Configuration

Configuration lives under Platform Admin and holds instance-level settings — these apply to the whole CYPEX deployment, not to a single organization:

Configuration

Session length and Connector internal/local targets are the two instance-wide settings exposed here.

Sets how long a session stays valid before the user must sign in again, using a duration string — 7d for 7 days, 24h for 24 hours, or 60m for 60 minutes. Click Edit to apply the value shown in the field, or Reset to restore the previous value. It writes cypex.t_config.jwt_exp.

The field helper text states the floor explicitly (minimum 30m at the default 15m access-token lifetime) and notes that access tokens renew on their own schedule regardless of this setting. New sessions pick up the change immediately; SSO sessions pick it up when the SSO gateway next restarts.

Info

Despite the storage key name (jwt_exp), this is the session length — the refresh-token lifetime — not the access-token lifetime. In v2.0.0 the access token is short-lived (JWT_EXPIRES_IN, default 15m) and is renewed against this session bound. Full model: Sessions and tokens.

Warning

The value must be at least 2× the access-token lifetime — 30m at the default 15m access TTL. Shorter values are rejected. A session shorter than its own access token would end when the access token expires rather than when you configured it to, and the renewal that re-checks whether the user is still active would never run.

Shorter sessions reduce the exposure window if a refresh token leaks, at the cost of forcing users to sign in again more often.

Controls whether connector allowlist entries marked as internal/local targets are allowed to reach private-network addresses — Docker containers, k8s pods, on-premise hosts. This is off by default because it relaxes SSRF (Server-Side Request Forgery) protections for those exact host:port entries.

Warning

Only enable Allow connectors to reach internal/local network targets if the deployment runs on a trusted private network. Leaving it off keeps the default SSRF protections in place for every connector allowlist entry.

See Allowlist for how individual internal/local target entries are added, and Connector Execution for the broader connector security model this toggle sits within.

• Sessions and tokens — the access/refresh model this setting bounds, and the related environment variables.
• Login Settings — per-tenant login-page branding.
• Allowlist — per-entry connector network targets.
• Migrations — apply schema-level migrations.