Settings

These are the platform-enforced toggles that sit outside the app's own code, applied at the edge before a request ever reaches a method. The signup allowlist restricts which email-code sign-ups are accepted, checked before a code is sent. Fixed-code test accounts hand app-store reviewers working credentials that skip real delivery. Frame-ancestors names the extra origins allowed to embed the deployed app in an iframe. Each has its own verb group, allowlist, test-accounts, and frame-ancestors, with list, add, and remove operations.

get dumps the whole settings object. set writes a scalar key by name, its value parsed as JSON. Those keys cover the rest: blocking disposable-email sign-ups, whether frontend error reports may include response bodies, auto-triage of new bug issues, and extra analytics query params to preserve. Because these are enforced by the platform rather than by app logic, they hold even against a request that tries to route around the frontend.