Configuration keys

Arc CMS reads its settings from three places: the install config arccms.config.json, a few environment variables, and the starter files of the custom space. This page lists every key.

The install config: arccms.config.json

The optional file arccms.config.json at the repository root says how Arc CMS sits in each Firebase project: which database, hosting site and bucket it uses. Without it every value is the default, which is right for a site that has a Firebase project to itself. Copy arccms.config.example.json to start:

{
  "profile": "standalone",
  "projects": {
    "your-project-id": {
      "profile": "backend",
      "databaseId": "arccms",
      "hostingSite": "your-project-arccms",
      "storageBucket": "your-project-arccms",
      "storagePrefix": ""
    }
  }
}

Keys at the top level apply to every project; the keys under projects override them for one project. Nothing reads the file directly at run time: npm run arc:configure turns it into src/environments/arc-install.ts, functions/.env.<projectId> and, when needed, firebase.<projectId>.json, and the guided npm run deploy does the same before each deploy. How to set it up is on Configure a project and Sharing a Firebase project.

Keys

Key	Type and default	Effect
`profile`	`"standalone"` or `"backend"`. Default `"standalone"`.	`standalone`: Arc CMS has the project to itself. `backend`: it shares the project with another app, so it must have its own `databaseId` (not `(default)`), `hostingSite` and `storageBucket`, `adminOnlySignIn` defaults to `yes`, and `arc:configure` prints the commands that create those resources.
`projects`	Object keyed by Firebase project id. Default none.	Settings for one project, laid over the top-level keys. `arc:configure --project=<alias or id>` resolves an alias from `.firebaserc` to the id.
`databaseId`	String. Default `"(default)"`.	The Firestore database Arc CMS reads and writes. Lowercase letters, digits and hyphens, 3 to 63 characters, starting with a letter; or `(default)`. Written to `arc-install.ts` for the browser, to `ARC_DATABASE_ID` for the functions, and to the generated Firebase config for rules and index deploys.
`hostingSite`	String. Default the project id (the project's first site).	The Firebase Hosting site the static pages are published to. `"none"` turns Hosting off: nothing is published and a deploy includes no Hosting. Written to `ARC_HOSTING_SITE`, the generated Firebase config and `src/environments/arc-install.ts` (so the admin in `npm run dev` can compare your site files with the live ones).
`storageBucket`	String, without `gs://`. Default the bucket in the app's Firebase config.	The Storage bucket for uploads. Written to `arc-install.ts`, `ARC_STORAGE_BUCKET` and the generated Firebase config. With a named database but no bucket of its own, Arc CMS deploys no Storage rules, because a bucket has one rules file and the other app's would be replaced.
`storagePrefix`	String. Default `""` (the bucket root).	A folder every new upload goes under, such as `"arccms/"`. Must be one folder ending in a slash. Written to `arc-install.ts` and `ARC_STORAGE_PREFIX`.
`adminOnlySignIn`	`"yes"` or `"no"`. Default `"yes"` for `backend`, else `"no"`.	Onboarding turns sign-ups off once the first admin exists. Written to `arc-install.ts`. See Sign-in methods.
`offlineCache`	`"off"`, `"single-tab"` or `"multi-tab"`. Default `"off"`.	Firestore's offline cache in the browser: loaded data stays on the device and offline writes are sent later. Written to `arc-install.ts` only (the functions do not use it). See Keep working offline.
`firebaseConfig`	Object, the Firebase web settings (`apiKey`, `authDomain`, `projectId`, `appId` and the optional ones). Default not set. The one value that is not a string.	Set under `projects.<id>` by `--web-config=fetch` (the Firebase CLI) or `--web-config=<file>`. Its `projectId` must be that project. Written to `src/environments/firebase-web.<id>.ts`, which builds for that project use. See Dev, staging and production.
`production`	`"yes"` or `"no"`. Default not set.	`yes`: the guided deploy asks for the project id to be typed back, a deploy with options needs `--confirm-production=<project id>` (see Deploy from CI), and admin scripts say `(production)`, whatever the alias is called. It also makes `buildMode` default to `"production"`.
`buildMode`	`"production"` or `"development"`. Default `"production"` for a project marked `production`, else `"development"`.	How a build for the project runs. `production`: no debug tools and no instance label on the sign-in page. Written as `production` in the project's generated web settings, so it applies once the project has its own `firebaseConfig`. Separate from `production`: a staging project can build like production without being guarded as the live one. See Dev, staging and production.
`analyticsConsent`	`"always"` or `"required"`. Default `"always"`.	Whether Google Analytics tracks every visitor, or only those who accepted the site usage banner (with the banner off, nobody). Written to `arc-install.ts` only. See Analytics.
`appUsersDatabase`	String. Default `"(default)"`.	The database that holds the host app's users, for the App audience. Written to `ARC_APP_USERS_DATABASE`. See App audience.
`appUsersPath`	String, `<collection>/{id}`. Default a collection nothing writes to.	The host app's user documents, one top-level collection, such as `users/{uid}`. Written to `ARC_APP_USERS_PATH`.
`appUsers`	`"own"`. Default not set.	The App audience is this install's own `users` collection; sets `appUsersDatabase` to `databaseId` and `appUsersPath` to `users/{id}`.
`region`	String, a Firestore or Storage location. Default not set.	The location in the setup commands `arc:configure` prints for a `backend` install. When `functionsRegion` is not set, it also chooses that: the region next to this location.
`functionsRegion`	String, a Cloud Functions region. Default `"us-central1"`.	Where the functions run: next to the database. The first functions deploy sets it to the database's region (see Regions). Written to `ARC_FUNCTIONS_REGION` for the functions, to `arc-install.ts` for the website, and onto the Hosting rewrites in the generated Firebase config.

Every value is a string. arc:configure drops any other type without a word, so "adminOnlySignIn": true is ignored and the default applies. Write "yes" or "no", or use the flag: npm run arc:configure -- --admin-only-sign-in=yes.

Each key has a flag that sets it for one project and writes the file for you: --profile, --database, --site, --bucket, --prefix, --region, --functions-region, --app-users-database, --app-users-path, --app-users, --admin-only-sign-in, --offline-cache, --analytics-consent, --production, --build-mode, plus --web-config=fetch|<file> (and --web-app=<appId>) for firebaseConfig. Add --dry-run to see what would change.

Environment variables

The Cloud Functions read their install settings from functions/.env (the committed defaults) overridden by functions/.env.<projectId>. arc:configure writes the ARC_ lines of the project's file and keeps every other line, so set these through arccms.config.json, not by hand.

Variable	Default	Read by and effect
`ARC_DATABASE_ID`	`(default)`	The functions: the database they use, and, as a deploy-time parameter, the database every Firestore trigger listens on. Always written, because a non-interactive deploy refuses a parameter with no value.
`ARC_FUNCTIONS_REGION`	`us-central1`	The functions, as a deploy-time parameter: the region every function runs in (`functions/src/region.ts`; the one first generation function, `onSignInDeleted`, reads it itself), and the address the published search box calls. Always written, like `ARC_DATABASE_ID`.
`ARC_HOSTING_SITE`	The project id	The functions and the seed scripts: the Hosting site pages are published to. `none` turns publishing off.
`ARC_STORAGE_BUCKET`	The project's default bucket	The functions: the bucket Arc CMS files live in, such as the folder deleted with an account.
`ARC_STORAGE_PREFIX`	Empty (bucket root)	The functions: the upload folder, ending in `/`.
`ARC_APP_USERS_DATABASE`	`(default)`	The functions, as a deploy-time parameter: the database of the host app's users.
`ARC_APP_USERS_PATH`	`_arccms_app_users_not_configured/{id}`	The functions, as a deploy-time parameter: the host app's user documents, watched by the App audience trigger. The default is a path nothing writes to.
`PORT`	Vite's own (5173)	`npm run dev`: the dev server's port, so a second one can run beside the first.
`ARC_PROJECT`	Not set	`npm run build` and `npm run dev`: an alias or project id; the build uses that project's web settings (its `firebase-web.<id>.ts`, else the matching environment file) and stops if it has none. `npm run deploy` sets it to the project it deploys to. Without it, both use the `default` alias's project when it has a `firebase-web.<id>.ts`, else the environment file, and stop when that names no project. See Dev, staging and production.
`USE_DEV_ENV`	Not set	`npm run build` without `ARC_PROJECT`, when the `default` alias has no `firebase-web.<id>.ts`: `true` builds for production with `src/environments/environment.ts` instead of `src/environments/environment.prod.ts`. The deploy scripts no longer use it.
`GCLOUD_PROJECT`	The alias's project in `.firebaserc`	`npm run seed:dev` and `seed:prod`: the project to seed, when set.

A trigger's database is fixed when the function is deployed, from ARC_DATABASE_ID in the dotenv files. Change databaseId, run arc:configure, then deploy the functions again, or the triggers keep listening on the old database.

Custom space starter exports

An app configures Arc CMS through the starter files of the custom space. Arc CMS ships each one empty and never edits it again. See Use the custom space. This table lists the starter files' own exports; whatever else an app's custom code exports is the app's, and needs no entry here.

Export	File and type	What it does
`CUSTOM_FEATURES`	`src/custom/features.ts`, `FeatureChoice`: `{ on?: FeatureId[]; off?: FeatureId[] }`	The features the app turns on (`pwa`) or off. Empty: every feature except `pwa`. See Feature ids.
`MEMBER_LANGUAGES`	`src/custom/languages.ts`, `MemberLanguage[]`: `{ code; label; locale; localeData?; partial? }`	The languages members get besides English; the admin keeps Arc CMS's own. Empty: as before. See Member languages.
`CUSTOM_ROUTES`	`src/custom/routes.ts`, Angular `Routes`	The app's own routes, added after Arc CMS's explicit routes and before the file-based pages, so an app page cannot replace a core page. See Add pages and routes.
`CUSTOM_NAV`	`src/custom/nav.ts`, `MenuItem[]`	The app's items in the admin menu, shown before Profile. Each item takes `label`, `labelKey`, `route` or `externalUrl`, `icon`, `subItems`, `allowRoles` and `feature`. See Change the admin menu.
`CUSTOM_NAV_CHANGES`	`src/custom/nav-changes.ts`, `NavChanges`: `{ admin?: NavChange[]; member?: NavChange[] }`	The app's changes to the admin and member menus, applied in order for the signed-in person's role. `src/custom/nav.ts` also ships it, empty, from before `nav-changes.ts` existed: changes written there are applied first. A change is `{ id, ...fields }` (`route`, `queryParams`, `externalUrl`, `icon`, `label`, `labelKey`, `allowRoles`), `{ id, hide: true }`, `{ id, before \| after }` or `{ add: item, before? \| after? }`, each with optional `roles`. Profile, Logout and Sign out cannot be removed. Empty: both menus as shipped. See Change Arc CMS's items and Change the member menu.
`CUSTOM_HOME`	`src/custom/home.ts`, `HomePages`: role to path	Where each role lands after signing in, laid over the defaults (`admin`: `/admin/dashboard`, everyone else: `/user/dashboard`). `'*'` covers roles not listed, but not `admin`, which keeps its default unless you list it. A sign-in that started from a page returns there instead. See Build the member area.
`CUSTOM_BRAND`	`src/custom/brand.ts`, `CustomBrand`: `{ name?; titles? }`	The site's name until an admin sets one in Settings, About, and `titles`: a core page's own tab title by path, such as `{ '/admin/users': 'Staff' }`. Empty: Settings, About, then Arc CMS's name. See Brand the admin.
`CUSTOM_APP_ACCOUNTS`	`src/custom/app-accounts.ts`, `AppAccountChoice`: `{ memberPages? }`	Whether locked app accounts may open the member pages (`/user/...`, `/account`). Empty: they may, with a read-only profile. `memberPages: false` sends them to their home page instead. See App accounts.
`CUSTOM_SIGN_IN`	`src/custom/sign-in.ts`, `SignInChoice`: `{ strength? }`	How hard new passwords and PINs must be. Empty or `'strict'`: passwords of 8 characters or more that are not easy to guess, PINs that are not repeated digits, a run or a common pattern. `'simple'`: passwords of 6 characters or more, any 6-digit PIN. The first admin always gets the strict rule. Any other value stops the build. See Set up sign-in.
`CUSTOM_USER_DASHBOARD`	`src/custom/user-dashboard.ts`, `UserDashboardLoader \| null`	A loader for the app's own page at `/user/dashboard`. `null` shows Arc CMS's dashboard. See Build the member area.
`CUSTOM_PWA`	`src/custom/pwa.ts`, `Partial<PwaConfig>`	The installable app's `name`, `shortName`, `description`, `themeColor`, `backgroundColor`, `startUrl`, `navigationTimeoutSeconds`, `routeCode`, `icon` (the image its icons are made from) and `appleIcon` (`padded` or `fill`, the iPhone icon), laid over the defaults in `src/app/core/pwa/pwa-config.ts`. Used only when `pwa` is on. See Make it installable.
`SEARCH_COLLECTIONS`	`functions/src/custom/search-sources.ts`, `string[]`	Collections the app makes searchable besides content. Each gets its own trigger, so adding or removing one needs a functions deploy; fields and results are set in the admin under Settings, Search. See Search.
`CUSTOM_SEARCH_SOURCES`	`functions/src/custom/search-sources.ts`, `SearchSource[]`	Search sources written in code, for what the settings cannot express. A ready-made one for products is in `functions/src/search/sources/products.ts`. See Search.

The other starter files have no settings to export: src/custom/pages/ (file-based pages), src/custom/i18n/ (translations), src/custom/styles.css (global styles), functions/src/custom/index.ts (the app's Cloud Functions, deployed as arccms-custom-<name>) and functions/src/custom/public-callables.txt (the app's callables, one per line, for the post-deploy access check).