Settings

SunBird reads its settings from the SunBird section of the site's configuration. Put them in appsettings.json:

{
  "SunBird": {
    "ShowSlotErrors": false
  }
}

or set them as environment variables or App Service application settings, with a double underscore between the section and the key: SunBird__ShowSlotErrors.

Setting Default What it does
SiteUrl none (required) The site's public address, for example https://www.example.co.uk. The links in SunBird's emails, and the canonical link, og:url and og:image that <sb-seo /> renders, are built from it, never from the address a request came in on. Set it as a deployment slot setting, so staging's links name staging.
ShowSlotErrors true in Development, false elsewhere When on, a slot used wrongly (no page key, a missing, invalid or duplicate key, or a slot in a layout) is replaced on the page by a red box saying what is wrong. When off, the slot shows its markup default. Either way the problem is logged.
Mode Live Live or Staging. Set Staging on a staging slot that shares the live database, as a deployment slot setting. Editors there see a banner and can save drafts, but nothing can be published, scheduled, restored, unpublished or deleted. Any other value stops the site starting. See Staging mode.
SetupCode none The code /sunbird/setup asks for to create the first admin. Setup is closed for good once any account exists. Set it as an App Service setting or in user secrets, never in source control. See Sign in and manage editors.
Password:RequiredLength 12 The shortest password an editor account can have.
Password:RequireDigit false When true, a password needs a digit (0-9).
Password:RequireLowercase false When true, a password needs a lowercase letter.
Password:RequireUppercase false When true, a password needs an uppercase letter.
Password:RequireNonAlphanumeric false When true, a password needs a character that is not a letter or digit.
Password:RequiredUniqueChars 1 The number of different characters a password needs.
Lockout:MaxFailedAttempts 5 Failed sign-in attempts in a row before an account is locked.
Lockout:Minutes 15 How long a locked account stays locked.
Email:From none (required) The address SunBird's emails come from.
Email:FromName the site's host name The name shown with Email:From.
Email:BrandName the site's host name The name at the top of SunBird's emails, for example the client's company.
Email:LogoUrl none An absolute https address of a logo shown at the top of SunBird's emails instead of the brand name.
Email:AccentColour #0b5cad The colour of buttons and the top border, as #rgb or #rrggbb.
Email:FooterText "Sent by the editing tools of" and the brand name The line at the bottom of SunBird's emails.
Media:MaxUploadMegabytes 10 The largest image an editor can upload, in megabytes. See Store images.
Mcp:Enabled false Serves the MCP server at /sunbird/mcp, through which AI agents with an access token work on content. Turn it on in development and on the staging slot, as a deployment slot setting, and leave it off on the live site. See Let agents edit content over MCP.
Mcp:AllowPublish true When false, agents can only save drafts through MCP: publishing, scheduling, rolling back, unpublishing and deleting pages are refused. They are refused in staging mode whatever this says.

Password and lockout rules

SunBird's defaults follow current guidance: a long password matters more than a mix of character types, so the default is at least 12 characters with no other rules. A site that needs stricter rules sets them without a code change, for example:

{
  "SunBird": {
    "Password": { "RequiredLength": 16, "RequireDigit": true },
    "Lockout": { "MaxFailedAttempts": 3, "Minutes": 30 }
  }
}

As an App Service setting, nested keys also use double underscores: SunBird__Password__RequiredLength. The rules apply when a password is set or changed, so existing passwords are not checked again.

Email

SunBird sends invites, password reset links and email change confirmations through the site's HCI.Email IEmailService. Email:From and SiteUrl are required: the site does not start without them. The branding settings are optional and change only how the emails look:

{
  "SunBird": {
    "SiteUrl": "https://www.acmebakery.co.uk",
    "Email": {
      "From": "noreply@acmebakery.co.uk",
      "BrandName": "Acme Bakery",
      "LogoUrl": "https://www.acmebakery.co.uk/img/logo.png",
      "AccentColour": "#c0392b",
      "FooterText": "Acme Bakery, 1 High Street, York"
    }
  }
}

The site does not start if AccentColour is not a hex colour or LogoUrl is not an absolute https address, because both go into the emails' markup. See Sign in and manage editors.

Development, staging and live

A typical site sets ShowSlotErrors like this:

Where ShowSlotErrors How
Developer's machine on The Development default, or true in appsettings.Development.json.
Staging slot on An App Service setting SunBird__ShowSlotErrors = true, marked as a deployment slot setting so it stays with staging when the slots swap.
Live site off The default, or false in appsettings.json.

Set Mode on the staging slot too, as SunBird__Mode = Staging (a deployment slot setting), so a staging slot that shares the live database cannot publish.

Staging is the final catch: turn the setting on there and a mistake that got past development is visible on the page, before the release is swapped live. On the live site a mistake never spoils a page.

The connection string is set separately, in ConnectionStrings. See Store content in SQL Server or Store content in SQLite.

Edit this page