---
title: "Get public server configuration"
method: GET
path: "/api/config"
tags: ["config", "internal"]
---

# Get public server configuration

`GET /api/config`

Returns public configuration settings like OIDC providers, billing status, etc.

## Response `200`

Public server configuration

- ApiResponsePublicConfigResponse
  - `data` object — The result payload. Omitted on failure.
    - `billing_enabled` boolean, required — Whether this deployment has billing configured.
    - `deployment_type` 'cloud' | 'commercial' | 'community', required
    - `disable_password_login` boolean, required — Whether email/password login is turned off, leaving OIDC as the only method.
    - `disable_registration` boolean, required — Whether self-service sign-up is turned off on this deployment.
    - `discount_save_offer_available` boolean, required — `STRIPE_SAVE_OFFER_COUPON_ID` env var is set. When false, the cancel modal hides the discount save-offer panel so the user doesn't see an option the deployment can't fulfil.
    - `has_email_opt_in` boolean, required — Whether the deployment asks users to opt in to product email.
    - `has_email_service` boolean, required — Whether outbound email is configured. Invites and password resets need it.
    - `has_integrated_daemon` boolean, required — Whether a daemon runs alongside the server, so no separate install is needed to start scanning.
    - `license_expiry` string, date, nullable — Hard expiry — the drop-dead date after which the server rejects the key. Referenced by the grace-period banner.
    - `license_in_grace_period` boolean, required — True when the license is past `intended_exp` but not yet past the hard `exp` — the silent grace window.
    - `license_intended_expiry` string, date, nullable — User-visible expiry — the date displayed to end users under normal operation. 7 days earlier than `license_expiry` for keys issued after grace-period support landed.
    - `license_status` 'valid' | 'expired' | 'invalid' — Runtime license state as reported by the public config endpoint.
    - `needs_cookie_consent` boolean, required — Whether the client should show a cookie-consent prompt.
    - `oidc_providers` OidcProviderMetadata[], required — Identity providers available on the login screen.
      - `logo` string, nullable — Logo to show on the login button, when the provider has one configured.
      - `name` string, required — Display name of the identity provider, shown on the login button.
      - `slug` string, required — URL-safe identifier used in the provider's login and link endpoints.
    - `org_limit_reached` boolean, required — True when this self-hosted instance has reached its licensed organization cap (`included_orgs`), so new-org registration is blocked. Always false on cloud (multi-tenant) and on unlimited-org plans.
    - `posthog_key` string, nullable — Public analytics key, when analytics is enabled.
    - `public_url` string, uri, required — Base URL this server is reachable at, as configured by the operator.
    - `server_admin_contact_email` string, email, required — Admin contact email to show users blocked by `org_limit_reached`, from `SCANOPY_SERVER_ADMIN_CONTACT_EMAIL`.
    - `server_port` integer, required — Port this server listens on.
    - `snapshot_retention_days_override` integer, nullable — `SCANOPY_SNAPSHOT_RETENTION_DAYS_OVERRIDE` if set on this instance. Frontend uses it inside the plan-comparison view to display the effective retention for this deployment rather than the per-plan fixture default.
    - `stripe_publishable_key` string, nullable — Stripe publishable key, exposed so the frontend can mount Stripe Elements (Payment Element) for in-app card collection. `None` when billing isn't configured. Publishable keys are safe to expose to the browser (same as `posthog_key`).
  - `error` string, nullable — Human-readable failure message. Omitted on success.
  - `meta` ApiMeta, required — API metadata included in all responses
    - `api_version` integer, required — API version (integer, increments on breaking changes)
    - `server_version` string, required — Server version (semver)
  - `success` boolean, required — `true` when the request succeeded. `false` responses carry `error` instead of `data`.

---

[API](https://skmtc.net/scanopy/apis/scanopy-api.md) · [All operations](https://skmtc.net/scanopy/apis/scanopy-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/scanopy/scanopy-api/revisions/2df1fc47dfa7/schema)