Settings & Credentials

Settings is the in-app control surface for the things you’d otherwise edit in a .env file or a config dialog: your provider API keys, OAuth secrets, SMTP for the Email node, the interface language, the theme, a global spend cap, and your account session.

Open it from the user menu in the top-right corner of the Workspace (Canvas): click your avatar, then Settings. Settings opens as a centered modal dialog with a vertical tab rail down the left side. The tabs are Appearance, Language, API Keys & Integrations, Connection, Safety, Models, and Advanced.

Credentials

The API Keys & Integrations tab lets you manage every secret RondoFlow needs without touching the .env file. Each credential is encrypted and stored on the server, then loaded into the environment so the Claude Code CLI, the OpenAI/Perplexity runners, and the SMTP sender can use it.

What you can set

Email (SMTP)

The Email (SMTP) group configures the SMTP relay used by the canvas Email Card (Node), which emails a workflow’s combined Assistant output as HTML. Two fields are required for email to work at all — SMTP_HOST and SMTP_FROM. If either is blank, the Email node is treated as not configured and stays inert (a blank host effectively disables it).

How credentials are stored and shown

Secrets are never returned to the browser in full. When you open Settings, the panel fetches only the status of each credential — whether it’s set, where it came from, and a masked preview.

• Secrets (API keys, OAuth client secrets, SMTP_PASS) are masked. The preview shows only the last four characters, e.g. ••••a1b2.
• Non-secrets (GitHub / Google Client IDs, the SMTP host/port/secure/user/from) are shown in full so you can confirm what’s configured.
• Each row shows a source label: Saved (stored in the database), From .env (falling back to the file), or Not set.

Behind the scenes, stored values are encrypted at rest with AES-256-GCM. The encryption key is derived (via scrypt) from a server secret.

Setting, changing, and clearing

The update semantics map directly to the API: an absent field is left unchanged, an empty string clears it (restoring the .env fallback), and a non-empty value sets it.

OAuth changes rebuild auth

When you change a GitHub or Google credential, RondoFlow rebuilds its authentication layer in place so that “Sign in with GitHub/Google” starts working without restarting the server. Claude, OpenAI, Perplexity, and SMTP credentials don’t require this — they’re picked up on the next Assistant run (or the next email send).

Language

The Language tab switches the UI locale. Five locales ship today: English (the default), Slovak, Spanish, French, and German. Your choice is persisted in the browser (local storage key rondoflow:locale) and re-applied on every visit. Localization covers user-facing strings only — code identifiers, model IDs, tool names, URLs, and brand names are never translated.

Theme

The Appearance tab has a three-way theme toggle:

Your choice is remembered in the browser and re-applied on every visit.

Global budget cap

The Advanced tab includes a Max Budget field. Despite the UI label reading “per Session”, this is a global per-run spend cap: the value is persisted on the canonical global Safety Rule (Policy) and forwarded as --max-budget-usd to every run. Leaving it blank means no cap.

• It is saved to the server when you leave the field (PUT /api/settings/budget), and loaded back when the dialog opens (GET /api/settings/budget).
• The value must be a positive number and is capped at 1000 USD by the API’s validation schema.
• Because it lives on the global Policy, it interacts with per-Assistant and per-Conversation (Session) rules using the usual “most restrictive wins” resolution — a stricter rule at a lower level still takes precedence. See Safety Rules for layered budgets.

Other Settings tabs

The remaining tabs expose client-side preferences stored locally in your browser. It’s worth knowing which controls actually affect the server and which are cosmetic:

• Connection — a server URL field (defaults to http://localhost:3001) with a Test button. The field is display-only and does not reconfigure the API endpoint (the real base is the build-time NEXT_PUBLIC_API_URL), and the Test button is a placeholder — it does not make a network request. It simply reports “connected” if the URL string contains localhost and “disconnected” otherwise.
• Safety — a global safety posture preference (Cautious / Balanced / Autonomous), stored in the browser. For the real enforced rules, see Safety Rules.
• Models — a default model preference (Deep Thinker / All-Rounder / Quick Helper, mapping to Opus / Sonnet / Haiku), stored in the browser.
• Advanced — beyond the global budget above, the Agent Teams toggle and the Max Concurrent Assistants slider are stored only in the browser and have no server effect today. The real concurrency limit is set by the MAX_CONCURRENT_AGENTS environment variable (default 5); the slider does not change it.

Interface complexity

RondoFlow has machinery for showing more or less of its interface via a complexity tier (Simple / Standard / Full). In the current build, the tier is hard-pinned to Full — every feature, palette Card (Node), and panel is visible, the tier indicator stays hidden, and there is no user-facing control to change it. The tier machinery remains wired up so simpler modes can be re-enabled later, but today it does not gate anything you can see.

Account

Your account lives in the same user menu that opens Settings:

• The menu header shows your name and email.
• The run-data panels — Activity, Audit Log, and Analytics — appear above Settings. A tier gate exists for these entries, but with the interface pinned to Full they are always shown.
• Sign out ends your session and returns you to the sign-in screen.

Where settings come from

RondoFlow reads configuration from three places, in increasing precedence:

1. The root .env file (the baseline, see Configuration).
2. Credentials stored in the database via this panel — these override the .env file at boot.
3. Live edits in Settings — applied immediately to the running server.

This is why clearing a credential in the UI “falls back to .env”: removing the database value restores whatever the file provided.

Next steps