Template Configuration Reference

This page describes the configuration implemented by the current ApiStandard template. It uses the standard ASP.NET Core configuration system: JSON, environment variables, user secrets, and command-line values can be combined, and later providers override earlier values.

MiniApi reuses the cache, authentication, login-policy, SMTP, SMS, and S3 options. Its ComponentOption does not include Database or IsMultiTenant; its database is fixed to PostgreSQL and it has no built-in EF Core migration resource. The database-selection and multi-tenancy settings below apply only to ApiStandard.

Configuration sources

The template has two configuration scopes:

• src/AppHost/appsettings*.json: read by AppHost to choose the database and cache and to pass the tenant setting, then injected into services when Aspire starts them.
• src/Services/ApiService and src/Services/AdminService appsettings*.json: service-specific settings such as authentication, CORS, cache policy, and optional toolkit services.

When running through Aspire, AppHost shares the infrastructure choices with the services:

The __ separator in an environment variable represents : in a configuration path:

$env:Components__IsMultiTenant = "true"
$env:Authentication__Jwt__Sign = "replace-with-a-secret"

When a service is run directly, AppHost does not inject these values. Provide the same settings through the service configuration, environment, or secret store.

Components

Components binds to ComponentOption:

The current ComponentOption has no Components:UseOpenAPI property and the template does not read it. Do not use it to control OpenAPI. ApiStandard uses its current Swagger defaults; MiniApi uses ASP.NET Core OpenAPI.

Cache

Cache binds to CacheOption; the time values are in minutes:

Authentication

Jwt

The path is Authentication:Jwt. In production, provide Sign through an environment variable or secret store:

OAuth

The path is Authentication:OAuth:

Authentication:OAuth:ClientId appears in some examples but is not a property of the current OAuthOption; Microsoft and Google client settings are described below.

LoginSecurityPolicy

The path is LoginSecurityPolicy:

Optional toolkit services

These options are registered only when the corresponding Components:Use* flag is true:

Other configuration sections

These settings are read directly by the template but are not part of the custom Options above:

• Cors:AllowedOrigins: production allowed-origin list.
• Cors:AllowedSubdomains: allow wildcard subdomains.
• Authentication:Microsoft and Authentication:Google: third-party login is registered when ClientId, ClientSecret, and CallbackUrl are all valid.
• ConnectionStrings:Default, ConnectionStrings:Analysis, and ConnectionStrings:Cache: the default business database, optional analysis database, and cache connections. When Analysis is not configured, it uses Default; use AddConnectionString in AppHost when an existing database or cache should be shared.
• OTEL_EXPORTER_OTLP_ENDPOINT: the standard OpenTelemetry exporter endpoint injected by Aspire.

Migration environment variables

The migration script and AppHost use these variables to keep the model consistent:

• Components__Database: selects the database provider used by migration generation.
• Components__IsMultiTenant: is passed from AppHost and the migration script to the services; it does not control tenant-index generation. TenantIndexConvention handles entities implementing ITenantEntityBase.

See EF Core migrations and seeding and Deploying applications for the migration and release workflows.