Advanced Settings
Setting up advanced configuration with Commander Service Mode
Advanced Configuration
Rate Limited Rules
Defines maximum API requests allowed within a specified time frame.
Default Rate Limits: 60/minute, 600/hour, 6000/day
Input Format: X/[minute|hour|day] or X per [minute|hour|day]
Valid Examples: "100/minute", "50/hour", "1000 per day"
Note: Case insensitive
IP Allow and IP Deny Lists
Controls access based on IP addresses or IP network ranges.
IP Allow List (Whitelist):
If specified, only IPs in this list are allowed access
Takes precedence over deny list
Default:
0.0.0.0/0(allow all) when not specified
IP Deny List (Blacklist):
IPs in this list are explicitly denied access
Only effective when allow list is not specified or when IP is not in allow list
Logic Flow:
If IP Allow list exists: Check if IP is allowed → Grant/Deny access
If IP Allow list is empty: Check IP Deny list → Deny if found, otherwise allow
Input Format: Comma-separated list of IP addresses or CIDR blocks
Validation Rules: Each IP must be valid IPv4 address or CIDR block
Valid Examples: "192.168.1.1, 10.0.0.0/24","172.16.0.0/16"
Notes: Empty list is allowed (skips validation)
Encryption Settings
Optional layer of AES-256 (GCM) encryption for all REST API responses
Input Format: y or n
Private Key Validation Rules:
Exactly 32 characters long
Allowed characters: alphanumeric and special characters (@#$%^&+=)
Cannot be empty
Note: The Key is required for API response decryption.
Token Expiration
Configures the REST API token lifespan.
Input Format: Xm, Xh, or Xd where X is a positive number and time units represent m for minutes, h for hours and d for days.
Validation Rules:
Value must be a positive number
Unit must be one of m, h or d
Valid Examples: "
30m", "24h", "7d".
Note: Empty input will set the token to never expire.
Command List
Specify the list of commands to be exposed via the API
Input Format: Comma-separated list of valid Keeper Commander commands
Validation Rules:
Must be a comma-separated list of valid Keeper Commander commands (can be seen by executing help in Commander CLI or entering some wrong command).
Cannot be empty
No spaces in individual commands.
Valid Example: "
whoami,tree,list"
Configuration Format
Input Format: Select between 'json' or 'yaml'
Validation Rules: Must be either 'json' or 'yaml' (case insensitive)
Run Mode
Input Format: Select between 'foreground' or 'background'
Foreground Mode: Service runs in the current terminal session Background Mode: Service runs as a background process with logging to files
Validation Rules: Must be either 'foreground' or 'background' (case insensitive)
Multiple API Token Support
The service_config.yaml file stored in the vault contains the service properties. In the file there is a section called "records". This allows you to define an API key with specific commands and token expiration.
Configuration Security
Important Security Feature: The local service configuration files are automatically encrypted using your private key to protect sensitive configuration data including API keys, tokens, and security settings.
Last updated
Was this helpful?