# Settings
URL: https://synquic.tech/docs/dashboard/settings.md

The Settings screen, one tab at a time. General, Security & 2FA, Git, Credentials, API tokens, MCP, Users & team, Notifications, Email, Cloudflare Tunnel, Infrastructure and Instance, with panel backups and updates.

Settings is where you configure everything that isn't tied to a single project: your own sign-in, how you connect
to Git, the tokens and AI clients that talk to your API, who's on your team, and how this install itself is run,
backed up and updated.

Open it from the sidebar (the **Settings** item), or go straight to **`/settings`**. The screen has a tab list on
the right (a horizontal strip on mobile). Each tab is also directly linkable with a `?tab=` query, for example
`/settings?tab=team`, so you can bookmark or share the exact place you mean.

| Tab | `?tab=` | What it holds |
| --- | --- | --- |
| **General** | (none) | Build preferences, language, full platform or mail-only view, interface preferences |
| **Security & 2FA** | `security` | Two-factor authentication for your own password sign-in |
| **Git** | `git` | Self-hosted GitHub Apps, the GitHub connection, clone credentials |
| **Credentials** | `credentials` | Tokens and logins Synq uses for you: private registries, DNS providers (admins) |
| **API tokens** | `tokens` | Personal access tokens for the API, CLI and MCP |
| **MCP** | `mcp` | The MCP endpoint, client recipes and connected AI clients |
| **Users & team** | `team` | Members, invitations and roles |
| **Notifications** | `notifications` | Delivery channels and what you're notified about |
| **Email** | `email` | The mail transport invitations and alerts are sent from (admins) |
| **Certificates** | (link) | Opens **Domains**, **Certificates** |
| **Storage providers** | (link) | Opens **Backups**, where backup destinations are managed |
| **Cloudflare Tunnel** | `tunnel` | Serving apps behind a Cloudflare Tunnel or another TLS-terminating proxy |
| **Infrastructure** | `infrastructure` | Edge and mail containers across your servers, leftover edge routes (admins) |
| **Instance** | `instance` | This install: version, apps domain, updates, panel backups, data export and import |

<Callout title="Some tabs and sections only appear in some setups" type="info">
**Security & 2FA** appears only where you sign in with a password. Within **Instance**, **Panel backups** and data
export/import appear only for instance administrators on a self-hosted install. The **Audit log** is not a Settings
tab: it has its own page in the sidebar (see [Audit log](/docs/guides/audit-log)).
</Callout>

## General

Build preferences for new deployments (self-hosted), the dashboard **Language**, whether you see the full platform or
only the mail tools, and interface preferences.

### Build Preferences

*(Self-hosted.)* Choose the default build strategy for new deployments: **Auto** (smart per-framework), **Server**
(build on the remote) or **Local** (build on this machine). Per-project overrides live in the project's own settings.

### Language

Choose the language used across the dashboard. The change applies immediately.

## Security & 2FA

Turn two-factor authentication on or off for your own account, and generate new backup codes. The card also shows
the recovery command for a locked-out owner, `synq reset-admin-password`. See
[Two-factor authentication](/docs/guides/two-factor).

## Git

The **Git** tab owns outbound source-control access. On self-hosted instances, workspace owners first see
**Self-hosted GitHub Apps**, where they can create Apps with GitHub's manifest flow, register an existing GitHub or
GitHub Enterprise App, manage installations, rotate credentials, verify health, and choose a default source. See
[Self-hosted GitHub Apps](/docs/guides/self-hosted-github-app).

The **GitHub** connection card underneath manages the separate local `gh`/device/token identity and the managed App
fallback. When workspace-owned Apps exist, their install, manage and delete controls remain exclusively in the source
cards, so **Disconnect** cannot misleadingly remove only an unrelated OAuth account.

The **GitHub clone credentials** card stores a personal token fallback for private clones.

See [Deploy from GitHub](/docs/guides/deploy-from-github) for the full walk-through.

## API tokens

**Personal Access Tokens** are bearer tokens for the API, CLI and MCP clients. Each token **acts as you**: it carries
your role's permissions unless you narrow it. When creating one you can:

- Name it (for example "MCP client").
- Set an expiry: **No expiry**, **30 days**, **90 days** or **1 year**.
- Mark it **Read-only** to block all writes.
- **Limit to specific resources** to scope it below your own role, ideal for a narrow MCP token.

Press **Create token**, then copy it immediately: this is the only time the value is shown. Existing tokens are
listed with **read-only** / **scoped** badges, last use, expiry and call count, and a **Revoke** button. See
[Authentication](/docs/security/auth#personal-access-tokens-bearer).

<Callout title="Copy the token now" type="warn">
A new token's value is displayed once, at creation. If you lose it you can't recover it: revoke it and make a new
one.
</Callout>

## MCP

Connect AI agents (Claude, Cursor, VS Code, Windsurf, …) to your Synq API over the Model Context Protocol. The tab
shows this install's **Endpoint**, a Streamable-HTTP JSON-RPC URL on the panel's host
(`https://app.<domain>/api/mcp`), plus per-client install snippets.

Two ways to authenticate:

- **OAuth**: the client opens a browser to authorize; you approve access and pick what it can reach. Nothing to copy.
- **Static token**: for clients without OAuth, put a fixed, scoped token (created in **API tokens**) into the client
  config.

**Connected clients** lists every authorized client with its access level (**Read-only** or **Full control**) and
resource scope, with **Edit access**, **Activity** (its entries in the audit log) and **Disconnect**. See
[MCP](/docs/mcp).

## Users & team

Who can reach this workspace's projects, deployments and servers. See
[Teams & members](/docs/guides/teams-members) for the full workflow.

- **Active members**: everyone with access, their role, and a **Remove member** action (owners and admins). Only the
  owner changes roles.
- **Pending invitations**: invites you've sent that haven't been accepted yet, with **Copy invitation link**.
- **Invite member**: email a join link. Pick a role: **Member** (read and write to everything), **Admin** (Member
  plus managing members) or **Restricted** (no default access: you choose exactly which resources to unlock).
  Restricted invites open a resource picker.

The **⋮** menu next to the heading holds **Create a team organization** (from your personal workspace), **Manage
workspace** (team owners) or **Leave workspace** (other team members). Until the panel has a public address, the tab
explains how to give it one, since invitations need it.

## Notifications

Decide what you get told about and where it goes. Full walkthrough: [Notifications](/docs/guides/notifications).

- **Delivery channels**: your own destinations. Add **Email**, **Webhook**, **Slack**, **Discord**, **Microsoft
  Teams**, **Telegram**, **ntfy**, **Gotify**, **Pushover**, **Mattermost** or **Matrix**. A new channel is
  **Unverified** and receives nothing until **Send test** succeeds. The **In-app** dashboard bell is always on.
- **What to be notified about**: a table of events (deploys, app health and server alerts, backups, jobs,
  certificates and domain verification, members, watched mail), grouped in tabs. **Notify me** is your own
  on/off per event across all your channels.
- **Organization defaults** (admins and owners): for each event, whether it's on for members who haven't chosen,
  and which channel kinds it goes to (email by default).

## Instance

Everything about *this install*. Two cards at the top show the instance type (**Self-Hosted**) with its deploy mode
and version, and the auth mode (**Local Auth**) with the signed-in user. On an instance that opted into
[zero-auth loopback](/docs/security/auth#zero-auth-loopback-mode) the auth card reads **Zero Auth**, and a **Change**
link lets you add an email and password login without losing any projects or history.

### Apps domain

*(Self-hosted, instance administrators.)* The domain free app subdomains use (`<app>.<apps domain>`): the one in
use and where it comes from (set on the server, set here, the panel's own domain, or the server's IP through
sslip.io), the wildcard DNS record it needs and whether that record points at this server (**Check DNS**). Type a
domain and **Save** to set it, or **Clear** to go back to the panel's domain or sslip.io. While the server's
configuration sets one, the field is read-only and names the `sudo synq apps-domain` command that changes it.
Changing it doesn't move existing apps. See [Free subdomains](/docs/guides/custom-domains#free-subdomains).

### Updates

*(Self-hosted.)* Shows the panel's current version, a **Check now** button, a toggle for **Update & security
notifications**, and **View changelog & releases** (the changelog on synquic.tech). The check only ever *pulls*
release data; nothing can push updates to your install. To update, run the installer again on the server, as
described in [Updating Synq](/docs/guides/updating).

### Panel backups

*(Self-hosted, instance administrators.)* Back up this control plane's own database to a backup destination on a
schedule: **Destination**, **Back up on a schedule**, **Schedule (cron)** (default every day at 02:11), **Keep the
newest** N backups, and **Include instance settings (.env)**. **Back up now** runs one immediately, **Show stored
backups** lists what the destination holds, and **How to restore** gives the restore commands. See
[Back up and restore the panel](/docs/guides/panel-backups).

### Export / Import data

*(Self-hosted, instance administrators only.)* **Export instance or projects** downloads a portable JSON
file. Choose the entire instance, or select projects and individual environments in bulk. The same project export is
available in **Project**, **Advanced**, **Export project**, with all of that project's environments selected by
default.

Project exports include deployments, service configuration, environment variables, linked apps, routing, backup
policies and destinations, and Git credentials. Related self-hosted servers are recommended and included by default.
You can choose which configuration and history to include. Environment values, private keys, deployment snapshots,
inline Compose configuration, and credentials require a transfer password and are sealed in the file; save that
password separately.

**Import data** uploads the file once and previews its contents. Select the environments to import into the current
workspace, review conflicts, and map source servers to destination servers. Matching self-hosted servers are reused
with their existing connection credentials. Existing projects are skipped by default; **Overwrite matching project
records** updates imported configuration while retaining destination-only records. Individual projects can override
that choice. Shared integrations and backup destinations are reused unless you explicitly choose to overwrite shared
settings.

A source control-plane host always needs an explicit target mapping. Projects mapped to a different host arrive
disabled with live container references cleared, ready for a migration or redeployment.

Loopback SSH addresses also require explicit mapping. Backup schedules that use a source-local folder or a different
backup host arrive disabled; reconnect the storage, verify it, and then enable the schedules.

Exports contain control-plane metadata. Volume contents, database payloads, source folders, and host TLS files stay
on their server. Keep using that server, or move the runtime data with migration or backup restore. Reconnect local
source folders and update Git and webhook callback URLs when the control-plane address changes. The import result
keeps these follow-up notes available.

Direct transfer continues to move an entire instance. Use an export file for project selections so you can review
conflicts and server mappings on the destination before applying them.

<Callout title="Import can wipe this instance" type="warn">
An instance archive also offers **Entire instance**, with merge or full replacement. Replacement erases all
destination data and signs you out. A project archive can never wipe an instance. Only an **instance administrator**
can export or import, and restoring credentials requires the original password.
</Callout>

## Related guides

<Cards>
  <Card title="Teams & members" href="/docs/guides/teams-members" description="Invite people and choose their roles." />
  <Card title="Two-factor authentication" href="/docs/guides/two-factor" description="Protect your sign-in with an authenticator app." />
  <Card title="Back up and restore the panel" href="/docs/guides/panel-backups" description="Scheduled backups of Synq's own database." />
  <Card title="MCP" href="/docs/mcp" description="Connect AI agents to your server." />
</Cards>