Skip to main content

⚙️ Settings reference

All settings live in one CONTENT_STUDIO dictionary in your Django settings. Every setting is optional; leave out the ones you do not change.

# mysite/settings.py
CONTENT_STUDIO = {
    "ADMIN_SITE": "mysite.studio.admin_site",
    "MEDIA_LIBRARY_MODEL": "content_studio.media_library.models.Media",
}

Site​

ADMIN_SITE​

The site the admin runs on, as an import path string. Default: "content_studio.admin.admin_site", a site without customizations. To add a dashboard, extensions, tenants or media library hooks, subclass ContentStudioSite and point this setting at your instance.

Login and sessions​

LOGIN_BACKENDS​

The login backends, as import path strings. Default: ["content_studio.login_backends.UsernamePasswordBackend"], the only supported backend (authentication).

LOGIN_THROTTLE_RATE​

The maximum number of login attempts per IP address, as a Django REST Framework rate string such as "10/min". Default: "10/min". None removes the limit. Attempts are counted in the cache: with the default per-process cache, every worker counts separately, so configure a shared cache.

TOKEN_BACKEND​

The token backend that manages sessions, as an import path string. Default: "content_studio.token_backends.JsonWebTokenBackend", the only supported backend.

TOKEN_LIFETIME​

How long a session stays active between renewals, in seconds. Default: 3600 (one hour). Sessions renew themselves while the editor works, so a short lifetime does not log anyone out.

REFRESH_TOKEN_LIFETIME​

How long a session can go unused before the editor has to log in again, in seconds. Default: 604800 (seven days).

TOKEN_SIGNING_KEY​

The key that signs the sessions. Default: None, which uses Django's SECRET_KEY. Set a separate key if you rotate SECRET_KEY independently of admin sessions.

TOKEN_ALGORITHM​

The algorithm that signs the sessions: "HS256", "HS384" or "HS512". Default: "HS256".

Whether the session cookie is marked Secure, so browsers only send it over HTTPS. Default: None, which marks it secure on HTTPS requests and whenever DEBUG is off, also behind a proxy that does not set SECURE_PROXY_SSL_HEADER. Set True or False to force either value. A production site served over plain HTTP needs False to log in at all, and should move to HTTPS.

Audit stamps​

EDITED_BY_ATTR, EDITED_AT_ATTR, CREATED_BY_ATTR, CREATED_AT_ATTR​

The field names of the audit stamps. Defaults: "edited_by", "edited_at", "created_by" and "created_at". When an editor creates an object, the admin fills in created_by; when they save it, edited_by and edited_at. Models without these fields are left as they are.

Content​

HTML_SANITIZER​

The sanitizer that cleans HTMLField values on save: a callable or an import path string. Default: None, the built-in sanitizer, which keeps a common set of tags, attributes and link types and removes everything else. A sanitizer passed to an HTMLField takes precedence over this setting.

Media library​

MEDIA_LIBRARY_MODEL, MEDIA_LIBRARY_FOLDER_MODEL​

The media item and folder models of the media library, as import path strings. Default: None, which turns the media library off.

MEDIA_LIBRARY_ALLOWED_EXTENSIONS​

The file extensions the media library accepts, in lowercase and without the dot. By default:

  • images: avif, gif, jpeg, jpg, png, webp;
  • video and audio: m4a, mov, mp3, mp4, ogg, wav, webm;
  • documents: csv, doc, docx, odp, ods, odt, pdf, ppt, pptx, txt, xls, xlsx.

SVG is left out because it can contain scripts. None accepts every extension. Files whose content is markup (HTML, SVG, XML) are rejected whatever their extension.

MEDIA_LIBRARY_MAX_UPLOAD_SIZE​

The maximum size of an upload, in bytes. Default: 52428800 (50 MB). None removes the limit; your web server's own request size limit still applies.

FOCAL_POINT_ATTR​

The field on the media item model that stores the focal point, which turns on the focal point editor of the media library. The field must be a JSONField; the editor stores {"x": 0-100, "y": 0-100}, percentages of the image's width and height. Default: None, which turns the editor off. System check content_studio.E009 reports a focal point field without a media library model, or one that is missing or not a JSONField.

Multi-tenancy​

TENANT_MODEL​

The tenant model for multi-tenancy, as an import path string. Default: None, which turns multi-tenancy off.

Password reset​

PASSWORD_RESET_EXPIRATION_TIME​

How long a password reset code stays valid, in minutes. Default: 10.

PASSWORD_RESET_THROTTLE_RATE​

The maximum number of password reset requests per IP address, as a Django REST Framework rate string. Default: "10/hour". None removes the limit. Like the login limit, it is counted in the cache.