Settings

Settings is where you configure everything that isn't tied to a single project: your own sign-in, how you connect to Git, the tokens and AI clients that talk to your API, who's on your team, and how this install itself is run, backed up and updated.

Open it from the sidebar (the Settings item), or go straight to /settings. The screen has a tab list on the right (a horizontal strip on mobile). Each tab is also directly linkable with a ?tab= query, for example /settings?tab=team, so you can bookmark or share the exact place you mean.

General

Build preferences for new deployments (self-hosted), the dashboard Language, whether you see the full platform or only the mail tools, and interface preferences.

Build Preferences

(Self-hosted.) Choose the default build strategy for new deployments: Auto (smart per-framework), Server (build on the remote) or Local (build on this machine). Per-project overrides live in the project's own settings.

Language

Choose the language used across the dashboard. The change applies immediately.

Security & 2FA

Turn two-factor authentication on or off for your own account, and generate new backup codes. The card also shows the recovery command for a locked-out owner, synq reset-admin-password. See Two-factor authentication.

Git

The Git tab owns outbound source-control access. On self-hosted instances, workspace owners first see Self-hosted GitHub Apps, where they can create Apps with GitHub's manifest flow, register an existing GitHub or GitHub Enterprise App, manage installations, rotate credentials, verify health, and choose a default source. See Self-hosted GitHub Apps.

The GitHub connection card underneath manages the separate local gh/device/token identity and the managed App fallback. When workspace-owned Apps exist, their install, manage and delete controls remain exclusively in the source cards, so Disconnect cannot misleadingly remove only an unrelated OAuth account.

The GitHub clone credentials card stores a personal token fallback for private clones.

See Deploy from GitHub for the full walk-through.

API tokens

Personal Access Tokens are bearer tokens for the API, CLI and MCP clients. Each token acts as you: it carries your role's permissions unless you narrow it. When creating one you can:

• Name it (for example "MCP client").
• Set an expiry: No expiry, 30 days, 90 days or 1 year.
• Mark it Read-only to block all writes.
• Limit to specific resources to scope it below your own role, ideal for a narrow MCP token.

Press Create token, then copy it immediately: this is the only time the value is shown. Existing tokens are listed with read-only / scoped badges, last use, expiry and call count, and a Revoke button. See Authentication.

MCP

Connect AI agents (Claude, Cursor, VS Code, Windsurf, …) to your Synq API over the Model Context Protocol. The tab shows this install's Endpoint, a Streamable-HTTP JSON-RPC URL on the panel's host (https://app.<domain>/api/mcp), plus per-client install snippets.

Two ways to authenticate:

• OAuth: the client opens a browser to authorize; you approve access and pick what it can reach. Nothing to copy.
• Static token: for clients without OAuth, put a fixed, scoped token (created in API tokens) into the client config.

Connected clients lists every authorized client with its access level (Read-only or Full control) and resource scope, with Edit access, Activity (its entries in the audit log) and Disconnect. See MCP.

Users & team

Who can reach this workspace's projects, deployments and servers. See Teams & members for the full workflow.

• Active members: everyone with access, their role, and a Remove member action (owners and admins). Only the owner changes roles.
• Pending invitations: invites you've sent that haven't been accepted yet, with Copy invitation link.
• Invite member: email a join link. Pick a role: Member (read and write to everything), Admin (Member plus managing members) or Restricted (no default access: you choose exactly which resources to unlock). Restricted invites open a resource picker.

The ⋮ menu next to the heading holds Create a team organization (from your personal workspace), Manage workspace (team owners) or Leave workspace (other team members). Until the panel has a public address, the tab explains how to give it one, since invitations need it.

Notifications

Decide what you get told about and where it goes. Full walkthrough: Notifications.

• Delivery channels: your own destinations. Add Email, Webhook, Slack, Discord, Microsoft Teams, Telegram, ntfy, Gotify, Pushover, Mattermost or Matrix. A new channel is Unverified and receives nothing until Send test succeeds. The In-app dashboard bell is always on.
• What to be notified about: a table of events (deploys, app health and server alerts, backups, jobs, certificates and domain verification, members, watched mail), grouped in tabs. Notify me is your own on/off per event across all your channels.
• Organization defaults (admins and owners): for each event, whether it's on for members who haven't chosen, and which channel kinds it goes to (email by default).

Instance

Everything about this install. Two cards at the top show the instance type (Self-Hosted) with its deploy mode and version, and the auth mode (Local Auth) with the signed-in user. On an instance that opted into zero-auth loopback the auth card reads Zero Auth, and a Change link lets you add an email and password login without losing any projects or history.

Apps domain

(Self-hosted, instance administrators.) The domain free app subdomains use (<app>.<apps domain>): the one in use and where it comes from (set on the server, set here, the panel's own domain, or the server's IP through sslip.io), the wildcard DNS record it needs and whether that record points at this server (Check DNS). Type a domain and Save to set it, or Clear to go back to the panel's domain or sslip.io. While the server's configuration sets one, the field is read-only and names the sudo synq apps-domain command that changes it. Changing it doesn't move existing apps. See Free subdomains.

Updates

(Self-hosted.) Shows the panel's current version, a Check now button, a toggle for Update & security notifications, and View changelog & releases (the changelog on synquic.tech). The check only ever pulls release data; nothing can push updates to your install. To update, run the installer again on the server, as described in Updating Synq.

Panel backups

(Self-hosted, instance administrators.) Back up this control plane's own database to a backup destination on a schedule: Destination, Back up on a schedule, Schedule (cron) (default every day at 02:11), Keep the newest N backups, and Include instance settings (.env). Back up now runs one immediately, Show stored backups lists what the destination holds, and How to restore gives the restore commands. See Back up and restore the panel.

Export / Import data

(Self-hosted, instance administrators only.) Export instance or projects downloads a portable JSON file. Choose the entire instance, or select projects and individual environments in bulk. The same project export is available in Project, Advanced, Export project, with all of that project's environments selected by default.

Project exports include deployments, service configuration, environment variables, linked apps, routing, backup policies and destinations, and Git credentials. Related self-hosted servers are recommended and included by default. You can choose which configuration and history to include. Environment values, private keys, deployment snapshots, inline Compose configuration, and credentials require a transfer password and are sealed in the file; save that password separately.

Import data uploads the file once and previews its contents. Select the environments to import into the current workspace, review conflicts, and map source servers to destination servers. Matching self-hosted servers are reused with their existing connection credentials. Existing projects are skipped by default; Overwrite matching project records updates imported configuration while retaining destination-only records. Individual projects can override that choice. Shared integrations and backup destinations are reused unless you explicitly choose to overwrite shared settings.

A source control-plane host always needs an explicit target mapping. Projects mapped to a different host arrive disabled with live container references cleared, ready for a migration or redeployment.

Loopback SSH addresses also require explicit mapping. Backup schedules that use a source-local folder or a different backup host arrive disabled; reconnect the storage, verify it, and then enable the schedules.

Exports contain control-plane metadata. Volume contents, database payloads, source folders, and host TLS files stay on their server. Keep using that server, or move the runtime data with migration or backup restore. Reconnect local source folders and update Git and webhook callback URLs when the control-plane address changes. The import result keeps these follow-up notes available.

Direct transfer continues to move an entire instance. Use an export file for project selections so you can review conflicts and server mappings on the destination before applying them.

Related guides