Settings Reference
Settings is administrator-only and has six tabs. Most settings take effect immediately, without a restart.
Settings stored here override the equivalent environment variable. Environment variables set the initial value; the database is the source of truth afterwards.
Read-only. Shows the exact ID Server and Relay Server values to enter in a RustDesk client, ready to copy. Nothing to configure — it exists so you are not retyping values from memory when setting up a machine.
To point a client at CortenDesk, set its API Server to the console URL, plus the ID Server, Relay Server and Key from here. See Devices.
| Setting | Default | What it does |
|---|---|---|
| ID server | — | Your hbbs address, host:21116. Shown to clients. |
| Relay server | — | Your hbbr address, host:21117. |
| Public key | — | Contents of id_ed25519.pub from the RustDesk server. Must match exactly — see the warning below. |
| Online window |
60 seconds |
How long after its last heartbeat a device still counts as online. Raise it if devices flicker on unreliable links. |
| Require device approval | Off | New devices register as pending and stay hidden until an administrator approves them. |
| rdgen URL | — | Link to an rdgen instance for building custom clients. Adds the Build Installers item to the sidebar. Leave blank to hide it. |
Whitespace in the public key. The key is compared exactly. A trailing newline or space picked up when copying through an editor makes it mismatch, and the symptom is indistinguishable from a genuinely wrong key — clients simply fail to connect. Paste it with no surrounding whitespace.
| Setting | Default | What it does |
|---|---|---|
| Require 2FA for everyone | Off | Every user must enrol in TOTP before using the console. |
| Require 2FA for administrators | Off | Same, administrators only. |
| Emailed sign-in verification | Off | Sends a one-time code when someone signs in from an unrecognised browser. Requires working SMTP. |
| Trusted device days | 30 |
How long a browser stays remembered after a successful emailed code, before it is challenged again. |
Requiring 2FA with no way to enrol will lock people out — read Two-factor authentication first, and note the break-glass command in the command-line reference.
SMTP for invitations, password resets and sign-in codes.
| Setting | Notes |
|---|---|
| Enable SMTP | Master switch. With it off, nothing is sent. |
| Host / Port | Your relay. |
| Encryption | TLS, STARTTLS or none, matching your relay. |
| Username / Password | Blank for an unauthenticated relay. |
| From address / From name | Must be an address your relay is allowed to send as. |
| Send test to | Sends a real message and reports the exact error on failure. |
Use the test send before relying on any email feature. It surfaces the provider's own error text, which is usually the fastest way to a fix.
Without working SMTP: no invitations, no self-service password reset, no emailed sign-in codes. Administrators are warned in the console when SMTP is unset, because account recovery silently depends on it.
See Email, invitations and password reset.
OpenID Connect for both the console and RustDesk clients. Full walkthrough in Single sign-on (OIDC) — the fields are:
| Setting | Notes |
|---|---|
| Enable SSO | Master switch. |
| Discovery URL | Provider's .well-known/openid-configuration. |
| Public base URL | Override when the browser reaches the provider at a different address than the server does — split-horizon DNS, or a container network. |
| Client ID / Client secret | From your provider. |
| Scopes | Defaults are sufficient for most providers. |
| Button label | Text on the sign-in button. |
| New user policy | What happens on first sign-in by an unknown user. |
| Default administrator | Whether provisioned users become administrators. Leave off. |
| Default group | User group new accounts join. |
| Allowed email domains | Restrict which domains may sign in. |
| Require verified email | Off by default deliberately: some providers send email_verified: false as a matter of policy, and turning this on rejects those users. |
| Provider sign-out | Also sign out of the identity provider on logout. |
| Disable local login | Hides password sign-in. |
Before you disable local login, know how to get back in. Password sign-in returns automatically only when SSO stops being usable as configured — that is, SSO is switched off, or its discovery URL, client ID or client secret is blank. A provider that is merely unreachable or broken while still fully configured does not restore password sign-in on its own.
For that case the break-glass is an environment variable on the server:
CORTENDESK_OIDC_DISABLED=trueIt forces SSO off regardless of the stored settings and brings the password form back. Set it, restart, sign in, fix the provider.
| Setting | Default | What it does |
|---|---|---|
| Log retention days | 365 |
Age at which audit rows are deleted. 0 keeps everything forever. |
| Prune now | — | Runs the prune immediately and reports rows deleted. |
Retention covers connections, file transfers, logins, alarms and the console audit trail. Automatic pruning needs the scheduler — running inside the Docker image already, but a manual install must add the cron entry.