<!-- Generated from the canonical OpenPost public page. Do not edit this build artifact. -->

Title: Configuration
Description: Configure URLs, storage, provider apps, and optional self-hosted services.
Canonical: https://docs.openpo.st/self-hosting/configuration
Source: [https://docs.openpo.st/self-hosting/configuration](https://docs.openpo.st/self-hosting/configuration)

# Configuration

Set `OPENPOST_APP_URL`, `OPENPOST_PUBLIC_URL`, and `OPENPOST_MEDIA_URL` to the addresses users and providers can reach. Use HTTPS for production. OAuth callback URLs must match the configured public URL exactly.

## Storage

SQLite at `OPENPOST_DATABASE_PATH` and local files at `OPENPOST_MEDIA_PATH` are the default. Set `OPENPOST_DATABASE_URL` for PostgreSQL. Use an S3-compatible media configuration when media should live outside the container. Back up the database and media together.

## Provider apps

Self-hosted operators create provider apps and enter their client IDs, secrets, callback URLs, and required permissions. Environment-defined provider apps are read-only in Settings and take precedence over database entries. Restart OpenPost after changing them.

| Provider                     | Setup requirement                                                     |
| ---------------------------- | --------------------------------------------------------------------- |
| X                            | OAuth callback registered in the X developer app                      |
| LinkedIn                     | LinkedIn app with the required products and permissions               |
| Threads, Facebook, Instagram | Meta app with the required product, account type, and permissions     |
| TikTok                       | App configured for the chosen posting product, review may be required |
| YouTube                      | Google OAuth client with YouTube API enabled                          |
| Mastodon                     | App per server, or automatic app setup on a public instance           |
| Bluesky                      | No provider app, use an account app password                          |
| Discord                      | Incoming webhook URL                                                  |

Provider rules and app review can change. Start with one account and test one post before adding more providers.

## Useful controls

Set `OPENPOST_DISABLE_REGISTRATIONS=true` after the first administrator has created the instance. Keep `OPENPOST_JWT_SECRET` and `OPENPOST_ENCRYPTION_KEY` private and stable. Configure CORS only for origins that need API access.