Settings
The Settings page is the central configuration area for the management dashboard. It is organised into six tabs. Which tabs appear depends on your permissions: administrators see System, Admin, Networking, and Security in addition to User; users with the users.view permission see the Users tab. Use it to tune system performance windows, configure Prometheus scraping credentials, run backups, manage user accounts, and set personal dashboard display preferences.
Access Settings from the dashboard sidebar under Settings.
System tab
Applies to the entire gateway instance. Requires administrator role. Changes take effect immediately when saved.
Fields
| Setting | Type | Default | Range | Description |
|---|---|---|---|---|
| Metrics Retention Period | integer (minutes) | 360 | 1–10,080 | How long in-memory metrics data is retained. 360 retains 6 hours. Maximum is 10,080 minutes (7 days). Data outside this window is not available in charts or the dashboard. Reducing this value truncates historical data on the next restart. |
| Task Activity Scope | integer (seconds) | 60 | 10–600 | Time window used to calculate task throughput. If no activity occurs within this window, throughput shows 0 B/s. Any new activity resets the window. |
| Temporary Channel Timeout | integer (seconds) | 30 | 10–300 | Lifetime of temporary surfaces created during the onboard-from-payload wizard. The surface is automatically deleted after this period. |
| Total Connections Window | integer (minutes) | 60 | 1–1,440 | Sliding window used to count total connections on the dashboard and surface Monitoring tab. |
| Average Latency Window | integer (minutes) | 60 | 1–1,440 | Sliding window used to calculate average latency on charts. |
Actions
| Action | Description |
|---|---|
| Save System Settings | Applies all current system field values immediately. |
| Reset to Defaults | Reverts all system fields to their factory default values. |
User tab
Personal preferences saved to your user account. These override system defaults for your dashboard session only. Other users are not affected.
Fields
| Setting | Type | Default | Options / Range | Description |
|---|---|---|---|---|
| Badge time threshold | integer (minutes) | 5 | 1–1,440 | Identities created or used within this window are shown with a NEW or ACTIVE badge on the Identities page. |
| Auto-refresh interval | integer (seconds) | 5 | 1–300 | How often the dashboard polls for updated data. Lower values increase update frequency at the cost of higher bandwidth. |
| Log timestamp format | select | local | local, utc, relative, compact | Format for log entry timestamps. local: browser timezone. utc: ISO 8601. relative: for example, “2m ago”. compact: time portion only. |
| Time series bucket interval | select (seconds) | 30 | 30, 60, 300, 900, 1800, 3600, 10800, 21600 | Default bucket size for the aggregated connections time series graph. Can be overridden on the dashboard per session. |
| Minimum payment items to display | integer | 10 | 1–100 | Minimum number of payment records required before the Payments section is visible. |
Actions
| Action | Description |
|---|---|
| Save My Preferences | Saves the current user preference values to your account. |
| Reset to System Defaults | Reverts your personal preferences to the system-wide values set by the administrator. |
Admin tab
System-level operations. Requires administrator role.
System actions
| Action | Description |
|---|---|
| Truncate Old Metrics Now | Immediately deletes metrics data older than the current retention period, without a restart. Returns a count of records removed and retained. |
| Truncate Old Logs | Removes accumulated log data. The current active log is always kept. |
Export storage
Produces a PII-redacted, encrypted snapshot of the storage directory.
| Field / action | Description |
|---|---|
| Ed25519 Public Key (PEM) | Paste the Ed25519 public key to encrypt the export. The export uses hybrid encryption (X25519 ECDH + AES-256-GCM). Only the holder of the matching private key can decrypt it. |
| Export & Download | Generates and downloads the export as a .atgx file. Sensitive directories (private keys, secrets, API keys, certificates, session tokens, credentials, avatars) are excluded entirely. |
Backup and restore
Full backup includes all data, including private keys, secrets, and credentials: everything required to fully restore the service. Backup files are encrypted with AES-256-GCM.
The backup archive contains sensitive data including private keys and credentials. Store it securely and never transmit it over unencrypted channels.
| Action | Description |
|---|---|
| Backup | Downloads an encrypted backup.tgwbak snapshot of all gateway data, including private keys, secrets, and credentials. Log data is excluded. |
| Restore | Uploads a backup.tgwbak file. The gateway archives the current data before replacing it with the backup. The service restarts to complete the procedure. |
Prometheus authentication
Require HTTP Basic Authentication for the /v1/metrics/prometheus endpoint. When enabled, Prometheus scrapers must provide valid credentials.
| Field / action | Description |
|---|---|
| Toggle | Enables or disables authentication for the Prometheus metrics endpoint. |
| Username | The HTTP Basic Authentication username. Defaults to prometheus when enabling for the first time. |
| Password | The password. Stored as a bcrypt hash. Leave blank when updating credentials to keep the existing password. |
| Save Credentials | Saves the username and password and enables authentication immediately. |
Feature flags
| Flag | Default | Description |
|---|---|---|
metrics | On | Shows the Metrics entry in the sidebar. Set to off to hide the sidebar entry; the /metrics routes remain reachable directly. |
copilot_integration | Off | Reveals Copilot integration surfaces in the dashboard: A2A Proxy management and Header Metadata Mapping controls. Runtime configurations continue to execute regardless of this setting. |
Changes to feature flags take effect immediately.
Networking tab
Shows the gateway’s inbound mTLS (mutual TLS) and client authentication configuration. Requires administrator role. These settings are read-only; they reflect the platform’s network configuration and cannot be changed from the dashboard.
| Setting | Description |
|---|---|
| Direct TLS client-cert request | Whether the gateway requests a client certificate during its own TLS handshake: Disabled, Optional (request, don't require), or Required (handshake fails without cert). |
| Trusted proxy CIDRs | IP ranges allowed to present a forwarded client certificate header. When empty, the forwarded-cert path is disabled. |
| Forwarded client-cert header | Name and format of the header read when the peer matches a trusted proxy CIDR. Format is either Envoy XFCC (x-forwarded-client-cert) or URL-encoded PEM (nginx ssl_client_escaped_cert). |
Security tab
Controls whether the gateway records Verifiable Presentation (VP) evidence of authorisation decisions for compliance auditing. Requires administrator role.
Fields
| Setting | Type | Default | Description |
|---|---|---|---|
| Enable VP Auditing | toggle | Off | When enabled, the gateway records VP evidence for every authorisation decision in the selected categories. |
When Enable VP Auditing is on, an Audit Categories section appears with the following checkboxes:
| Category | Description |
|---|---|
| Policy Decisions | Records OPA allow/deny outcomes for every policy evaluation. |
| Trust Checks | Records TRQP query outcomes for every trust-registry verification. |
| Identity Bindings | Records managed-identity VP injection events. |
Enable only the categories you need. Each additional category increases storage usage proportionally to request volume.
Actions
| Action | Description |
|---|---|
| Save | Applies the current audit toggle and category selections immediately. |
Users tab
Visible to administrators only. Lists all gateway users with their username, role, status, and last login time. Users self-register from the login page using a passkey and appear here with New status until an administrator approves them. Provides edit and delete operations for existing accounts.
Roles
Agent Gateway enforces role-based access control with three roles. Roles are hierarchical: each role includes all capabilities of the roles below it.
Administrator
Full access to all permissions.
- System settings (view and edit)
- User management (create, approve, edit, and delete all accounts)
- Trust registry management
- Surface configuration and deletion
- API key and certificate management
- Integration configuration and gateway configuration reload
- Agent identity issuance
- Storage backup, restore, and export
- Secrets and pipes management (edit and delete)
- Audit log access
An Administrator account cannot be deleted or downgraded below Power User. The designated primary Administrator account has additional protection: its role and status cannot be changed and the account cannot be deleted by any user.
Power User
Inherits all User access, plus:
- Mediator management (edit and delete)
- MCP proxy management (view, edit, and delete)
- A2A proxy management (view, edit, and delete)
- Surface payload capture
Power Users cannot access user management, system settings, trust registry or surface configuration, API keys, certificates, storage operations, or the audit log.
User
Read-only access to most shared gateway resources:
- View gateways, mediators, trust registries, surfaces, secrets, metrics, the dashboard, and logs
- View and retry payments
- Manage own notifications, issuers, and authorities
- View and execute existing pipes
Users cannot manage user accounts, modify system settings, edit trust registries or surfaces, manage API keys, or perform storage operations. Users cannot create or modify pipes.
User status
| Status | Description |
|---|---|
| New | Registered but not yet approved. The user cannot sign in until an administrator changes the status to Approved. |
| Approved | Active account. The user can sign in. |
| Disabled | Suspended account. The user cannot sign in. The account and its data are retained. |
Related
- Observability: How the dashboard home screen uses metrics retention and bucket size to display traffic data.
Glad to hear it! Please tell us how we can improve more.
Sorry to hear that. Please tell us how we can improve.
Thank you for sharing your feedback so we can improve your experience.