---
title: "Environment Administration"
slug: "environment-administration"
description: "Manage platform-wide settings in Environment Administration, including authentication, session management, and security policies for optimal performance."
tags: ["administration"]
updated: 2026-09-11T19:34:21Z
published: 2026-09-11T19:34:21Z
canonical: "docs.unqork.io/environment-administration"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.unqork.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Environment Administration

To access Environment Administration, navigate to **Administration** > **Environment** > **Environment Administration**.

Environment Administration manages platform-wide settings for authentication, session management, security policies, rate limiting, file uploads, and logging. All settings apply across the entire environment.

> [!WARNING]
> Modifying environment settings requires administrative permissions. Administrators needing access should contact their environment administrator.

## General

Basic environment settings including site name, logging, and default behaviors.

| Setting | Description |
| --- | --- |
| **Site Name** | The name of the environment. Displays in the browser tab. Required. |
| **Hide Preview Bar by Default** | When set to **ON**, this setting hides the preview bar by default across the environment. Default: **OFF**. |
| **PagerDuty Key** | A PagerDuty key for alerting on failed server-side execution requests. Default: none. |
| **Environment Style** | The style applied to the environment. Not editable from this page. |
| **Display Custom Login/Logout Settings for Applications** | When set to **ON**, this setting enables custom login and logout settings for applications in the environment. Default: **OFF**. |
| **Default Module** | The module loaded by default when no specific module is requested. Default: none. |

### Server-Side Execution Logging

Controls logging verbosity for server-side execution. Higher verbosity levels might affect performance.

| Setting | Description |
| --- | --- |
| **Server-Side Execution Request/Response Body Log** | Controls how request and response bodies are logged during Server-Side Execution. Default: **Do not capture request/response bodies**. [See options.](/unqorkai/docs/environment-administration#sse-body-log-options) |
| **Server-Side Execution Debug Log** | Controls debug logging verbosity during Server-Side Execution. Default: **Never capture debug logging**. [See options.](/unqorkai/docs/environment-administration#sse-debug-log-options) |
| **No of Days to Keep Tracker Record** | The number of days server-side execution tracker records are retained. Must be greater than 0. Default: 60. |

#### Server-Side Execution Request/Response Body Log options

| Option | Description |
| --- | --- |
| **Do not capture request/response bodies** | No request or response bodies are logged. |
| **Capture request/response bodies on failure** | Request and response bodies are logged only when a failure occurs. |
| **Capture request/response bodies** | All request and response bodies are logged. |

#### Server-Side Execution Debug Log options

| Option | Description |
| --- | --- |
| **Never capture debug logging** | Debug logging is disabled. |
| **Always capture debug logging** | Debug logging is always active. High verbosity can significantly increase memory usage. |

## Google Tag Manager

Configure Google Tag Manager for analytics and tracking.

| Setting | Description |
| --- | --- |
| **GTM Container ID** | The Google Tag Manager container identifier. Default: none. |
| **GTM Environment Authentication** | The authentication key for a specific GTM environment. Default: none. |
| **GTM Environment Preview** | The preview token for a specific GTM environment. Default: none. |

## Unqork API

| Setting | Description |
| --- | --- |
| **Enable OAuth2 Password Grant** | When set to **ON**, this setting enables the OAuth2 password grant type for API authentication. Default: **OFF**. |

## Authentication

Configure password requirements and login behavior for the environment.

| Setting | Description |
| --- | --- |
| **Disable Login Screen** | When set to **ON**, this setting bypasses the default login screen. Default: **OFF**. |

### Password Requirements

| Setting | Description |
| --- | --- |
| **Number of Days to Enforce Password Reset** | The number of days before end-users must reset their password. Must be greater than 0. Default: none (no reset enforced). |
| **Minimum Length** | The minimum number of characters required for passwords. Must be between 12 and 64. Default: 12. |
| **Maximum Length** | The maximum number of characters allowed for passwords. Must be between 12 and 64. Default: 64. |
| **Require Lowercase Letter** | When set to **ON**, passwords must include at least one lowercase letter. Default: **OFF**. |
| **Require Uppercase Letter** | When set to **ON**, passwords must include at least one uppercase letter. Default: **OFF**. |
| **Require Number** | When set to **ON**, passwords must include at least one number. Default: **OFF**. |
| **Require Symbol** | When set to **ON**, passwords must include at least one special character. Default: **OFF**. |

End-users cannot reuse any of their last 5 passwords.

> [!WARNING]
> Setting a password reset window also blocks API calls using Password Grant when the window is exceeded, unless the credentials belong to a Service User.

### Anonymous Access

| Setting | Description |
| --- | --- |
| **Disable Anonymous Access** | When set to **ON**, this setting prevents unauthenticated access to Express applications. Default: **OFF**. |

## API Rate Limiting

| Setting | Description |
| --- | --- |
| **Number of Requests per IP Address** | The maximum number of requests allowed from a single IP address per server per 60 seconds. Must be between 100 and 1,000,000. Default: 100,000. |

## Execution Limit

Controls the maximum number of iterations allowed during component and workflow execution to prevent infinite loops. An iteration is counted each time a component or workflow node executes as part of a chain—for example, a component that triggers another component repeatedly. These limits protect environment stability when logic is misconfigured.

| Setting | Description |
| --- | --- |
| **Looping Limit for Component Execution** | The maximum number of execution iterations for a component. Must be between 1 and 10,000. Default: 500. |
| **Looping Limit for Workflow Node Execution** | The maximum number of execution iterations for a workflow node. Must be between 1 and 10,000. Default: 500. |

## Express Session Administration

Configure how and when end-user sessions expire. Unqork manages sessions using a JWT with two embedded expiration times. The **Inactivity Timeout** controls how long the JWT remains valid after the last user action. The **Session Timeout** controls the maximum lifetime of the session regardless of activity.

| Setting | Description |
| --- | --- |
| **Expire User Sessions in Express** | Controls when end-user sessions end. • **Expiration on Browser Quit**: Ends sessions when the token expires or when the browser is closed. Recommended for strongest security. • **Expiration Only**: Ends sessions when the token expires. Default: **Expiration on Browser Quit**. |
| **Inactivity Timeout (Minutes)** | The number of minutes before a JWT token expires due to inactivity. Must be between 5 and 1,440 (24 hours). Default: 240. |
| **Session Timeout (Minutes)** | The number of minutes before a JWT refresh token expires, ending the session. Must be between 1 and 1,440 (24 hours). Default: 1,440. |

## Express Content Security Policy (CSP)

Configure allowed sources for the environment's Content Security Policy. Enter comma-separated hostnames. Maximum 2,000 characters per field. For an explanation of CSP and how each source list works, see [Environment Security Concepts](/unqorkai/docs/environment-security-concepts).

| Setting | Description |
| --- | --- |
| **Frame Source List** | Hostnames that can load as frames in this environment. Default: none. |
| **Frame Ancestors List** | Hostnames that can embed this environment in a frame. Default: none. |
| **Object Source List** | Hostnames that can serve as sources for object, embed, and applet elements. Default: none. |
| **Image Source List** | Hostnames that can serve as image sources. Default: none. |

## Cross-Origin Resource Sharing (CORS)

For an explanation of CORS and when to configure it, see [Environment Security Concepts](/unqorkai/docs/environment-security-concepts).

| Setting | Description |
| --- | --- |
| **Allowed Origins List** | Comma-separated list of origins allowed to make cross-origin requests to the environment. Maximum 2,000 characters. Default: none. |

## User Account Lockout

Configure automatic account lockout after repeated failed login attempts.

| Setting | Description |
| --- | --- |
| **Maximum Number of User Login Attempts** | The number of failed login attempts allowed before an account is locked. Must be between 2 and 10. Default: 5. |
| **User Account Lockout Duration (Minutes)** | The number of minutes an account remains locked after exceeding the login attempt limit. Must be between 5 and 120. Default: 30. |
| **User Login Attempt Duration (Minutes)** | The time window in which failed login attempts are counted. Must be between 5 and 120. Default: 30. |

## End User Account Password

Configure how end-users set their account password.

| Setting | Description |
| --- | --- |
| **Let User Set Password on Login** | End-users set their own password on first login. An email is sent with a login link that expires in 24 hours. Recommended. Default: selected. |
| **Choose Password** | Administrators set the password directly. Deprecated and less secure. |

## Component Security

| Setting | Description |
| --- | --- |
| **Disable Safe HTML Filters in Content Components** | When set to **ON**, disables HTML sanitization in Content components. Use with caution—disabling this setting might expose end-users to cross-site scripting (XSS) risks. Default: **OFF**. |

## Promote Translations

The **Promote Translations** action pushes all translation data from the current environment to a selected target environment. This action is available to environment administrators only and is accessible from the **Promote Translations** button in the Environment Administration page header.

Translations are stored separately from module definitions and are not included when a module is promoted through the standard promotions workflow. Administrators must promote translations independently to ensure higher environments display correct translated text.

To promote translations, complete the following:

1. Select **Promote Translations** in the Environment Administration header.
2. In the dialog, select the target environment from the drop-down.
3. Select **Promote** to confirm.

A success notification confirms when the promotion is complete. If the promotion takes longer than expected, it continues in the background. No action is needed.

> [!NOTE]
> Promoting translations pushes all translations in the current environment to the target. If a higher environment has no translations table, end-users see source language text for all translated fields until a promotion is completed.

## Designer Access (deprecated)

**Designer Access (Super-user)** is a deprecated Express role option that lets end-users create and edit applications in Module Builder without holding a Designer role. The **Designer Access (deprecated)** card at the bottom of Environment Administration retires the option for the entire environment.

To remove Designer Access (Super-user), complete the following:

1. Navigate to Express Role Administration and clear **Designer Access (Super-user)** on every Express role that has it enabled.
2. Return to Environment Administration and select **Remove Designer Access (Super-user)**.
3. Confirm the action in the dialog.

If any Express role still has the option enabled, an error notification lists those roles and no change is made. Clear them first, then try again.

> [!WARNING]
> This action is not reversible. Once Designer Access (Super-user) is removed, the option no longer appears on any Express role and all users who need Designer must be given a Designer role. The card disappears from Environment Administration.

## Quick Reference

| Task | URL |
| --- | --- |
| Check platform version | `https://[your-environment-url]/version` |

---

**Changelog**

| Date | Change |
| --- | --- |
| 2026-07-10 | Added DocsSettingsSection interactive mockups and default values to all settings. |
| 2026-08-11 | Added Promote Translations section (EN-7993). |
| 2026-08-20 | Added Designer Access (deprecated) section and corrected the Server-Side Execution Debug Log option labels. |
| — | Initial publication. |

API rate limiting is a form of security and quality control for managing access to an API. Rate limiting an API increases security by preventing malicious actors from overwhelming the API with requests that violate the policies set by the API's Owner. Rate limiting also increases quality control by increasing relability and minimizing response times for end-users accessing the API.

A key-value pair is a fundamental data structure where a unique "key" is associated with a specific "value," used for organizing and retrieving data efficiently, like in dictionaries or databases.

Includes the Short Answer component, Long Answer component, Select Boxes, Radio component, Dropdown, Number component and Single Checkbox.

Debugging is the process of finding and resolving errors or bugs in an application. To debug an application in Unqork, use UNQENG tools in Express View.

An object is a type of data structure that represents a single, self-contained entity that acts as a container for the characteristics of that entity.

Elements are are what you use to build Unqork applications. Elements include modules, workflows, Data Collections, Data Schema, and Record Collections.

Cross-Origin Resource Sharing (CORS) lets you control access to resources located outside a given domain.

The Number data type accepts integer or floating point values. The number data type does not use quotes around numerical values.

End-users, also known as Express Users, are the individuals accessing an application through Express View. In most cases, end-users are the customers using the product.

HTML (Hyper Text Markup Language) is the standard markup language for for achieving font, color, graphic, and hyperlink effects when creating web pages.

Cross Site Scripting attacks vulnerability used by malicious entities to bypass the access controls of a website.

The Unqork front-end application framework that delivers Creator-built applications to end-users. Express is the layer end-users interact with—the published forms, screens, and navigation built in the Module Builder. Express is distinct from Express View, which is a Creator-facing preview tool in the IDE.

A URL (uniform resource locator) is a unique identifier used to locate a resource on the internet. Also known as a web address.

## Related

- [Audit Logs](/audit-logs-overview.md)
- [Refer Strings](/refer-strings.md)
- [Refer Strings](/refer-strings-1.md)