Skip to content

Admin Settings

GiftWrapt has two configuration surfaces:

  • Environment variables - boot-time secrets and connection strings. See Environment variables.
  • Admin settings - everything else, stored in the app_settings table and editable from the admin UI without a restart.

This page is the map: what each admin section controls and where to read more.

The admin panel lives at /admin. Once you’re signed in as an admin, the top-right user menu shows the link. Each section is a sub-route:

SectionPathWhat it controls
Dashboard/adminAt-a-glance counts and recent activity.
Users/admin/usersUser list, roles, partner/guardian relationships, user-detail pages, impersonation.
Settings/admin/settingsApp-level toggles: list types, archive timing, comments, mobile, OIDC, passkeys.
Email/admin/emailEmail-family toggles (comments, birthday, Christmas, holiday, reminders, relationship reminders) and a test-send button.
Auth/admin/authOIDC client config; passkey toggle.
Barcode/admin/barcodeMobile barcode-lookup provider, API key, cache TTL, and scraper fallback. Surfaced when enableMobileApp is on.
Scraping/admin/scrapingURL scraping providers, tiers, quality threshold, cache, AI toggles.
AI/admin/aiLLM provider (OpenAI / Anthropic / OpenAI-compatible), model, base URL, API key.
Intelligence/admin/intelligenceRecommendations feature: enable, schedule, analyzers, retention, notifications.
Storage/admin/storageBucket connectivity, recent uploads, test-upload.
Scheduling/admin/schedulingCron-run history and next-fire times per endpoint.
Data/admin/dataDB-level diagnostics and one-off admin actions.

A rough heuristic:

In envIn app_settings
Database connectionList type toggles
Master encryption keyEmail family toggles
Cron secretReveal-delay offsets
Storage credentialsScraper provider configs
Default Resend API key (optional)AI provider config
Default AI provider (optional)Intelligence settings
LoggingCron-run retention

Env vars are baked in at boot; changes need a restart. app_settings changes apply on the next read (cron tick, next request, etc.) without a restart.

A few secret fields in app_settings (scraper API keys, AI keys, OIDC client secret) are AES-256-GCM-encrypted using a key derived from BETTER_AUTH_SECRET. Don’t rotate BETTER_AUTH_SECRET without re-entering those.

A few app-wide toggles that shape what users see:

SettingDefaultWhat it does
appTitleGiftWraptRendered in nav, emails, OG tags.
defaultListTypewishlistPre-selected type in the new-list dialog.
enableChristmasListstrueChristmas list type available. Disables related reminders and emails when off.
enableBirthdayListstrueSame, for birthday lists.
enableGenericHolidayListstrueSame, for admin-curated custom holidays.
enableTodoListstrueTodo lists, a separate row shape from gift items.
enableCommentstrueItem comments.
enableMobileAppfalseExposes the mobile API and shows the per-device API key UI. See Mobile App.
enablePasskeysfalseWebAuthn passkey enrollment.

The list-type toggles are deliberately fine-grained so a single-family deployment can run wishlists-only and not see Christmas / birthday / holiday machinery anywhere.

These control when claims auto-archive (which is also when the recipient sees them):

SettingDefault (days)When it fires
archiveDaysAfterBirthday14N days after the recipient’s birthday. Applies to birthday and wishlist lists owned by that user.
archiveDaysAfterChristmas14N days after Dec 25. Applies to all Christmas lists.
archiveDaysAfterHoliday14N days after the configured holiday’s occurrence. Per-list via customHolidayId.
maxArchiveDeferDays90Caps how far past a list’s event date an editor/guardian/partner may extend the reveal (see Extensions below).

The auto-archive runs regardless of whether the corresponding email toggle is on. Disabling the post-birthday email doesn’t disable the reveal.

On top of the deployment-wide timing above, anyone with edit access to a list can adjust that list’s reveal from its edit view:

  • Reveal now force-archives every claim on the list immediately (and sends the matching reveal email). Only offered once the event has passed but before the reveal date, and never while an extension is active.
  • Extend pushes the reveal later, useful when an event sits close to another occasion (e.g. a graduation just before a birthday) so a gift isn’t revealed too early. Extensions are push-later only and capped at the event date plus maxArchiveDeferDays.
  • Cancel extension returns the list to the derived default reveal date.

The reveal date (and any active extension) is shown inline with the list title as a small tappable badge: read-only for gifters, and with the controls above for editors (in the badge’s dialog). These are web-only features.

Each admin section has its own configuration page in these docs: