Configuration

s3BEAR is configured through environment variables. The full list lives in .env.example; the most important ones are below. Runtime settings such as auth toggles, auto-provisioning, and quotas can also be changed from Settings in the UI without a redeploy.

Core

Variable	Default	Purpose
`SECRET_KEY`	—	JWT signing key (min 32 chars, required)
`APP_NAME`	`s3BEAR`	Application name
`DEBUG`	`false`	Debug mode
`ALLOWED_ORIGINS`	`["http://localhost:3000"]`	CORS allow-list for the frontend origin(s)
`DATABASE_URL` / `DATABASE_URL_SYNC`	localhost	Async / sync (Alembic) database connections
`AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY`	`""`	Credentials for the default S3 connection
`AWS_REGION`	`us-east-1`	S3 region
`AWS_ENDPOINT_URL`	`""`	S3 endpoint (for MinIO / compatible backends)

JWT & sessions

Variable	Default	Purpose
`JWT_ALGORITHM`	`HS256`	JWT signing algorithm
`ACCESS_TOKEN_EXPIRE_MINUTES`	`30`	Access-token lifetime
`REFRESH_TOKEN_EXPIRE_DAYS`	`7`	Refresh-token lifetime
`DEFAULT_ADMIN_EMAIL`	`[email protected]`	Seeded admin on first run
`DEFAULT_ADMIN_PASSWORD`	generated	Seeded admin password (random if unset — check the backend log)

Uploads & presigned URLs

Variable	Default	Purpose
`PRESIGNED_URL_BASE`	`""`	External URL the browser uses to reach S3 (critical for multipart)
`MULTIPART_PART_SIZE_MB`	`10`	Multipart part size
`PRESIGNED_URL_EXPIRY_SECONDS`	`1800`	Presigned URL lifetime

PRESIGNED_URL_BASE must point to the S3-compatible host the browser can reach. A mismatch causes 403 SignatureDoesNotMatch. See Uploading Objects and Troubleshooting.

Image transforms

Variable	Default	Purpose
`MAX_IMAGE_TRANSFORM_MB`	`25`	Source-size cap for on-the-fly image transforms (413 on breach)

See Image Serving & Transforms.

Webhooks

Variable	Default	Purpose
`WEBHOOKS_ENABLED`	`true`	Enable webhook enqueue + dispatch
`WEBHOOK_MAX_ATTEMPTS`	`4`	Delivery attempts before a webhook is marked failed
`WEBHOOK_TIMEOUT_SECONDS`	`10`	Per-delivery HTTP timeout
`WEBHOOK_DELIVERY_RETENTION_DAYS`	`30`	How long delivery records are kept

See Webhooks.

Auth (Azure Entra)

Variable	Default	Purpose
`AZURE_TENANT_ID` / `AZURE_CLIENT_ID` / `AZURE_CLIENT_SECRET`	`""`	Entra SSO credentials
`AZURE_REDIRECT_URI`	`.../auth/callback`	OIDC redirect target
`AZURE_AUTHORITY`	derived	Overrides the authority URL (defaults to `login.microsoftonline.com/<tenant>`)

See Authentication.

Audit logging

Variable	Default	Purpose
`AUDIT_LOG_ENABLED` / `AUDIT_LOG_FILE_ENABLED`	`true`	Audit logging (database / file)
`AUDIT_LOG_PATH`	`/var/log/s3bear/audit`	Directory for the flat-file audit mirror
`AUDIT_LOG_RETENTION_DAYS`	`90`	File audit retention

See Audit Log.

Related: Deployment · CORS Setup