Skip to content

Admin Settings

GiftWrapt has two configuration surfaces:

  • Environment variables - boot-time secrets and connection strings. See Environment variables.
  • Admin settings - everything else, stored in the app_settings table and editable from the admin UI without a restart.

This page is the map: what each admin section controls and where to read more.

The admin panel lives at /admin. Once you’re signed in as an admin, the top-right user menu shows the link. Each section is a sub-route:

SectionPathWhat it controls
Dashboard/adminAt-a-glance counts and recent activity.
Users/admin/usersUser list, roles, partner/guardian relationships, user-detail pages, impersonation.
Settings/admin/settingsApp-level toggles: list types, archive timing, comments, mobile, OIDC, passkeys.
Email/admin/emailEmail-family toggles (comments, birthday, Christmas, holiday, reminders, relationship reminders) and a test-send button.
Auth/admin/authOIDC client config; passkey toggle.
Barcode/admin/barcodeMobile barcode-lookup provider, API key, cache TTL, and scraper fallback. Surfaced when enableMobileApp is on.
Scraping/admin/scrapingURL scraping providers, tiers, quality threshold, cache, AI toggles.
AI/admin/aiLLM provider (OpenAI / Anthropic / OpenAI-compatible), model, base URL, API key.
Intelligence/admin/intelligenceRecommendations feature: enable, schedule, analyzers, retention, notifications.
Storage/admin/storageBucket connectivity, recent uploads, test-upload.
Scheduling/admin/schedulingCron-run history and next-fire times per endpoint.
Data/admin/dataDB-level diagnostics and one-off admin actions.

A rough heuristic:

In envIn app_settings
Database connectionList type toggles
Master encryption keyEmail family toggles
Cron secretReveal-delay offsets
Storage credentialsScraper provider configs
Default Resend API key (optional)AI provider config
Default AI provider (optional)Intelligence settings
LoggingCron-run retention

Env vars are baked in at boot; changes need a restart. app_settings changes apply on the next read (cron tick, next request, etc.) without a restart.

A few secret fields in app_settings (scraper API keys, AI keys, OIDC client secret) are AES-256-GCM-encrypted using a key derived from BETTER_AUTH_SECRET. Don’t rotate BETTER_AUTH_SECRET without re-entering those.

A few app-wide toggles that shape what users see:

SettingDefaultWhat it does
appTitleGiftWraptRendered in nav, emails, OG tags.
defaultListTypewishlistPre-selected type in the new-list dialog.
enableChristmasListstrueChristmas list type available. Disables related reminders and emails when off.
enableBirthdayListstrueSame, for birthday lists.
enableGenericHolidayListstrueSame, for admin-curated custom holidays.
enableTodoListstrueTodo lists, a separate row shape from gift items.
enableCommentstrueItem comments.
enableMobileAppfalseExposes the mobile API and shows the per-device API key UI. See Mobile App.
enablePasskeysfalseWebAuthn passkey enrollment.

The list-type toggles are deliberately fine-grained so a single-family deployment can run wishlists-only and not see Christmas / birthday / holiday machinery anywhere.

These control when claims auto-archive (which is also when the recipient sees them):

SettingDefault (days)When it fires
archiveDaysAfterBirthday14N days after the recipient’s birthday. Applies to birthday and wishlist lists owned by that user.
archiveDaysAfterChristmas14N days after Dec 25. Applies to all Christmas lists.
archiveDaysAfterHoliday14N days after the configured holiday’s occurrence. Per-list via customHolidayId.

The auto-archive runs regardless of whether the corresponding email toggle is on. Disabling the post-birthday email doesn’t disable the reveal.

Each admin section has its own configuration page in these docs: