---
title: Configuration
description: The app settings App Translations reads, and how source headers get their values.
seo:
  image: /og/configuration.png
---

App Translations reads its settings from the `AppTranslations` section of your site's configuration. Every setting is optional.

| Setting | Default | Purpose |
| --- | --- | --- |
| `SourceSecurity:AllowPrivateNetworkEndpoints` | `false` | Let sources read from private networks and `localhost`. |
| `DeploymentSync:ApiKey` | none | Turns on [deployment-triggered sync](/syncing#with-a-secret) with a secret. A long random value, without spaces. To use an OIDC token instead, [register a policy](/syncing#with-an-oidc-token) in code. |
| `Delivery:ApiKey` | none | Requires a key for the [delivery endpoints](/delivery-api#access), which are public without one. A long random value, without spaces. |
| `Delivery:MaxAgeSeconds` | `60` | How long clients and CDNs may keep a [delivery response](/delivery-api#caching). `0` makes them check every time. |

Set them in `appsettings.json`, or as environment variables, where the separators are double underscores:

```json appsettings.json
{
  "AppTranslations": {
    "DeploymentSync": { "ApiKey": "replace-with-a-long-random-value" },
    "Delivery": { "MaxAgeSeconds": 60 }
  }
}
```

```sh Environment variables
AppTranslations__DeploymentSync__ApiKey=replace-with-a-long-random-value
AppTranslations__Delivery__MaxAgeSeconds=60
```

Keep the keys out of source control, in your host's secret store or user secrets.

A key that contains whitespace stops the site at startup, because it could never match what a client sends.

A source header can name a setting to read its value from, which keeps secrets out of the database. See [Sources that need authentication](/sources#sources-that-need-authentication).

Everything else is set in the backoffice, in **Settings > App translations**: sources and their sync schedules, the AI assistant, and whether Umbraco's Translation section is hidden while the Dictionary is empty.

One Umbraco setting matters too. Umbraco sends the [App translations updated webhook](/syncing#telling-your-application-something-changed) only while `Umbraco:CMS:Webhook:Enabled` is on, which it is by default.