Configuration
Configure your Micro instance to suit your needs.
Introduction
config.toml holds every setting that isn't a secret. Secrets go in environment variables.
In the container it lives at /app/config.toml. To mount it somewhere else, point MICRO_CONFIG_PATH at the new path. Most settings can also be changed from the instance settings in the app.
Note
Micro won't start unless at least one sign-in method is enabled.
origin
This is the public URL of your instance. Micro uses it for links and redirects, and passkeys only work when it matches the URL in the browser.
| Key | Type | Description | Default |
|---|---|---|---|
origin | string | The URL Micro is served on. | "http://localhost:3000" |
auth.passkeys
Passkeys let people sign in without a password.
| Key | Type | Description | Default |
|---|---|---|---|
enabled | bool | Whether passkeys can be used. | true |
auth.oidc
OIDC lets people sign in through your own identity provider, like Authentik or Keycloak. It also needs OIDC_CLIENT_SECRET.
| Key | Type | Description | Default |
|---|---|---|---|
enabled | bool | Whether OIDC sign-in is enabled. | false |
clientId | string | The client ID from your provider. | "" |
discoveryUrl | string | Your provider's .well-known/openid-configuration URL. | "" |
label | string | The name shown on the sign-in button. | "" |
usernameClaim | string | Which claim to use as the username. | "preferred_username" |
auth.email
People get a one-time sign-in code by email. This needs email to be set up.
| Key | Type | Description | Default |
|---|---|---|---|
enabled | bool | Whether email sign-in is enabled. | false |
auth.discord
Lets people sign in with their Discord account. It uses the client ID from discord and also needs DISCORD_CLIENT_SECRET.
| Key | Type | Description | Default |
|---|---|---|---|
enabled | bool | Whether Discord sign-in is enabled. | false |
auth.google
Lets people sign in with their Google account. It also needs GOOGLE_CLIENT_SECRET.
| Key | Type | Description | Default |
|---|---|---|---|
enabled | bool | Whether Google sign-in is enabled. | false |
clientId | string | Your Google OAuth client ID. | "" |
auth.apple
Lets people sign in with their Apple account. It also needs APPLE_PRIVATE_KEY.
| Key | Type | Description | Default |
|---|---|---|---|
enabled | bool | Whether Apple sign-in is enabled. | false |
clientId | string | Your Apple services ID. | "" |
teamId | string | Your Apple developer team ID. | "" |
keyId | string | The ID of your .p8 key. | "" |
discord
Discord sign-in and the Discord bot both use this application.
| Key | Type | Description | Default |
|---|---|---|---|
clientId | string | Your Discord application's client ID. | "" |
bot.enabled | bool | Whether the Discord bot is enabled. Needs DISCORD_BOT_TOKEN and DISCORD_BOT_SECRET. | false |
email
The SMTP server Micro sends email through. Set SMTP_PASSWORD if it needs a login.
| Key | Type | Description | Default |
|---|---|---|---|
enabled | bool | Whether Micro sends email. | false |
host | string | The SMTP host. | "" |
port | int | 465 for implicit TLS, 587 for STARTTLS. | 587 |
secure | bool | true when using port 465, false for 587. | false |
user | string | The SMTP username, if your server needs one. | "" |
from | string | Who emails come from, like "Micro <micro@example.com>". | "" |
assets
Uploads are stored either on disk or in an S3 bucket. Enable one, not both.
| Key | Type | Description | Default |
|---|---|---|---|
local.enabled | bool | Store uploads on disk, in /app/assets inside the container or MICRO_ASSETS_PATH if set. | false |
s3.enabled | bool | Store uploads in an S3 bucket. Needs S3_ACCESS_KEY_ID and S3_SECRET_ACCESS_KEY. | false |
s3.bucket | string | The bucket name. | "" |
s3.region | string | The bucket's region. | "" |
s3.endpoint | string | For S3-compatible services like MinIO, R2 or Garage. | |
s3.publicUrl | string | A public URL prefix, if files are served from a CDN. | |
upload.maxSizeMb | int | The largest file that can be uploaded, in megabytes. | 10 |