# Settings

> Reference for all tabs and fields on the Agent Gateway dashboard Settings page, including system settings, user preferences, admin operations, networking configuration, and user management.
The Settings page is the central configuration area for the management dashboard. It is organised into six tabs. The tabs visible to you depend on your role: administrators see all six; other users see only the User tab.

Access Settings from the dashboard sidebar under Settings.

## System tab

Applies to the entire gateway instance. Requires administrator role. Changes take effect immediately when saved.

### Fields

| Setting | Type | Default | Range | Description |
| Metrics Retention Period | integer (minutes) | 360 | 1–10,080 | How long in-memory metrics data is retained. 360 retains 6 hours. Maximum is 10,080 minutes (7 days). Data outside this window is not available in charts or the dashboard. Reducing this value truncates historical data on the next restart. |
| Task Activity Scope | integer (seconds) | 60 | 10–600 | Time window used to calculate task throughput. If no activity occurs within this window, throughput shows 0 B/s. Any new activity resets the window. |
| Temporary Channel Timeout | integer (seconds) | 30 | 10–300 | Lifetime of temporary surfaces created during the onboard-from-payload wizard. The surface is automatically deleted after this period. |
| Total Connections Window | integer (minutes) | 60 | 1–1,440 | Sliding window used to count total connections on the dashboard and surface Monitoring tab. |
| Average Latency Window | integer (minutes) | 60 | 1–1,440 | Sliding window used to calculate average latency on charts. |

### Actions

| Action | Description |
| Save System Settings | Applies all current system field values immediately. |
| Reset to Defaults | Reverts all system fields to their factory default values. |

## User tab

Personal preferences saved to your user account. These override system defaults for your dashboard session only. Other users are not affected.

### Fields

| Setting | Type | Default | Options / Range | Description |
| Badge time threshold | integer (minutes) | 5 | 1–1,440 | Identities created or used within this window are shown with a NEW or ACTIVE badge on the Identities page. |
| Auto-refresh interval | integer (seconds) | 5 | 1–300 | How often the dashboard polls for updated data. Lower values increase update frequency at the cost of higher bandwidth. |
| Log timestamp format | select | local | local, utc, relative, compact | Format for log entry timestamps. local: browser timezone. utc: ISO 8601. relative: for example, “2m ago”. compact: time portion only. |
| Time series bucket interval | select (seconds) | 30 | 30, 60, 300, 900, 1800, 3600, 10800, 21600 | Default bucket size for the aggregated connections time series graph. Can be overridden on the dashboard per session. |
| Minimum payment items to display | integer | 10 | 1–100 | Minimum number of payment records required before the Payments section is visible. |

### Actions

| Action | Description |
| Save My Preferences | Saves the current user preference values to your account. |
| Reset to System Defaults | Reverts your personal preferences to the system-wide values set by the administrator. |

## Admin tab

System-level operations. Requires administrator role.

### System actions

| Action | Description |
| Truncate Old Metrics Now | Immediately deletes metrics data older than the current retention period, without a restart. Returns a count of records removed and retained. |
| Truncate Old Logs | Removes accumulated log data. The current active log is always kept. |

### Export storage

Produces a PII-redacted, encrypted snapshot of the storage directory.

| Field / action | Description |
| Ed25519 Public Key (PEM) | Paste the Ed25519 public key to encrypt the export. The export uses hybrid encryption (X25519 ECDH + AES-256-GCM). Only the holder of the matching private key can decrypt it. |
| Export & Download | Generates and downloads the export as a .atgx file. Sensitive directories (private keys, secrets, API keys, certificates, session tokens, credentials, avatars) are excluded entirely. |

### Backup and restore

Full backup includes all data, including private keys, secrets, and credentials: everything required to fully restore the service. Backup files are encrypted with AES-256-GCM.
Caution

The backup archive contains sensitive data including private keys and credentials. Store it securely and never transmit it over unencrypted channels.

| Action | Description |
| Backup | Downloads an encrypted backup.tgwbak snapshot of all gateway data, including private keys, secrets, and credentials. Log data is excluded. |
| Restore | Uploads a backup.tgwbak file. The gateway archives the current data before replacing it with the backup. The service restarts to complete the procedure. |

### Prometheus authentication

Require HTTP Basic Authentication for the /v1/metrics/prometheus endpoint. When enabled, Prometheus scrapers must provide valid credentials.

| Field / action | Description |
| Toggle | Enables or disables authentication for the Prometheus metrics endpoint. |
| Username | The HTTP Basic Authentication username. Defaults to prometheus when enabling for the first time. |
| Password | The password. Stored as a bcrypt hash. Leave blank when updating credentials to keep the existing password. |
| Save Credentials | Saves the username and password and enables authentication immediately. |

### Feature flags

| Flag | Description |
| metrics | Shows the Metrics entry in the sidebar. Default on. Set to off to hide the sidebar entry; the /metrics routes remain reachable directly. |

Changes to feature flags take effect immediately.

## Networking tab

Shows the gateway’s inbound mTLS (mutual TLS) and client authentication configuration. Requires administrator role. These settings are read-only; they reflect the platform’s network configuration and cannot be changed from the dashboard.

| Setting | Description |
| Direct TLS client-cert request | Whether the gateway requests a client certificate during its own TLS handshake: Disabled, Optional (request, don't require), or Required (handshake fails without cert). |
| Trusted proxy CIDRs | IP ranges allowed to present a forwarded client certificate header. When empty, the forwarded-cert path is disabled. |
| Forwarded client-cert header | Name and format of the header read when the peer matches a trusted proxy CIDR. Format is either Envoy XFCC (x-forwarded-client-cert) or URL-encoded PEM (nginx ssl_client_escaped_cert). |

## Security tab

Controls whether the gateway records Verifiable Presentation (VP) evidence of authorisation decisions for compliance auditing. Requires administrator role.

### Fields

| Setting | Type | Default | Description |
| Enable VP Auditing | toggle | Off | When enabled, the gateway records VP evidence for every authorisation decision in the selected categories. |

When Enable VP Auditing is on, an Audit Categories section appears with the following checkboxes:

| Category | Description |
| Policy Decisions | Records OPA allow/deny outcomes for every policy evaluation. |
| Trust Checks | Records TRQP query outcomes for every trust-registry verification. |
| Identity Bindings | Records managed-identity VP injection events. |

Enable only the categories you need. Each additional category increases storage usage proportionally to request volume.

### Actions

| Action | Description |
| Save | Applies the current audit toggle and category selections immediately. |

## Users tab

Shows the user management interface. Requires the users.view permission. Lists all gateway users with their roles and status, and provides add, edit, and delete operations.

## Related

- [Observability](/products/affinidi-trust-fabric/agent-gateway/concepts/observability.md): How the dashboard home screen uses metrics retention and bucket size to display traffic data.