Settings

The Settings panel is the control surface for how Aura Workshop 1.36.2 behaves at runtime — which provider drives the agent loop, how tools are isolated, what memory is recalled, how cost is capped, and which services are connected. This page walks each tab. Defaults shown are the shipped values.

General — model, sampling & execution

Global defaults for the selected model and how the agent runs tools. Per-model overrides (see Models & Providers) win over these globals.

Model & sampling

A separate media model (image / video / audio / music) is held apart from the chat model — a media model can't drive the chat loop. Context is compacted automatically at 70% of the active model's window, preserving tool_use/tool_result pairs.

Execution isolation & backend

Device capabilities

Toggle host access per tool: screen_capture_enabled (off), camera_capture_enabled (off), system_notifications_enabled (on), and headless_mode (off — set on for CI/server). Agent context injection (git status, project instruction files) is controlled by the AURA_GIT_CONTEXT / AURA_PROJECT_INSTRUCTIONS flags.

Security

• Biometric authentication — gate access to credentials and sensitive operations behind Touch ID (macOS) or Windows Hello.
• Password lock — require a password to open the Settings panel.
• License — enter and activate a license key, then view the current tier, expiry, and feature entitlements. The key is written via a dedicated path so the frontend can't accidentally clear it.
• Session management — view and revoke active JWT sessions issued for the web UI.

Named credentials and OAuth tokens are encrypted with the encryption model described in Deployment & Security; the encryption key lives in the system keychain.

Connectivity — web server & ACP discovery

Embedded web server

ACP peer discovery

Discovered peers are admitted manually — see Multi-Agent Teams. Live ports across the app: 18800 (web / REST / SSE / WS / ACP), 18790 (webhooks), 18802/udp (ACP discovery).

Models & Providers

Hold multiple provider keys and endpoints at once. Full guidance on connecting providers lives in Models & Providers; the settings themselves:

Routing

Aura Routing scores each request and picks a tier, then resolves a model for that tier — trading cost against capability automatically.

Aura Routing 2.0 layers five mostly table-backed phases on top of the scorer: a passive health circuit breaker, a task-sticky load balancer, routing_rules (first-match pins a tier/model and short-circuits the scorer), guardrails, and an optional semantic cache. Every routing event is logged to routing_decisions and surfaced in the Routing Debug Log.

The semantic cache is off by default (semantic_cache_enabled = false) so a stale answer never silently short-circuits a task; when on, it matches at cosine semantic_cache_threshold (0.95, clamped 0.5–0.999) with a fixed 7-day TTL, and never serves on a Retry/Restart or empty prompt.

Memory

Controls what the agent recalls and how knowledge is distilled. The full model is in Memory & Knowledge.

The tab itself also lets you browse, add, edit, delete, and search memories by type (user / feedback / project / reference) and scope, edit project instruction (AURA.md) files, and review LLM-extracted facts with their confidence scores. Recall is hybrid FTS5/BM25 + embedding-cosine fused with RRF, ACL-filtered. Embeddings are a user-configured external endpoint — there is no bundled inference.

Billing & Usage

• Usage dashboard — summary cards for today's cost, this month's cost, lifetime cost, and today's tokens, plus daily spend charts and a per-provider / per-model breakdown.
• Spend limits — per-provider {daily_limit_usd, monthly_limit_usd, enabled} in the spend_limits table. When the current provider is over budget, the resolver walks the fallback chain.
• Provider fallback order — priority-ordered {provider, model, base_url, api_key_ref} rows the resolver walks when a provider is over budget or unreachable.
• Model pricing table — editable input/output cost per million tokens, pre-seeded with market rates, with a reset-to-defaults action.

Managed via GET/PUT /api/billing/limits and /api/billing/fallback-order.

Credentials

• Credential list — every stored credential by name, type, and timestamps. Secret values are never shown in the list.
• Add — create an entry with a name, type (API key, token, password, SSH key), and value.
• View — reveal a decrypted value; gated behind biometric authentication where enabled.
• Delete — remove a credential permanently.
• Encryption — values are encrypted before writing to the credentials table; the key lives in the system keychain.
• Usage — credentials are referenced by id from listeners, webhooks, MCP servers, ACP peers, and remote deployments, so tokens never appear in config files.

Integrations — search, email & voice

Service connections for OAuth providers (Slack, Gmail, GitHub, Notion, and 100+ more) live in Integrations. This tab covers the built-in helpers:

Design

Optionally pin a design system that every task injects, so generated UI artifacts stay on-brand.

• active_design_system — when set, this design system is injected into every task.
• design_systems_enabled — a map of name → enabled.
• design_linked_memories — memory names to co-inject alongside the active design system.
• Manage tokens (colors, typography, spacing, radii, shadows) and application theme. Tokens are exposed to agents via the design-systems endpoint and consumed by the design skills.

Skills

• Skill list — every installed skill with its name, category, and prompt preview.
• Edit / delete / new — modify a skill's prompt and metadata, remove it, or author a new one.
• Per-skill settings — enable/disable and configuration overrides, persisted in the skill_settings table.

See Skills & Agent Tools for the bundled skill catalog and how skills load.

Plugins

• Plugin list — installed plugins with name, version, status, and description.
• Enable / disable — disabled plugins are not loaded and consume no resources.
• Configuration — each plugin may expose its own settings; installed CLI tools can register as MCP servers via a plugin manifest.

Managed programmatically via /api/plugins.

MCPs

Add, edit, connect, disconnect, and delete Model Context Protocol servers (stdio or HTTP), set their isolation mode (shared or per-task), attach OAuth credentials, and import from JSON. Full details are in Integrations.

Teams & Roles

Teams

• List, create, edit, and delete teams — each with member roles and a workflow type (sequence / parallel / fan-out).
• Quick-start templates seed common configurations.

Roles & Prompts

• Built-in and custom roles grouped by category. Each role is a markdown system prompt with tool permissions, optional per-role model, and output settings.
• Create, duplicate, edit, and delete custom roles; built-ins can't be deleted.

See Multi-Agent Teams for how teams and roles run together.

Workflows

Create, edit, import, export, and delete visual workflows, and browse run history. The canvas editor and node types are documented in Automation & Workflows.

Commands

Manage custom slash commands — view them by name, description, handler type, and enabled state, and create / edit / delete them. Slash commands are covered in Automation & Workflows.

Data Management

Each destructive action requires confirmation.

Updates

• Check for updates — query the update server for a newer version.
• Changelog — see what changed between the installed version and the latest.
• Download and install — one-click update that verifies integrity and restarts. A toast appears automatically when an update is available.

Environment variables

Read at startup by aura-daemon / aura-workshop, or per-task by subsystem modules. For the keys they cover, env wins over the DB row — most useful for headless daemon deployments.

Editing settings programmatically

Beyond the UI, settings can be written over REST or (in the desktop app) via Tauri.

TOKEN=...
curl -X PUT https://aura.example.com/api/settings \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"native_mode": false, "execution_isolation": "sandbox"}'

Enum-typed fields are coerced on read — an invalid string falls back to its default silently. There is no schema endpoint; this page and the Settings struct are the reference. Some state is persisted outside the settings table (license key, on-disk memory, skill metadata, spend limits / fallback / routing rules / guardrails, OAuth connections, named credentials, and portal enrollment) — each edited from its own tab or API.