App Settings

The App Settings section allows administrators to configure global behavior, branding, integrations, and operational preferences for the Secryn deployment.

These settings apply to the entire instance and affect all projects and vaults.

Only users with the Admin role can access and modify App Settings.

Overview

App Settings includes:

• Company Branding
• Email (SMTP) Configuration
• Multi-Factor Authentication (MFA)
• Social Login Providers
• Theme Customization (ShadCN)
• Export / Import Configuration
• System-Level Preferences

All changes are applied immediately after saving and may affect authentication, notifications, or UI appearance.

Company Branding

The Company Name is displayed throughout the application and is used in:

• Navigation headers
• Emails and notifications
• Footer metadata
• About modal

Updating the company name immediately reflects across the platform.

ShadCN Theme Customizer

Secryn allows administrators to apply a custom ShadCN theme configuration using a JSON blob.

This enables:

• Custom color palettes
• Border radius adjustments
• Accent styling
• Component theme overrides

To generate a compatible theme JSON, use the Shadcn Studio Theme Generator: https://shadcnstudio.com/theme-generator

You can:

• Paste a theme configuration
• Preview changes
• Reset to default
• Save and apply globally

Theme updates affect the entire UI and are applied instantly after saving.

Email Settings (SMTP)

Secryn uses SMTP for:

• Expiration notifications
• Digest emails
• User-related system notifications
• Auth-related emails, including MFA verification codes

You can configure:

• Mail Host
• Port
• Encryption (None / TLS / SSL)
• Username
• Password
• From Address
• From Name
• Test Connection

Before saving, you can send a test email to verify that SMTP is configured correctly.

If email notifications are enabled for users, system-generated emails will respect their notification preferences (except authentication-related emails, which are always sent).

Multi-Factor Authentication (MFA)

Administrators can use App Settings to configure MFA requirements and select which MFA methods are available across the Secryn deployment.

Email verification codes are the default MFA method. Administrators can also enable authenticator-app MFA, which uses a QR code during enrollment and provides one-time recovery codes.

MFA Requirements

• MFA is always required for administrators and cannot be disabled from an administrator's profile.
• Administrators can require MFA globally for other users.
• Protected pages remain inaccessible until the user completes MFA setup or verifies an existing MFA method.
• MFA challenges also apply after sign-in with Google, GitHub, Twitter (X), or Apple.
• MFA verification attempts are rate-limited.

Changes to global MFA settings take effect across the deployment. Users are prompted to enroll or verify as required by the updated configuration.

MFA Methods

The available MFA methods are:

• Email verification code — A time-limited code is sent to the user's email address. Recovery codes are not used for email-based MFA.
• Authenticator app — The user scans a QR code with a compatible authenticator app and enters the generated code to complete enrollment. One-time recovery codes are provided and should be stored securely.

Email-based MFA depends on a working SMTP configuration. Verify SMTP delivery before requiring email MFA so users can receive their authentication codes.

Managing User MFA

Administrators can review and manage user MFA access from the administrator controls in App Settings. If a user loses access to an enrolled method, an administrator can reset the user's MFA enrollment so the user can set it up again.

Reset MFA enrollment only after verifying the user's identity. Authenticator recovery codes must never be requested, viewed, or stored by an administrator.

Social Login Credentials

Secryn supports OAuth authentication providers.

You can configure:

• Google
• GitHub
• Twitter (X)
• Apple

Each provider requires:

• Client ID
• Client Secret
• Callback URL configuration

Social login is optional. If not configured, only local authentication will be available.

Signing in through a social provider does not bypass MFA. When MFA is required, the user must complete the MFA challenge before accessing protected pages.

Export / Import

Secryn supports exporting and importing App Settings as JSON. This is useful for:

• Promoting configuration between environments (dev -> staging -> production)
• Backing up instance configuration
• Standardizing settings across multiple deployments

Export Settings

From the Export section, you can download a JSON representation of the current App Settings.

By default:

• Secrets remain masked in the exported JSON.
• Sensitive values are not included unless explicitly requested.

This allows safe sharing of configuration structure without exposing credentials.

Include Secrets (Optional)

You may enable Include secrets during export.

When enabled:

• Sensitive values (such as SMTP passwords or OAuth secrets) are included in the JSON.
• These values will be visible in the export file.

The settings screen describes secrets included in an export as encrypted at rest and visible in the downloaded file. Treat that file as sensitive. Vault secret values are a different record: they are encrypted with Laravel encryption keyed by APP_KEY. This page does not name a cipher for SMTP passwords or OAuth client secrets.

Import Settings

The Import section allows you to paste a JSON payload and apply it to the current deployment.

When importing:

• Non-sensitive configuration (company name, theme settings, provider metadata) is applied directly.
• Secret values are only applied if explicitly included.

Imported SMTP passwords and OAuth client secrets are saved as settings values and masked again in the interface. Vault secret values, when stored as secrets, are encrypted with Laravel encryption keyed by APP_KEY.

Secret Handling During Import

If the imported JSON contains masked placeholders instead of real secret values:

• Secryn will ignore them.
• Existing stored secrets will remain unchanged.

This prevents accidental overwrites when importing configuration that was exported without secrets.

A warning banner is displayed to remind administrators to verify secret data before importing.

Audit & Security

Changes to App Settings are considered privileged operations.

Secryn's broader security model for App Settings also relies on RBAC, audit logs, HTTPS in transit, and self-hosted deployment control.

Best practices:

• Restrict access to Admin users only.
• Require MFA for all users who can access sensitive resources.
• Keep SMTP delivery working and tested when email verification codes are enabled.
• Instruct authenticator-app users to store their recovery codes securely and separately from their passwords.
• Verify a user's identity before resetting their MFA enrollment.
• Store exported JSON files securely.
• Avoid sharing exports that contain secrets.
• Review Audit Logs after major configuration changes.

All App Settings modifications should be traceable via logs.

Best Practices

• Configure SMTP before enabling expiration notifications.
• Verify SMTP delivery before requiring email-based MFA.
• Use environment-specific exports rather than manually duplicating configuration.
• Test OAuth providers after configuration.
• Test MFA after changing global requirements or available methods.
• Always verify imports in non-production environments before applying to production.

App Settings provides centralized control over how Secryn behaves and presents itself across your deployment. Proper configuration ensures secure operation, consistent branding, and reliable notifications.