# Configure the Developer Portal

After deploying the Developer Portal, use the Provider Portal to control public access and portal tokens. Authentication behavior is configured in the Developer Portal application.

## Portal Settings[​](#portal-settings "Direct link to Portal Settings")

Portal settings are managed in the Provider Portal under each portal's **Settings** page. The settings are organized into the following sections.

### Public Access[​](#public-access "Direct link to Public Access")

The **Public Access** toggle controls whether the Developer Portal is accessible to unauthenticated users:

* **Enabled**: Unauthenticated visitors can browse the API Hub and view public API products.
* **Disabled**: All visitors must authenticate before accessing any portal content.

### Portal Tokens[​](#portal-tokens "Direct link to Portal Tokens")

Portal tokens authenticate the Developer Portal application with the Portal API. Each token has the prefix `a7prt` and can be configured with an expiration date.

| Operation      | Description                                                                                                                                          |
| -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Generate**   | Create a new token with a name and optional expiration date. The token value is shown only at creation time.                                         |
| **Rename**     | Update the display name of a token.                                                                                                                  |
| **Regenerate** | Generate a new token value, invalidating the previous one. Update the Developer Portal `config.yaml` with the new token and restart the application. |
| **Delete**     | Remove a token. If the Developer Portal is using this token, it will lose connectivity to the Portal API.                                            |

caution

After regenerating or deleting a token, update the `config.yaml` on the Developer Portal host and restart the application. The portal will not function correctly without a valid token.

## Built-in Authentication Status[​](#built-in-authentication-status "Direct link to Built-in Authentication Status")

The Provider Portal Settings page includes Public Access and portal tokens. It does not include controls for self-registration, registration approval, email login, or built-in authentication.

Configure email-and-password behavior in `auth.emailAndPassword` in the Developer Portal `config.yaml`. Email and password are enabled by default. See [Customize the Developer Portal](https://docs.api7.ai/api7-gateway/developer-portal/deploy/customize-portal.md#email-and-password).

## SSO (External Login Options)[​](#sso-external-login-options "Direct link to SSO (External Login Options)")

Configure supported OAuth providers in the Developer Portal's `config.yaml`, not through the unavailable Provider Portal login-options workflow. See [Customize the Developer Portal](https://docs.api7.ai/api7-gateway/developer-portal/deploy/customize-portal.md#social-login-providers) for the released frontend configuration and [Developer Portal SSO Status](https://docs.api7.ai/api7-gateway/developer-portal/manage/configure-sso.md) for the Provider Portal limitation.

## SCIM Provisioning[​](#scim-provisioning "Direct link to SCIM Provisioning")

SCIM (System for Cross-domain Identity Management) can synchronize identities from an external identity provider into a custom Developer Portal. The released frontend does not register a SCIM plugin, so the endpoint is not enabled by changing a Provider Portal setting.

For a custom implementation based on the public Boilerplate, follow [Configure SCIM Provisioning for a Custom Developer Portal with Okta](https://docs.api7.ai/api7-gateway/developer-portal/manage/configure-scim.md). That workflow adds the server plugin, declares a provisioning credential, and updates the database schema. Organization membership and application access require separate integration with the portal's authorization model.

## Application Configuration[​](#application-configuration "Direct link to Application Configuration")

The following settings are configured in the Developer Portal's `config.yaml` file and require a restart to take effect.

### Portal API Connection[​](#portal-api-connection "Direct link to Portal API Connection")

config.yaml

```
portal:

  url: https://<CONTROL_PLANE_HOST>:4321   # Portal API endpoint

  token: a7prt-xxxxxxxxxxxx                 # Portal token from Provider Portal
```

### Database[​](#database "Direct link to Database")

config.yaml

```
db:

  url: "postgres://user:password@host:5432/dbname"
```

The Developer Portal uses a PostgreSQL-compatible database for storing user sessions, authentication data, and organization information.

### Authentication Secret[​](#authentication-secret "Direct link to Authentication Secret")

config.yaml

```
auth:

  secret: "<base64-encoded-secret>"
```

This secret is used to sign authentication sessions. Generate it with:

```
openssl rand -base64 32
```

### Application URLs[​](#application-urls "Direct link to Application URLs")

config.yaml

```
app:

  name: "My Developer Portal"        # Displayed in browser title and header

  desc: "API documentation portal"   # Used for SEO meta description

  baseURL: "https://portal.example.com"

  trustedOrigins:

    - "https://portal.example.com"
```

### Environment Variable Substitution[​](#environment-variable-substitution "Direct link to Environment Variable Substitution")

Configuration values support environment variable substitution:

| Syntax           | Behavior                                                     |
| ---------------- | ------------------------------------------------------------ |
| `${VAR}`         | Required. Fails if the variable is not set.                  |
| `${VAR:default}` | Optional. Uses the default value if the variable is not set. |

Example:

config.yaml

```
portal:

  url: ${PORTAL_API_URL}

  token: ${PORTAL_TOKEN}

auth:

  secret: ${AUTH_SECRET}
```

## Additional Resources[​](#additional-resources "Direct link to Additional Resources")

* [Deploy the Developer Portal](https://docs.api7.ai/api7-gateway/developer-portal/deploy/deploy-portal.md)
* [Customize the Developer Portal](https://docs.api7.ai/api7-gateway/developer-portal/deploy/customize-portal.md)
* [Configure SSO for the Developer Portal](https://docs.api7.ai/api7-gateway/developer-portal/manage/configure-sso.md)
* [Configure SCIM Provisioning for a Custom Developer Portal with Okta](https://docs.api7.ai/api7-gateway/developer-portal/manage/configure-scim.md)