Configuration

A site is configured through small config files that live alongside its pages. This is where you set environment variables and secrets, control cross-origin access, add response headers, and adjust behavior for parts of a site.

Per-area configuration

Configuration cascades by folder: settings apply to a directory and everything beneath it, and a deeper folder can override what it inherits. That lets you keep site-wide defaults in one place and adjust behavior for a specific section — an API area, a portal, an admin folder — without repeating yourself.

What you can configure

• Environment variables and secrets — API keys, tokens, and settings your handlers read at runtime, kept out of your templates and version control.
• CORS — which origins may call your site's JSON endpoints, for front-end apps and integrations.
• Response headers — custom headers on responses, including security headers.
• Rate limits and spam controls — tune the protections on your endpoints and forms.
• Error pages — map not-found and unauthorized states to your own pages. (This is also the mechanism that mounts a single-page app.)
• The CSS build — turn off the platform's Tailwind build for sites whose stylesheet comes from their own bundler. This one is site-wide rather than per-folder.

Environments

Configuration supports the idea of environments, so a site can behave differently while you're developing versus in production — for example using test credentials locally under acira preview and live ones once published.

Secrets, specifically

Secrets are set as configuration and read by your logic at runtime; they never belong in template output or in committed files. Set them once and reference them by name from your handlers and scheduled tasks.