> ## Documentation Index
> Fetch the complete documentation index at: https://docs.allgoodhq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Settings reference

> Every setting in this section: where it's edited, what it defaults to, and what enforces it.

## Web Edge

**Web Edge Sessions**

| Setting | Default | Enforced by |
| - | - | - |
| Hostname | — | allGood's edge routing, plus the certificate it issues |
| Default domain | The first one activated | The app, whenever it generates a URL or a snippet |
| Allowed origins | Empty — same-origin only | allGood, on every capture request and preflight |

Shown but not edited: the CNAME target, the DNS records, the four-step progress rail, the bot-check sitekey and the hostnames it covers.

Allowed origins are stored with the Form Processing settings, which is why their change history appears on that screen. Format is `scheme://host[:port]`: no path, no wildcard, exact match. One list governs both form capture and event capture.

## Form Processing

**Settings → Form Processing**

| Setting | Default | Enforced by |
| - | - | - |
| Max payload size | 8 KB | allGood, capped at 16 KB whatever the setting says, measured in bytes |
| Rate limiting | On | allGood — 30/min per IP, 300/min per origin |
| Honeypot field detection | On | allGood, on form capture |
| Honeypot field name | `_hp` | allGood, and the script when it adds the field |
| Bot protection | Turnstile | allGood, verifying the token in-network |

**Two-sided settings.** A form's own honeypot field name overrides the account default, but switching the check off account-wide beats both. Bot protection needs the account provider **and** the form's opt-in.

## Consent Provider

**Settings → Consent Provider**

| Setting | Default | Enforced by |
| - | - | - |
| Consent provider | Not configured | Nothing — it's a label recording which platform you run |
| Normalized signal source | `window.__consent` | The script, walking the path from `window` |
| No tracking before opt-in | On | The script's buffer, and allGood on event capture |
| Consent text versions | Empty | allGood, stamping the form's bound id onto every accepted submission |

Consent text versions are append-only: no edit, no delete.

> [!WARNING]
>
> **No tracking before opt-in** does not gate page views or the identity cookie on landing pages allGood hosts. See [What consent gates](https://docs.allgoodhq.com/mk/developer/web-edge/consent-behavior.md).

## Web Tracking

**Settings → Web Tracking**

| Setting | Default | Enforced by |
| - | - | - |
| Send events to allGood | Off | allGood — every event is refused while it's off |
| Automatic page views | On | The script |
| Tracking key | None | allGood, comparing fingerprints |

Key lifecycle: **Issue**, then **Rotate** (the old key works until the new one lands) or **Revoke** (every event refused; the record is kept). See [Rotate or revoke](https://docs.allgoodhq.com/mk/settings/web-edge/tracking-setup.md#your-tracking-key).

## Landing Page

**Settings → Landing Page**

| Setting | Default | Enforced by |
| - | - | - |
| Robots posture | Live pages are indexable | allGood, as a header on every live page it serves |

## Per-form settings

Not on a settings screen — these live on the form itself and reach allGood when the form is registered.

| Setting | Default | Enforced by |
| - | - | - |
| Declared fields | Required | The **script**, before sending. The endpoint itself stays schemaless |
| Consent text | None | allGood, stamped onto every accepted submission from its own records |
| Honeypot field name | The account default | allGood, and the script |
| Bot check required | Off | allGood, gated on the account provider |
| Success redirect | None | Returned on an accepted response; the script navigates |

Publishing the form registers it, so registration requires a published version. An unregistered form refuses every submission.

> [!NOTE]
>
> Because the endpoint is schemaless, a hand-built POST isn't checked against the declared fields. That's deliberate — the field check exists so a *visitor* can fix their input, which is only possible in a browser.

## Fail-closed defaults

If allGood finds no settings for an account, it falls back to the **strictest** position rather than a permissive one.

| Field | Fallback |
| - | - |
| Allowed origins | Empty — same-origin only |
| Max payload | 8 KB |
| Rate limiting | On |
| Honeypot | On, named `_hp` |
| Bot protection | Turnstile |
| Tracking | Absent — every event refused |
| Consent | Blocking posture |

A missing value never means "allow". "The sync hasn't landed yet" must never quietly become "the allowlist is off".

## Change history

Every settings screen records who changed what and when, append-only, at the bottom of the page.

Saving any of these settings, including the origin allowlist, and issuing, rotating, or revoking a tracking key, needs the Admin or Power user role. There is no separate permission per screen. The Standard role can view but not change them.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.