Skip to main content

⚙️ Settings reference

All settings live in one CONTENT_STUDIO dictionary in your Django settings. Every setting is optional; leave out the ones you do not change.

# mysite/settings.py
CONTENT_STUDIO = {
    "ADMIN_SITE": "mysite.studio.admin_site",
    "MEDIA_LIBRARY_MODEL": "content_studio.media_library.models.Media",
}

Site​

ADMIN_SITE​

The site the admin runs on, as an import path string. Default: "content_studio.admin.admin_site", a site without customizations. To add a dashboard, extensions, tenants or media library hooks, subclass ContentStudioSite and point this setting at your instance.

Login and sessions​

LOGIN_BACKENDS​

The login backends, as import path strings. Default: ["content_studio.login_backends.UsernamePasswordBackend"], the only supported backend (authentication).

LOGIN_THROTTLE_RATE​

The maximum number of login attempts per IP address, as a Django REST Framework rate string such as "10/min". Default: "10/min". None removes the limit. Attempts are counted in the cache: with the default per-process cache, every worker counts separately, so configure a shared cache.

TOKEN_BACKEND​

The token backend that manages sessions, as an import path string. Default: "content_studio.token_backends.JsonWebTokenBackend", the only supported backend.

TOKEN_LIFETIME​

How long a session stays active between renewals, in seconds. Default: 3600 (one hour). Sessions renew themselves while the editor works, so a short lifetime does not log anyone out.

REFRESH_TOKEN_LIFETIME​

How long a session can go unused before the editor has to log in again, in seconds. Default: 604800 (seven days).

MAX_SESSION_LIFETIME​

How long a session can last after logging in, however active the editor is, in seconds. Default: 2592000 (30 days). After that, the editor logs in again. None lets a session that is in use last indefinitely.

TOKEN_CACHE​

The alias of the cache in CACHES that ended sessions are recorded in. Default: "default". With several worker processes or servers, it must be a shared cache, such as Redis, Memcached or the database cache: with a per-process cache, a session that was logged out in one worker continues in another. Clearing the cache lets ended sessions continue until they expire.

TOKEN_SIGNING_KEY​

The key that signs the sessions. Default: None, which uses Django's SECRET_KEY. Rotate SECRET_KEY the way Django documents, with the old key in SECRET_KEY_FALLBACKS, and the sessions it signed continue; without the fallback, every editor logs in again. Set a separate key if you rotate SECRET_KEY independently of admin sessions.

TOKEN_ALGORITHM​

The algorithm that signs the sessions: "HS256", "HS384" or "HS512". Default: "HS256".

Whether the session cookie is marked Secure, so browsers only send it over HTTPS. Default: None, which marks it secure on HTTPS requests and whenever DEBUG is off, also behind a proxy that does not set SECURE_PROXY_SSL_HEADER. Set True or False to force either value. A production site served over plain HTTP needs False to log in at all, and should move to HTTPS.

Audit stamps​

EDITED_BY_ATTR, EDITED_AT_ATTR, CREATED_BY_ATTR, CREATED_AT_ATTR​

The field names of the audit stamps. Defaults: "edited_by", "edited_at", "created_by" and "created_at". When an editor creates an object, the admin fills in created_by; when they save it, edited_by and edited_at. Models without these fields are left as they are.

Content​

HTML_SANITIZER​

The sanitizer that cleans HTMLField values on save: a callable or an import path string. Default: None, the built-in sanitizer, which keeps a common set of tags, attributes and link types and removes everything else. A sanitizer passed to an HTMLField takes precedence over this setting.

Media library​

MEDIA_LIBRARY_MODEL, MEDIA_LIBRARY_FOLDER_MODEL​

The media item and folder models of the media library, as import path strings. Default: None, which turns the media library off.

MEDIA_LIBRARY_ALLOWED_EXTENSIONS​

The file extensions the media library accepts, in lowercase and without the dot. By default:

  • images: avif, gif, jpeg, jpg, png, webp;
  • video and audio: m4a, mov, mp3, mp4, ogg, wav, webm;
  • documents: csv, doc, docx, odp, ods, odt, pdf, ppt, pptx, txt, xls, xlsx.

SVG is left out because it can contain scripts. None accepts every extension. Files whose content is markup (HTML, SVG, XML) are rejected whatever their extension.

MEDIA_LIBRARY_MAX_UPLOAD_SIZE​

The maximum size of an upload, in bytes. Default: 52428800 (50 MB). None removes the limit; your web server's own request size limit still applies.

FOCAL_POINT_ATTR​

The field on the media item model that stores the focal point, which turns on the focal point editor of the media library. The field must be a JSONField; the editor stores {"x": 0-100, "y": 0-100}, percentages of the image's width and height. Default: None, which turns the editor off. System check content_studio.E009 reports a focal point field without a media library model, or one that is missing or not a JSONField.

Multi-tenancy​

TENANT_MODEL​

The tenant model for multi-tenancy, as an import path string. Default: None, which turns multi-tenancy off.

Presence​

PRESENCE​

Whether the edit and list pages show which other editors have an object open; see Presence. Default: True. A studio turns it off for its model with presence = False.

PRESENCE_CACHE​

The alias of the cache in CACHES that presence is kept in. Default: "default". With several worker processes or servers, it must be a shared cache, such as Redis, Memcached or the database cache. System check content_studio.E023 reports an alias that is not in CACHES.

Webhooks​

These settings apply when the content_studio.webhooks app is installed; see Webhooks.

WEBHOOK_ALLOWED_HOSTS​

Host names that webhooks may reach although they resolve to a private, loopback or link-local address, or use plain HTTP, such as a build server on your own network. Default: []. Outside this list, webhooks only connect to public addresses, over HTTPS unless DEBUG is on.

WEBHOOK_MAX_ATTEMPTS​

How many times a webhook delivery is attempted before it is marked as failed. Default: 5. The wait between attempts grows from 1 minute to 64 minutes.

WEBHOOK_TIMEOUT​

How long a webhook request may take in total, from connecting to reading the response, in seconds. A request that takes longer fails and is retried. Default: 5.

WEBHOOK_DELIVERY_RETENTION​

How many days delivered and failed webhook deliveries are kept. content_studio_deliver_webhooks removes older ones; pending deliveries are always kept. Default: 30. None keeps every delivery.

Password reset​

PASSWORD_RESET_EXPIRATION_TIME​

How long a password reset code stays valid, in minutes. Default: 10.

PASSWORD_RESET_THROTTLE_RATE​

The maximum number of password reset requests per IP address, as a Django REST Framework rate string. Default: "10/hour". None removes the limit. Like the login limit, it is counted in the cache.