Configure your organization, branding, authentication, models, security, and deployment options.
The Settings page is organized into tabs, each controlling a different aspect of your AgenticMail Enterprise instance. Changes in most tabs are saved immediately when you click the save button.
| Tab | What It Controls |
|---|---|
| General | Company name, domain, branding (logo, favicon, colors), email signatures |
| Models | LLM providers, model pricing, API key management for AI services |
| API Keys | Create and revoke API keys for programmatic access to your instance |
| Authentication | SSO (SAML 2.0, OIDC), two-factor authentication |
| Platform | Platform-level configuration |
| Email & Domain | Organization-wide OAuth email config (Google Workspace / Microsoft 365) |
| Deployments | Deploy credentials for Docker, Kubernetes, cloud platforms |
| Security | Security system configuration, event monitoring, port scanning |
| Tool Security | Path sandboxing, SSRF protection, command sanitization |
| Network & Firewall | IP allowlists/blocklists, rate limiting, geo-blocking |
Set your company name, domain, subdomain, and plan tier. The plan tier controls agent limits:
| Plan | Agent Limit |
|---|---|
| Self-Hosted | Unlimited |
| Enterprise | Unlimited + Support |
| Team | 25 agents |
| Free | 3 agents |
Customize the dashboard to match your brand:
Define a shared HTML signature that all agents use in outgoing emails. Use template variables that get replaced per agent:
| Variable | Replaced With |
|---|---|
{{name}} | Agent's display name |
{{role}} | Agent's role |
{{email}} | Agent's email address |
{{phone}} | Agent's phone number |
{{company}} | Your organization name |
{{logo}} | Your company logo URL |
Configure which LLM providers your agents can use and set token pricing for billing calculations.
Add and manage API keys for AI model providers (Anthropic, OpenAI, Google, etc.). Each provider can be tested to verify connectivity.
Define input and output costs per million tokens for each model. This data is used to calculate agent token costs in billing reports (see Multi-Tenant Guide).
Create API keys for programmatic access to your AgenticMail instance. Keys support read, write, and admin scopes.
Enable 2FA for additional account security.
Enterprise SSO standard. Works with Okta, OneLogin, Azure AD, and any SAML 2.0 identity provider. You'll need:
Modern alternative to SAML. Works with Google Workspace, Microsoft Entra, Auth0, and any OIDC provider. Quick setup buttons are available for common providers.
Set up a shared OAuth application (Google or Microsoft) that all agents use for email. This centralizes OAuth app registration — each agent still authorizes individually, but they share the same Client ID and Secret.
https://your-domain.com/api/engine/oauth/callbackhttps://your-domain.com/api/engine/oauth/callbackManage deployment credentials for pushing agents to different environments (Docker, Kubernetes, cloud VMs). Create credentials with target-specific configuration.
The Security tab provides comprehensive security configuration including prompt injection defense, SQL injection prevention, input/output filtering, transport encryption, dependency management, screen unlock, and audit logging. Each section has its own Edit/Save/Cancel buttons.
| Section | What It Controls |
|---|---|
| Prompt Injection Defense | Multi-layer detection: monitor, sanitize, or block injection attempts |
| SQL Injection Prevention | Scan tool inputs and API bodies for SQL injection patterns |
| Input Validation | Max input length, JSON depth, HTML stripping, Unicode sanitization |
| Output Filtering | Scan agent outputs for secrets and PII; redact or block |
| Transport Encryption | AES-256-CBC encryption of API data between dashboard and server |
| Dependency Management | Org-wide package install policy, allowed managers, blocked packages |
| Screen Unlock | Auto-unlock the machine when agents need desktop access |
| Security Audit Log | Log prompt injection attempts, tool calls, API access |
View full Security System documentation →
Fine-grained control over what agents' tools can access:
| Control | What It Does |
|---|---|
| Path Sandbox | Restrict file system access to allowed directories. Block sensitive paths. |
| SSRF Protection | Block agents from making requests to internal network IPs. Allowlist specific internal hosts. |
| Command Sanitizer | Control which shell commands agents can execute. Blocklist or allowlist mode. |
| Audit Logging | Log all tool usage with optional key redaction. |
| Rate Limiting | Limit how frequently agents can use tools. |
| Circuit Breaker | Auto-disable tools that are failing repeatedly. |
View full Tool Security documentation →
Configure network-level security — who can access your instance and what agents can reach on the internet.
| Section | What It Controls |
|---|---|
| Inbound IP Filtering | Allowlist or blocklist IPs/CIDRs with test tool |
| Egress Filtering | Control outbound hosts and ports agents can reach |
| Proxy Configuration | HTTP/HTTPS proxy for corporate/air-gapped environments |
| Trusted Proxies | Reverse proxy IPs for correct X-Forwarded-For extraction |
| CORS Origins | Allowed cross-origin request domains |
| Rate Limiting | Per-IP requests per minute with skip paths |
| HTTPS Enforcement | Redirect HTTP to HTTPS in production |
| Security Headers | HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy |
| DNS Rebinding Protection | Host header validation against allowlist |
| Request Body Limits | Maximum payload size (default 10 MB) |
| Geo-IP Restrictions | Country-based access control with built-in geolocation |
| Webhook Security | HMAC validation and source IP filtering for webhooks |
View full Network & Firewall documentation →
| Issue | Solution |
|---|---|
| Logo not appearing after upload | Refresh the page. Favicon changes may require clearing browser cache. |
| SSO login fails | Verify redirect URI matches exactly. Check Entity ID and certificate. Use the OIDC test button to validate discovery. |
| Brand color not applying | Ensure the hex code is valid (#RRGGBB format). The color applies instantly — no save needed for preview. |
| API key not working | Check scopes — the key may not have the required permission. Also verify it hasn't been revoked. |
| Org email "redirect_uri_mismatch" | The redirect URI in your OAuth app must exactly match what's shown in the setup instructions, including protocol and path. |
AgenticMail Enterprise — Settings Documentation