Configuration Reference

AuthForge is designed to be highly configurable via Code, YAML, or Environment Variables.

1. Security Settings (SecurityConfig)

These settings control the fundamental guardrails of the system.

Parameter	Default	Environment Variable	Description
bcrypt_rounds	12	AUTHFORGE_BCRYPT_ROUNDS	Computational cost for password hashing.
max_login_attempts	5	AUTHFORGE_MAX_ATTEMPTS	Failed attempts allowed before a temporary lockout.
lockout_minutes	30	AUTHFORGE_LOCKOUT_MIN	Duration of the defensive lockout.
password_min_length	10	AUTHFORGE_MIN_PASS_LEN	Enforced minimum length for all user passwords.
breach_detection_enabled	True	AUTHFORGE_BREACH_DETECTION	Checks passwords against known data breaches (HIBP).
anomaly_detection_enabled	True	AUTHFORGE_ANOMALY_DETECTION	Toggles the risk-scoring engine on/off.
email_verification_required	True	AUTHFORGE_EMAIL_VERIFY	Blocks login until email is confirmed.

2. JWT Settings (JWTConfig)

Parameter	Default	Description
secret	""	REQUIRED. The secret key for signing tokens.
algorithm	HS256	The algorithm used for JWT signatures.
access_token_expire_minutes	15	How long an access token is valid.
refresh_token_expire_days	30	How long a refresh token is valid.

3. Database Settings (DatabaseConfig)

Parameter	Default	Description
url	sqlite+aiosqlite:///./authforge.db	The SQLAlchemy connection string.

4. MFA Settings (MFAConfig)

Parameter	Default	Description
enabled	True	Toggles all MFA features.
issuer	AuthForge	The name shown in the user's Authenticator app.
code_expire_seconds	300	How long an MFA setup/verify code is valid.

Configuration Priority

1. Environment Variables (Highest)
2. YAML File (authforge.yaml)
3. Code Constructor (Auth(...))
4. Library Defaults (Lowest)