Configuration reference

Every Bitwarden Server service binds the same root globalSettings: configuration section into GlobalSettings (src/Core/Settings/GlobalSettings.cs). This page lists the most-used sub-sections.

Top-level

Property	Used for
globalSettings.SelfHosted	Switch between cloud and self-host code paths.
globalSettings.ProjectName	Process-name string used in startup logs.
globalSettings.SiteName	Display name in emails.
globalSettings.LogDirectory	Where rolling-file logs go (self-host).
globalSettings.LogRollBySizeLimit	File-rotation size in bytes.
globalSettings.OidcIdentityClientKey	Shared secret between Identity and Sso.
globalSettings.LicenseKey	Self-host installation license.
globalSettings.Installation.Id / .Key	Installation identity (issued by cloud install API).

Database

globalSettings.SqlServer.ConnectionString — primary SQL Server connection. globalSettings.MySql.ConnectionString — MySQL/MariaDB. globalSettings.PostgreSql.ConnectionString — Postgres. globalSettings.Sqlite.ConnectionString — SQLite.

globalSettings.DatabaseProvider — one of sqlServer | mySql | postgreSql | sqlite. Selects which IXxxRepository implementation set is registered.

Storage

Property	Notes
globalSettings.Storage.ConnectionString	Generic storage account (Azurite in dev).
globalSettings.Attachment.BaseDirectory / .ConnectionString	Cipher attachment storage.
globalSettings.Send.ConnectionString	Send file storage.
globalSettings.Events.ConnectionString	Events queue + sink.

Identity / auth

Property	Notes
globalSettings.IdentityServer.CertificateThumbprint (or CertificatePassword)	IdentityServer signing cert.
globalSettings.DataProtection.Directory	Self-host data-protection key location.
globalSettings.PasswordHasher.Iterations	Server-side PBKDF2 iterations.
globalSettings.LoginPolicies	Master-password login lockout config.
globalSettings.Captcha.HCaptchaSiteKey / HCaptchaSecretKey	hCaptcha site & secret keys.
globalSettings.SecondaryEncryptionService.*	(advanced) override for sealed payloads.
globalSettings.PasswordlessAuth.KnownDevicesOnly / etc.	(src/Core/Auth/Settings/PasswordlessAuthSettings.cs) Login-with-device tweaks.

Notifications & push

Property	Notes
globalSettings.Notifications.ConnectionString	URL of the Notifications service or queue.
globalSettings.PushHub.ConnectionString / .HubName	Azure Notification Hub.
globalSettings.RelayPushNotificationKey / .Url	Self-host → cloud-relay credentials.

Mail

Property	Notes
globalSettings.Mail.Smtp.Host / .Port / .Username / .Password / .Ssl / .UseDefaultCredentials	SMTP settings.
globalSettings.Mail.SendGridApiKey	SendGrid API key.
globalSettings.Mail.MailgunApiKey / .Domain	Mailgun.
globalSettings.Mail.AmazonSesAccessKeyId / .SecretAccessKey / .Region	SES.
globalSettings.Mail.ReplyToEmail / .NoReplyEmail	From-address policy.

Stripe

Property	Notes
globalSettings.Stripe.ApiKey	Stripe secret key.
globalSettings.Stripe.WebhookKeys	Whitelisted webhook signing keys (an array).
globalSettings.Stripe.MaxNetworkRetries	Retry count.

Service Bus / RabbitMQ

Property	Notes
globalSettings.ServiceBus.ConnectionString	Cloud Service Bus.
globalSettings.ServiceBus.ApplicationCacheTopicName	Topic for ApplicationCacheHostedService.
globalSettings.RabbitMq.HostName / .Username / .Password	Self-host alternative.

Per-app overrides

Each app has its own settings file (src/Api/AppSettings.cs, src/Identity/IdentityServerSettings.cs, src/Billing/BillingSettings.cs, src/Admin/AdminSettings.cs). Bind via services.Configure<TSettings>(Configuration.GetSection(...)).

Sources

Configuration is layered. Later sources override earlier:

1. appsettings.json
2. appsettings.<Environment>.json
3. Environment variables (globalSettings__sqlServer__connectionString=…)
4. User secrets (dotnet user-secrets)
5. Azure Key Vault (cloud only, when globalSettings.Vault.AzureKeyvaultUri is set)

For full coverage read GlobalSettings.cs directly — it is the source of truth. New top-level settings sections are added there.