CINXE.COM

<!DOCTYPE html> <html lang="en" data-content_root="../"> <head> <meta charset="utf-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <meta name="viewport" content="width=device-width, initial-scale=1"> <title>Configuration Handling — Flask Documentation (3.1.x)</title> <link rel="stylesheet" type="text/css" href="../_static/pygments.css?v=4f649999" /> <link rel="stylesheet" type="text/css" href="../_static/flask.css?v=b87c8d14" /> <link rel="stylesheet" type="text/css" href="../_static/tabs.css?v=a5c4661c" /> <script src="../_static/documentation_options.js?v=d71c4578"></script> <script src="../_static/doctools.js?v=9bcbadda"></script> <script src="../_static/sphinx_highlight.js?v=dc90522c"></script> <script src="../_static/tabs.js?v=3030b3cb"></script> <link rel="canonical" href="https://flask.palletsprojects.com/en/stable/config/" /> <link rel="icon" href="../_static/shortcut-icon.png"/> <link rel="index" title="Index" href="../genindex/" /> <link rel="search" title="Search" href="../search/" /> <link rel="next" title="Signals" href="../signals/" /> <link rel="prev" title="Logging" href="../logging/" /> <script async type="text/javascript" src="/_/static/javascript/readthedocs-addons.js"></script><meta name="readthedocs-project-slug" content="flask" /><meta name="readthedocs-version-slug" content="stable" /><meta name="readthedocs-resolver-filename" content="/config/" /><meta name="readthedocs-http-status" content="200" /></head><body> <div class="related" role="navigation" aria-label="Related"> <h3>Navigation</h3> <ul> <li class="right" style="margin-right: 10px"> <a href="../genindex/" title="General Index" accesskey="I">index</a></li> <li class="right" > <a href="../py-modindex/" title="Python Module Index" >modules</a> |</li> <li class="right" > <a href="../signals/" title="Signals" accesskey="N">next</a> |</li> <li class="right" > <a href="../logging/" title="Logging" accesskey="P">previous</a> |</li> <li class="nav-item nav-item-0"><a href="../">Flask Documentation (3.1.x)</a> »</li> <li class="nav-item nav-item-this"><a href="">Configuration Handling</a></li> </ul> </div> <div class="document"> <div class="documentwrapper"> <div class="bodywrapper"> <div class="body" role="main"> <section id="configuration-handling"> <h1>Configuration Handling<a class="headerlink" href="#configuration-handling" title="Link to this heading">¶</a></h1> Applications need some kind of configuration. There are different settings you might want to change depending on the application environment like toggling the debug mode, setting the secret key, and other such environment-specific things. The way Flask is designed usually requires the configuration to be available when the application starts up. You can hard code the configuration in the code, which for many small applications is not actually that bad, but there are better ways. Independent of how you load your config, there is a config object available which holds the loaded configuration values: The <a class="reference internal" href="../api/#flask.Flask.config" title="flask.Flask.config"><code class="xref py py-attr docutils literal notranslate">config</code></a> attribute of the <a class="reference internal" href="../api/#flask.Flask" title="flask.Flask"><code class="xref py py-class docutils literal notranslate">Flask</code></a> object. This is the place where Flask itself puts certain configuration values and also where extensions can put their configuration values. But this is also where you can have your own configuration. <section id="configuration-basics"> <h2>Configuration Basics<a class="headerlink" href="#configuration-basics" title="Link to this heading">¶</a></h2> The <a class="reference internal" href="../api/#flask.Flask.config" title="flask.Flask.config"><code class="xref py py-attr docutils literal notranslate">config</code></a> is actually a subclass of a dictionary and can be modified just like any dictionary: <div class="highlight-default notranslate"><div class="highlight"><pre>app = Flask(__name__) app.config['TESTING'] = True </pre></div> </div> Certain configuration values are also forwarded to the <a class="reference internal" href="../api/#flask.Flask" title="flask.Flask"><code class="xref py py-attr docutils literal notranslate">Flask</code></a> object so you can read and write them from there: <div class="highlight-default notranslate"><div class="highlight"><pre>app.testing = True </pre></div> </div> To update multiple keys at once you can use the <a class="reference external" href="https://docs.python.org/3/library/stdtypes.html#dict.update" title="(in Python v3.13)"><code class="xref py py-meth docutils literal notranslate">dict.update()</code></a> method: <div class="highlight-default notranslate"><div class="highlight"><pre>app.config.update( TESTING=True, SECRET_KEY='192b9bdd22ab9ed4d12e236c78afcb9a393ec15f71bbf5dc987d54727823bcbf' ) </pre></div> </div> </section> <section id="debug-mode"> <h2>Debug Mode<a class="headerlink" href="#debug-mode" title="Link to this heading">¶</a></h2> The <a class="reference internal" href="#DEBUG" title="DEBUG"><code class="xref py py-data docutils literal notranslate">DEBUG</code></a> config value is special because it may behave inconsistently if changed after the app has begun setting up. In order to set debug mode reliably, use the <code class="docutils literal notranslate">--debug</code> option on the <code class="docutils literal notranslate">flask</code> or <code class="docutils literal notranslate">flask run</code> command. <code class="docutils literal notranslate">flask run</code> will use the interactive debugger and reloader by default in debug mode. <div class="highlight-text notranslate"><div class="highlight"><pre>$ flask --app hello run --debug </pre></div> </div> Using the option is recommended. While it is possible to set <a class="reference internal" href="#DEBUG" title="DEBUG"><code class="xref py py-data docutils literal notranslate">DEBUG</code></a> in your config or code, this is strongly discouraged. It can’t be read early by the <code class="docutils literal notranslate">flask run</code> command, and some systems or extensions may have already configured themselves based on a previous value. </section> <section id="builtin-configuration-values"> <h2>Builtin Configuration Values<a class="headerlink" href="#builtin-configuration-values" title="Link to this heading">¶</a></h2> The following configuration values are used internally by Flask: <dl class="py data"> <dt class="sig sig-object py" id="DEBUG"> DEBUG<a class="headerlink" href="#DEBUG" title="Link to this definition">¶</a></dt> <dd>Whether debug mode is enabled. When using <code class="docutils literal notranslate">flask run</code> to start the development server, an interactive debugger will be shown for unhandled exceptions, and the server will be reloaded when code changes. The <a class="reference internal" href="../api/#flask.Flask.debug" title="flask.Flask.debug"><code class="xref py py-attr docutils literal notranslate">debug</code></a> attribute maps to this config key. This is set with the <code class="docutils literal notranslate">FLASK_DEBUG</code> environment variable. It may not behave as expected if set in code. Do not enable debug mode when deploying in production. Default: <code class="docutils literal notranslate">False</code> </dd></dl> <dl class="py data"> <dt class="sig sig-object py" id="TESTING"> TESTING<a class="headerlink" href="#TESTING" title="Link to this definition">¶</a></dt> <dd>Enable testing mode. Exceptions are propagated rather than handled by the the app’s error handlers. Extensions may also change their behavior to facilitate easier testing. You should enable this in your own tests. Default: <code class="docutils literal notranslate">False</code> </dd></dl> <dl class="py data"> <dt class="sig sig-object py" id="PROPAGATE_EXCEPTIONS"> PROPAGATE_EXCEPTIONS<a class="headerlink" href="#PROPAGATE_EXCEPTIONS" title="Link to this definition">¶</a></dt> <dd>Exceptions are re-raised rather than being handled by the app’s error handlers. If not set, this is implicitly true if <code class="docutils literal notranslate">TESTING</code> or <code class="docutils literal notranslate">DEBUG</code> is enabled. Default: <code class="docutils literal notranslate">None</code> </dd></dl> <dl class="py data"> <dt class="sig sig-object py" id="TRAP_HTTP_EXCEPTIONS"> TRAP_HTTP_EXCEPTIONS<a class="headerlink" href="#TRAP_HTTP_EXCEPTIONS" title="Link to this definition">¶</a></dt> <dd>If there is no handler for an <code class="docutils literal notranslate">HTTPException</code>-type exception, re-raise it to be handled by the interactive debugger instead of returning it as a simple error response. Default: <code class="docutils literal notranslate">False</code> </dd></dl> <dl class="py data"> <dt class="sig sig-object py" id="TRAP_BAD_REQUEST_ERRORS"> TRAP_BAD_REQUEST_ERRORS<a class="headerlink" href="#TRAP_BAD_REQUEST_ERRORS" title="Link to this definition">¶</a></dt> <dd>Trying to access a key that doesn’t exist from request dicts like <code class="docutils literal notranslate">args</code> and <code class="docutils literal notranslate">form</code> will return a 400 Bad Request error page. Enable this to treat the error as an unhandled exception instead so that you get the interactive debugger. This is a more specific version of <code class="docutils literal notranslate">TRAP_HTTP_EXCEPTIONS</code>. If unset, it is enabled in debug mode. Default: <code class="docutils literal notranslate">None</code> </dd></dl> <dl class="py data"> <dt class="sig sig-object py" id="SECRET_KEY"> SECRET_KEY<a class="headerlink" href="#SECRET_KEY" title="Link to this definition">¶</a></dt> <dd>A secret key that will be used for securely signing the session cookie and can be used for any other security related needs by extensions or your application. It should be a long random <code class="docutils literal notranslate">bytes</code> or <code class="docutils literal notranslate">str</code>. For example, copy the output of this to your config: <div class="highlight-default notranslate"><div class="highlight"><pre>$ python -c 'import secrets; print(secrets.token_hex())' '192b9bdd22ab9ed4d12e236c78afcb9a393ec15f71bbf5dc987d54727823bcbf' </pre></div> </div> Do not reveal the secret key when posting questions or committing code. Default: <code class="docutils literal notranslate">None</code> </dd></dl> <dl class="py data"> <dt class="sig sig-object py" id="SECRET_KEY_FALLBACKS"> SECRET_KEY_FALLBACKS<a class="headerlink" href="#SECRET_KEY_FALLBACKS" title="Link to this definition">¶</a></dt> <dd>A list of old secret keys that can still be used for unsigning, most recent first. This allows a project to implement key rotation without invalidating active sessions or other recently-signed secrets. Keys should be removed after an appropriate period of time, as checking each additional key adds some overhead. Flask’s built-in secure cookie session supports this. Extensions that use <a class="reference internal" href="#SECRET_KEY" title="SECRET_KEY"><code class="xref py py-data docutils literal notranslate">SECRET_KEY</code></a> may not support this yet. Default: <code class="docutils literal notranslate">None</code> <div class="versionadded"> Added in version 3.1. </div> </dd></dl> <dl class="py data"> <dt class="sig sig-object py" id="SESSION_COOKIE_NAME"> SESSION_COOKIE_NAME<a class="headerlink" href="#SESSION_COOKIE_NAME" title="Link to this definition">¶</a></dt> <dd>The name of the session cookie. Can be changed in case you already have a cookie with the same name. Default: <code class="docutils literal notranslate">'session'</code> </dd></dl> <dl class="py data"> <dt class="sig sig-object py" id="SESSION_COOKIE_DOMAIN"> SESSION_COOKIE_DOMAIN<a class="headerlink" href="#SESSION_COOKIE_DOMAIN" title="Link to this definition">¶</a></dt> <dd>The value of the <code class="docutils literal notranslate">Domain</code> parameter on the session cookie. If not set, browsers will only send the cookie to the exact domain it was set from. Otherwise, they will send it to any subdomain of the given value as well. Not setting this value is more restricted and secure than setting it. Default: <code class="docutils literal notranslate">None</code> <div class="admonition warning"> Warning If this is changed after the browser created a cookie is created with one setting, it may result in another being created. Browsers may send send both in an undefined order. In that case, you may want to change <a class="reference internal" href="#SESSION_COOKIE_NAME" title="SESSION_COOKIE_NAME"><code class="xref py py-data docutils literal notranslate">SESSION_COOKIE_NAME</code></a> as well or otherwise invalidate old sessions. </div> <details class="changelog"> <summary>Changelog</summary><div class="versionchanged"> Changed in version 2.3: Not set by default, does not fall back to <code class="docutils literal notranslate">SERVER_NAME</code>. </div> </details></dd></dl> <dl class="py data"> <dt class="sig sig-object py" id="SESSION_COOKIE_PATH"> SESSION_COOKIE_PATH<a class="headerlink" href="#SESSION_COOKIE_PATH" title="Link to this definition">¶</a></dt> <dd>The path that the session cookie will be valid for. If not set, the cookie will be valid underneath <code class="docutils literal notranslate">APPLICATION_ROOT</code> or <code class="docutils literal notranslate">/</code> if that is not set. Default: <code class="docutils literal notranslate">None</code> </dd></dl> <dl class="py data"> <dt class="sig sig-object py" id="SESSION_COOKIE_HTTPONLY"> SESSION_COOKIE_HTTPONLY<a class="headerlink" href="#SESSION_COOKIE_HTTPONLY" title="Link to this definition">¶</a></dt> <dd>Browsers will not allow JavaScript access to cookies marked as “HTTP only” for security. Default: <code class="docutils literal notranslate">True</code> </dd></dl> <dl class="py data"> <dt class="sig sig-object py" id="SESSION_COOKIE_SECURE"> SESSION_COOKIE_SECURE<a class="headerlink" href="#SESSION_COOKIE_SECURE" title="Link to this definition">¶</a></dt> <dd>Browsers will only send cookies with requests over HTTPS if the cookie is marked “secure”. The application must be served over HTTPS for this to make sense. Default: <code class="docutils literal notranslate">False</code> </dd></dl> <dl class="py data"> <dt class="sig sig-object py" id="SESSION_COOKIE_PARTITIONED"> SESSION_COOKIE_PARTITIONED<a class="headerlink" href="#SESSION_COOKIE_PARTITIONED" title="Link to this definition">¶</a></dt> <dd>Browsers will send cookies based on the top-level document’s domain, rather than only the domain of the document setting the cookie. This prevents third party cookies set in iframes from “leaking” between separate sites. Browsers are beginning to disallow non-partitioned third party cookies, so you need to mark your cookies partitioned if you expect them to work in such embedded situations. Enabling this implicitly enables <a class="reference internal" href="#SESSION_COOKIE_SECURE" title="SESSION_COOKIE_SECURE"><code class="xref py py-data docutils literal notranslate">SESSION_COOKIE_SECURE</code></a> as well, as it is only valid when served over HTTPS. Default: <code class="docutils literal notranslate">False</code> <div class="versionadded"> Added in version 3.1. </div> </dd></dl> <dl class="py data"> <dt class="sig sig-object py" id="SESSION_COOKIE_SAMESITE"> SESSION_COOKIE_SAMESITE<a class="headerlink" href="#SESSION_COOKIE_SAMESITE" title="Link to this definition">¶</a></dt> <dd>Restrict how cookies are sent with requests from external sites. Can be set to <code class="docutils literal notranslate">'Lax'</code> (recommended) or <code class="docutils literal notranslate">'Strict'</code>. See <a class="reference internal" href="../web-security/#security-cookie">Set-Cookie options</a>. Default: <code class="docutils literal notranslate">None</code> <details class="changelog"> <summary>Changelog</summary><div class="versionadded"> Added in version 1.0. </div> </details></dd></dl> <dl class="py data"> <dt class="sig sig-object py" id="PERMANENT_SESSION_LIFETIME"> PERMANENT_SESSION_LIFETIME<a class="headerlink" href="#PERMANENT_SESSION_LIFETIME" title="Link to this definition">¶</a></dt> <dd>If <code class="docutils literal notranslate">session.permanent</code> is true, the cookie’s expiration will be set this number of seconds in the future. Can either be a <a class="reference external" href="https://docs.python.org/3/library/datetime.html#datetime.timedelta" title="(in Python v3.13)"><code class="xref py py-class docutils literal notranslate">datetime.timedelta</code></a> or an <code class="docutils literal notranslate">int</code>. Flask’s default cookie implementation validates that the cryptographic signature is not older than this value. Default: <code class="docutils literal notranslate">timedelta(days=31)</code> (<code class="docutils literal notranslate">2678400</code> seconds) </dd></dl> <dl class="py data"> <dt class="sig sig-object py" id="SESSION_REFRESH_EACH_REQUEST"> SESSION_REFRESH_EACH_REQUEST<a class="headerlink" href="#SESSION_REFRESH_EACH_REQUEST" title="Link to this definition">¶</a></dt> <dd>Control whether the cookie is sent with every response when <code class="docutils literal notranslate">session.permanent</code> is true. Sending the cookie every time (the default) can more reliably keep the session from expiring, but uses more bandwidth. Non-permanent sessions are not affected. Default: <code class="docutils literal notranslate">True</code> </dd></dl> <dl class="py data"> <dt class="sig sig-object py" id="USE_X_SENDFILE"> USE_X_SENDFILE<a class="headerlink" href="#USE_X_SENDFILE" title="Link to this definition">¶</a></dt> <dd>When serving files, set the <code class="docutils literal notranslate">X-Sendfile</code> header instead of serving the data with Flask. Some web servers, such as Apache, recognize this and serve the data more efficiently. This only makes sense when using such a server. Default: <code class="docutils literal notranslate">False</code> </dd></dl> <dl class="py data"> <dt class="sig sig-object py" id="SEND_FILE_MAX_AGE_DEFAULT"> SEND_FILE_MAX_AGE_DEFAULT<a class="headerlink" href="#SEND_FILE_MAX_AGE_DEFAULT" title="Link to this definition">¶</a></dt> <dd>When serving files, set the cache control max age to this number of seconds. Can be a <a class="reference external" href="https://docs.python.org/3/library/datetime.html#datetime.timedelta" title="(in Python v3.13)"><code class="xref py py-class docutils literal notranslate">datetime.timedelta</code></a> or an <code class="docutils literal notranslate">int</code>. Override this value on a per-file basis using <a class="reference internal" href="../api/#flask.Flask.get_send_file_max_age" title="flask.Flask.get_send_file_max_age"><code class="xref py py-meth docutils literal notranslate">get_send_file_max_age()</code></a> on the application or blueprint. If <code class="docutils literal notranslate">None</code>, <code class="docutils literal notranslate">send_file</code> tells the browser to use conditional requests will be used instead of a timed cache, which is usually preferable. Default: <code class="docutils literal notranslate">None</code> </dd></dl> <dl class="py data"> <dt class="sig sig-object py" id="TRUSTED_HOSTS"> TRUSTED_HOSTS<a class="headerlink" href="#TRUSTED_HOSTS" title="Link to this definition">¶</a></dt> <dd>Validate <a class="reference internal" href="../api/#flask.Request.host" title="flask.Request.host"><code class="xref py py-attr docutils literal notranslate">Request.host</code></a> and other attributes that use it against these trusted values. Raise a <a class="reference external" href="https://werkzeug.palletsprojects.com/en/stable/exceptions/#werkzeug.exceptions.SecurityError" title="(in Werkzeug v3.1.x)"><code class="xref py py-exc docutils literal notranslate">SecurityError</code></a> if the host is invalid, which results in a 400 error. If it is <code class="docutils literal notranslate">None</code>, all hosts are valid. Each value is either an exact match, or can start with a dot <code class="docutils literal notranslate">.</code> to match any subdomain. Validation is done during routing against this value. <code class="docutils literal notranslate">before_request</code> and <code class="docutils literal notranslate">after_request</code> callbacks will still be called. Default: <code class="docutils literal notranslate">None</code> <div class="versionadded"> Added in version 3.1. </div> </dd></dl> <dl class="py data"> <dt class="sig sig-object py" id="SERVER_NAME"> SERVER_NAME<a class="headerlink" href="#SERVER_NAME" title="Link to this definition">¶</a></dt> <dd>Inform the application what host and port it is bound to. Must be set if <code class="docutils literal notranslate">subdomain_matching</code> is enabled, to be able to extract the subdomain from the request. Must be set for <code class="docutils literal notranslate">url_for</code> to generate external URLs outside of a request context. Default: <code class="docutils literal notranslate">None</code> <div class="versionchanged"> Changed in version 3.1: Does not restrict requests to only this domain, for both <code class="docutils literal notranslate">subdomain_matching</code> and <code class="docutils literal notranslate">host_matching</code>. </div> <details class="changelog"> <summary>Changelog</summary><div class="versionchanged"> Changed in version 2.3: Does not affect <code class="docutils literal notranslate">SESSION_COOKIE_DOMAIN</code>. </div> <div class="versionchanged"> Changed in version 1.0: Does not implicitly enable <code class="docutils literal notranslate">subdomain_matching</code>. </div> </details></dd></dl> <dl class="py data"> <dt class="sig sig-object py" id="APPLICATION_ROOT"> APPLICATION_ROOT<a class="headerlink" href="#APPLICATION_ROOT" title="Link to this definition">¶</a></dt> <dd>Inform the application what path it is mounted under by the application / web server. This is used for generating URLs outside the context of a request (inside a request, the dispatcher is responsible for setting <code class="docutils literal notranslate">SCRIPT_NAME</code> instead; see <a class="reference internal" href="../patterns/appdispatch/">Application Dispatching</a> for examples of dispatch configuration). Will be used for the session cookie path if <code class="docutils literal notranslate">SESSION_COOKIE_PATH</code> is not set. Default: <code class="docutils literal notranslate">'/'</code> </dd></dl> <dl class="py data"> <dt class="sig sig-object py" id="PREFERRED_URL_SCHEME"> PREFERRED_URL_SCHEME<a class="headerlink" href="#PREFERRED_URL_SCHEME" title="Link to this definition">¶</a></dt> <dd>Use this scheme for generating external URLs when not in a request context. Default: <code class="docutils literal notranslate">'http'</code> </dd></dl> <dl class="py data"> <dt class="sig sig-object py" id="MAX_CONTENT_LENGTH"> MAX_CONTENT_LENGTH<a class="headerlink" href="#MAX_CONTENT_LENGTH" title="Link to this definition">¶</a></dt> <dd>The maximum number of bytes that will be read during this request. If this limit is exceeded, a 413 <a class="reference external" href="https://werkzeug.palletsprojects.com/en/stable/exceptions/#werkzeug.exceptions.RequestEntityTooLarge" title="(in Werkzeug v3.1.x)"><code class="xref py py-exc docutils literal notranslate">RequestEntityTooLarge</code></a> error is raised. If it is set to <code class="docutils literal notranslate">None</code>, no limit is enforced at the Flask application level. However, if it is <code class="docutils literal notranslate">None</code> and the request has no <code class="docutils literal notranslate">Content-Length</code> header and the WSGI server does not indicate that it terminates the stream, then no data is read to avoid an infinite stream. Each request defaults to this config. It can be set on a specific <a class="reference internal" href="../api/#flask.Request.max_content_length" title="flask.Request.max_content_length"><code class="xref py py-attr docutils literal notranslate">Request.max_content_length</code></a> to apply the limit to that specific view. This should be set appropriately based on an application’s or view’s specific needs. Default: <code class="docutils literal notranslate">None</code> <details class="changelog"> <summary>Changelog</summary><div class="versionadded"> Added in version 0.6. </div> </details></dd></dl> <dl class="py data"> <dt class="sig sig-object py" id="MAX_FORM_MEMORY_SIZE"> MAX_FORM_MEMORY_SIZE<a class="headerlink" href="#MAX_FORM_MEMORY_SIZE" title="Link to this definition">¶</a></dt> <dd>The maximum size in bytes any non-file form field may be in a <code class="docutils literal notranslate">multipart/form-data</code> body. If this limit is exceeded, a 413 <a class="reference external" href="https://werkzeug.palletsprojects.com/en/stable/exceptions/#werkzeug.exceptions.RequestEntityTooLarge" title="(in Werkzeug v3.1.x)"><code class="xref py py-exc docutils literal notranslate">RequestEntityTooLarge</code></a> error is raised. If it is set to <code class="docutils literal notranslate">None</code>, no limit is enforced at the Flask application level. Each request defaults to this config. It can be set on a specific <code class="xref py py-attr docutils literal notranslate">Request.max_form_memory_parts</code> to apply the limit to that specific view. This should be set appropriately based on an application’s or view’s specific needs. Default: <code class="docutils literal notranslate">500_000</code> <div class="versionadded"> Added in version 3.1. </div> </dd></dl> <dl class="py data"> <dt class="sig sig-object py" id="MAX_FORM_PARTS"> MAX_FORM_PARTS<a class="headerlink" href="#MAX_FORM_PARTS" title="Link to this definition">¶</a></dt> <dd>The maximum number of fields that may be present in a <code class="docutils literal notranslate">multipart/form-data</code> body. If this limit is exceeded, a 413 <a class="reference external" href="https://werkzeug.palletsprojects.com/en/stable/exceptions/#werkzeug.exceptions.RequestEntityTooLarge" title="(in Werkzeug v3.1.x)"><code class="xref py py-exc docutils literal notranslate">RequestEntityTooLarge</code></a> error is raised. If it is set to <code class="docutils literal notranslate">None</code>, no limit is enforced at the Flask application level. Each request defaults to this config. It can be set on a specific <a class="reference internal" href="../api/#flask.Request.max_form_parts" title="flask.Request.max_form_parts"><code class="xref py py-attr docutils literal notranslate">Request.max_form_parts</code></a> to apply the limit to that specific view. This should be set appropriately based on an application’s or view’s specific needs. Default: <code class="docutils literal notranslate">1_000</code> <div class="versionadded"> Added in version 3.1. </div> </dd></dl> <dl class="py data"> <dt class="sig sig-object py" id="TEMPLATES_AUTO_RELOAD"> TEMPLATES_AUTO_RELOAD<a class="headerlink" href="#TEMPLATES_AUTO_RELOAD" title="Link to this definition">¶</a></dt> <dd>Reload templates when they are changed. If not set, it will be enabled in debug mode. Default: <code class="docutils literal notranslate">None</code> </dd></dl> <dl class="py data"> <dt class="sig sig-object py" id="EXPLAIN_TEMPLATE_LOADING"> EXPLAIN_TEMPLATE_LOADING<a class="headerlink" href="#EXPLAIN_TEMPLATE_LOADING" title="Link to this definition">¶</a></dt> <dd>Log debugging information tracing how a template file was loaded. This can be useful to figure out why a template was not loaded or the wrong file appears to be loaded. Default: <code class="docutils literal notranslate">False</code> </dd></dl> <dl class="py data"> <dt class="sig sig-object py" id="MAX_COOKIE_SIZE"> MAX_COOKIE_SIZE<a class="headerlink" href="#MAX_COOKIE_SIZE" title="Link to this definition">¶</a></dt> <dd>Warn if cookie headers are larger than this many bytes. Defaults to <code class="docutils literal notranslate">4093</code>. Larger cookies may be silently ignored by browsers. Set to <code class="docutils literal notranslate">0</code> to disable the warning. </dd></dl> <dl class="py data"> <dt class="sig sig-object py" id="PROVIDE_AUTOMATIC_OPTIONS"> PROVIDE_AUTOMATIC_OPTIONS<a class="headerlink" href="#PROVIDE_AUTOMATIC_OPTIONS" title="Link to this definition">¶</a></dt> <dd>Set to <code class="docutils literal notranslate">False</code> to disable the automatic addition of OPTIONS responses. This can be overridden per route by altering the <code class="docutils literal notranslate">provide_automatic_options</code> attribute. </dd></dl> <div class="versionadded"> Added in version 3.10: Added <a class="reference internal" href="#PROVIDE_AUTOMATIC_OPTIONS" title="PROVIDE_AUTOMATIC_OPTIONS"><code class="xref py py-data docutils literal notranslate">PROVIDE_AUTOMATIC_OPTIONS</code></a> to control the default addition of autogenerated OPTIONS responses. </div> <details class="changelog"> <summary>Changelog</summary><div class="versionchanged"> Changed in version 2.3: <code class="docutils literal notranslate">JSON_AS_ASCII</code>, <code class="docutils literal notranslate">JSON_SORT_KEYS</code>, <code class="docutils literal notranslate">JSONIFY_MIMETYPE</code>, and <code class="docutils literal notranslate">JSONIFY_PRETTYPRINT_REGULAR</code> were removed. The default <code class="docutils literal notranslate">app.json</code> provider has equivalent attributes instead. </div> <div class="versionchanged"> Changed in version 2.3: <code class="docutils literal notranslate">ENV</code> was removed. </div> <div class="versionchanged"> Changed in version 2.2: Removed <code class="docutils literal notranslate">PRESERVE_CONTEXT_ON_EXCEPTION</code>. </div> <div class="versionchanged"> Changed in version 1.0: <code class="docutils literal notranslate">LOGGER_NAME</code> and <code class="docutils literal notranslate">LOGGER_HANDLER_POLICY</code> were removed. See <a class="reference internal" href="../logging/">Logging</a> for information about configuration. Added <code class="xref py py-data docutils literal notranslate">ENV</code> to reflect the <code class="xref std std-envvar docutils literal notranslate">FLASK_ENV</code> environment variable. Added <a class="reference internal" href="#SESSION_COOKIE_SAMESITE" title="SESSION_COOKIE_SAMESITE"><code class="xref py py-data docutils literal notranslate">SESSION_COOKIE_SAMESITE</code></a> to control the session cookie’s <code class="docutils literal notranslate">SameSite</code> option. Added <a class="reference internal" href="#MAX_COOKIE_SIZE" title="MAX_COOKIE_SIZE"><code class="xref py py-data docutils literal notranslate">MAX_COOKIE_SIZE</code></a> to control a warning from Werkzeug. </div> <div class="versionadded"> Added in version 0.11: <code class="docutils literal notranslate">SESSION_REFRESH_EACH_REQUEST</code>, <code class="docutils literal notranslate">TEMPLATES_AUTO_RELOAD</code>, <code class="docutils literal notranslate">LOGGER_HANDLER_POLICY</code>, <code class="docutils literal notranslate">EXPLAIN_TEMPLATE_LOADING</code> </div> <div class="versionadded"> Added in version 0.10: <code class="docutils literal notranslate">JSON_AS_ASCII</code>, <code class="docutils literal notranslate">JSON_SORT_KEYS</code>, <code class="docutils literal notranslate">JSONIFY_PRETTYPRINT_REGULAR</code> </div> <div class="versionadded"> Added in version 0.9: <code class="docutils literal notranslate">PREFERRED_URL_SCHEME</code> </div> <div class="versionadded"> Added in version 0.8: <code class="docutils literal notranslate">TRAP_BAD_REQUEST_ERRORS</code>, <code class="docutils literal notranslate">TRAP_HTTP_EXCEPTIONS</code>, <code class="docutils literal notranslate">APPLICATION_ROOT</code>, <code class="docutils literal notranslate">SESSION_COOKIE_DOMAIN</code>, <code class="docutils literal notranslate">SESSION_COOKIE_PATH</code>, <code class="docutils literal notranslate">SESSION_COOKIE_HTTPONLY</code>, <code class="docutils literal notranslate">SESSION_COOKIE_SECURE</code> </div> <div class="versionadded"> Added in version 0.7: <code class="docutils literal notranslate">PROPAGATE_EXCEPTIONS</code>, <code class="docutils literal notranslate">PRESERVE_CONTEXT_ON_EXCEPTION</code> </div> <div class="versionadded"> Added in version 0.6: <code class="docutils literal notranslate">MAX_CONTENT_LENGTH</code> </div> <div class="versionadded"> Added in version 0.5: <code class="docutils literal notranslate">SERVER_NAME</code> </div> <div class="versionadded"> Added in version 0.4: <code class="docutils literal notranslate">LOGGER_NAME</code> </div> </details></section> <section id="configuring-from-python-files"> <h2>Configuring from Python Files<a class="headerlink" href="#configuring-from-python-files" title="Link to this heading">¶</a></h2> Configuration becomes more useful if you can store it in a separate file, ideally located outside the actual application package. You can deploy your application, then separately configure it for the specific deployment. A common pattern is this: <div class="highlight-default notranslate"><div class="highlight"><pre>app = Flask(__name__) app.config.from_object('yourapplication.default_settings') app.config.from_envvar('YOURAPPLICATION_SETTINGS') </pre></div> </div> This first loads the configuration from the <code class="code docutils literal notranslate">yourapplication.default_settings</code> module and then overrides the values with the contents of the file the <code class="xref std std-envvar docutils literal notranslate">YOURAPPLICATION_SETTINGS</code> environment variable points to. This environment variable can be set in the shell before starting the server: <div class="sphinx-tabs docutils container"> <div aria-label="Tabbed content" class="closeable" role="tablist"><button aria-controls="panel-0-QmFzaA==" aria-selected="true" class="sphinx-tabs-tab group-tab" id="tab-0-QmFzaA==" name="QmFzaA==" role="tab" tabindex="0">Bash</button><button aria-controls="panel-0-RmlzaA==" aria-selected="false" class="sphinx-tabs-tab group-tab" id="tab-0-RmlzaA==" name="RmlzaA==" role="tab" tabindex="-1">Fish</button><button aria-controls="panel-0-Q01E" aria-selected="false" class="sphinx-tabs-tab group-tab" id="tab-0-Q01E" name="Q01E" role="tab" tabindex="-1">CMD</button><button aria-controls="panel-0-UG93ZXJzaGVsbA==" aria-selected="false" class="sphinx-tabs-tab group-tab" id="tab-0-UG93ZXJzaGVsbA==" name="UG93ZXJzaGVsbA==" role="tab" tabindex="-1">Powershell</button></div><div aria-labelledby="tab-0-QmFzaA==" class="sphinx-tabs-panel group-tab" id="panel-0-QmFzaA==" name="QmFzaA==" role="tabpanel" tabindex="0"><div class="highlight-text notranslate"><div class="highlight"><pre>$ export YOURAPPLICATION_SETTINGS=/path/to/settings.cfg $ flask run * Running on http://127.0.0.1:5000/ </pre></div> </div> </div><div aria-labelledby="tab-0-RmlzaA==" class="sphinx-tabs-panel group-tab" hidden="true" id="panel-0-RmlzaA==" name="RmlzaA==" role="tabpanel" tabindex="0"><div class="highlight-text notranslate"><div class="highlight"><pre>$ set -x YOURAPPLICATION_SETTINGS /path/to/settings.cfg $ flask run * Running on http://127.0.0.1:5000/ </pre></div> </div> </div><div aria-labelledby="tab-0-Q01E" class="sphinx-tabs-panel group-tab" hidden="true" id="panel-0-Q01E" name="Q01E" role="tabpanel" tabindex="0"><div class="highlight-text notranslate"><div class="highlight"><pre>> set YOURAPPLICATION_SETTINGS=\path\to\settings.cfg > flask run * Running on http://127.0.0.1:5000/ </pre></div> </div> </div><div aria-labelledby="tab-0-UG93ZXJzaGVsbA==" class="sphinx-tabs-panel group-tab" hidden="true" id="panel-0-UG93ZXJzaGVsbA==" name="UG93ZXJzaGVsbA==" role="tabpanel" tabindex="0"><div class="highlight-text notranslate"><div class="highlight"><pre>> $env:YOURAPPLICATION_SETTINGS = "\path\to\settings.cfg" > flask run * Running on http://127.0.0.1:5000/ </pre></div> </div> </div></div> The configuration files themselves are actual Python files. Only values in uppercase are actually stored in the config object later on. So make sure to use uppercase letters for your config keys. Here is an example of a configuration file: <div class="highlight-default notranslate"><div class="highlight"><pre># Example configuration SECRET_KEY = '192b9bdd22ab9ed4d12e236c78afcb9a393ec15f71bbf5dc987d54727823bcbf' </pre></div> </div> Make sure to load the configuration very early on, so that extensions have the ability to access the configuration when starting up. There are other methods on the config object as well to load from individual files. For a complete reference, read the <a class="reference internal" href="../api/#flask.Config" title="flask.Config"><code class="xref py py-class docutils literal notranslate">Config</code></a> object’s documentation. </section> <section id="configuring-from-data-files"> <h2>Configuring from Data Files<a class="headerlink" href="#configuring-from-data-files" title="Link to this heading">¶</a></h2> It is also possible to load configuration from a file in a format of your choice using <a class="reference internal" href="../api/#flask.Config.from_file" title="flask.Config.from_file"><code class="xref py py-meth docutils literal notranslate">from_file()</code></a>. For example to load from a TOML file: <div class="highlight-python notranslate"><div class="highlight"><pre>import tomllib app.config.from_file("config.toml", load=tomllib.load, text=False) </pre></div> </div> Or from a JSON file: <div class="highlight-python notranslate"><div class="highlight"><pre>import json app.config.from_file("config.json", load=json.load) </pre></div> </div> </section> <section id="configuring-from-environment-variables"> <h2>Configuring from Environment Variables<a class="headerlink" href="#configuring-from-environment-variables" title="Link to this heading">¶</a></h2> In addition to pointing to configuration files using environment variables, you may find it useful (or necessary) to control your configuration values directly from the environment. Flask can be instructed to load all environment variables starting with a specific prefix into the config using <a class="reference internal" href="../api/#flask.Config.from_prefixed_env" title="flask.Config.from_prefixed_env"><code class="xref py py-meth docutils literal notranslate">from_prefixed_env()</code></a>. Environment variables can be set in the shell before starting the server: <div class="sphinx-tabs docutils container"> <div aria-label="Tabbed content" class="closeable" role="tablist"><button aria-controls="panel-1-QmFzaA==" aria-selected="true" class="sphinx-tabs-tab group-tab" id="tab-1-QmFzaA==" name="QmFzaA==" role="tab" tabindex="0">Bash</button><button aria-controls="panel-1-RmlzaA==" aria-selected="false" class="sphinx-tabs-tab group-tab" id="tab-1-RmlzaA==" name="RmlzaA==" role="tab" tabindex="-1">Fish</button><button aria-controls="panel-1-Q01E" aria-selected="false" class="sphinx-tabs-tab group-tab" id="tab-1-Q01E" name="Q01E" role="tab" tabindex="-1">CMD</button><button aria-controls="panel-1-UG93ZXJzaGVsbA==" aria-selected="false" class="sphinx-tabs-tab group-tab" id="tab-1-UG93ZXJzaGVsbA==" name="UG93ZXJzaGVsbA==" role="tab" tabindex="-1">Powershell</button></div><div aria-labelledby="tab-1-QmFzaA==" class="sphinx-tabs-panel group-tab" id="panel-1-QmFzaA==" name="QmFzaA==" role="tabpanel" tabindex="0"><div class="highlight-text notranslate"><div class="highlight"><pre>$ export FLASK_SECRET_KEY="5f352379324c22463451387a0aec5d2f" $ export FLASK_MAIL_ENABLED=false $ flask run * Running on http://127.0.0.1:5000/ </pre></div> </div> </div><div aria-labelledby="tab-1-RmlzaA==" class="sphinx-tabs-panel group-tab" hidden="true" id="panel-1-RmlzaA==" name="RmlzaA==" role="tabpanel" tabindex="0"><div class="highlight-text notranslate"><div class="highlight"><pre>$ set -x FLASK_SECRET_KEY "5f352379324c22463451387a0aec5d2f" $ set -x FLASK_MAIL_ENABLED false $ flask run * Running on http://127.0.0.1:5000/ </pre></div> </div> </div><div aria-labelledby="tab-1-Q01E" class="sphinx-tabs-panel group-tab" hidden="true" id="panel-1-Q01E" name="Q01E" role="tabpanel" tabindex="0"><div class="highlight-text notranslate"><div class="highlight"><pre>> set FLASK_SECRET_KEY="5f352379324c22463451387a0aec5d2f" > set FLASK_MAIL_ENABLED=false > flask run * Running on http://127.0.0.1:5000/ </pre></div> </div> </div><div aria-labelledby="tab-1-UG93ZXJzaGVsbA==" class="sphinx-tabs-panel group-tab" hidden="true" id="panel-1-UG93ZXJzaGVsbA==" name="UG93ZXJzaGVsbA==" role="tabpanel" tabindex="0"><div class="highlight-text notranslate"><div class="highlight"><pre>> $env:FLASK_SECRET_KEY = "5f352379324c22463451387a0aec5d2f" > $env:FLASK_MAIL_ENABLED = "false" > flask run * Running on http://127.0.0.1:5000/ </pre></div> </div> </div></div> The variables can then be loaded and accessed via the config with a key equal to the environment variable name without the prefix i.e. <div class="highlight-python notranslate"><div class="highlight"><pre>app.config.from_prefixed_env() app.config["SECRET_KEY"] # Is "5f352379324c22463451387a0aec5d2f" </pre></div> </div> The prefix is <code class="docutils literal notranslate">FLASK_</code> by default. This is configurable via the <code class="docutils literal notranslate">prefix</code> argument of <a class="reference internal" href="../api/#flask.Config.from_prefixed_env" title="flask.Config.from_prefixed_env"><code class="xref py py-meth docutils literal notranslate">from_prefixed_env()</code></a>. Values will be parsed to attempt to convert them to a more specific type than strings. By default <a class="reference external" href="https://docs.python.org/3/library/json.html#json.loads" title="(in Python v3.13)"><code class="xref py py-func docutils literal notranslate">json.loads()</code></a> is used, so any valid JSON value is possible, including lists and dicts. This is configurable via the <code class="docutils literal notranslate">loads</code> argument of <a class="reference internal" href="../api/#flask.Config.from_prefixed_env" title="flask.Config.from_prefixed_env"><code class="xref py py-meth docutils literal notranslate">from_prefixed_env()</code></a>. When adding a boolean value with the default JSON parsing, only “true” and “false”, lowercase, are valid values. Keep in mind that any non-empty string is considered <code class="docutils literal notranslate">True</code> by Python. It is possible to set keys in nested dictionaries by separating the keys with double underscore (<code class="docutils literal notranslate">__</code>). Any intermediate keys that don’t exist on the parent dict will be initialized to an empty dict. <div class="highlight-text notranslate"><div class="highlight"><pre>$ export FLASK_MYAPI__credentials__username=user123 </pre></div> </div> <div class="highlight-python notranslate"><div class="highlight"><pre>app.config["MYAPI"]["credentials"]["username"] # Is "user123" </pre></div> </div> On Windows, environment variable keys are always uppercase, therefore the above example would end up as <code class="docutils literal notranslate">MYAPI__CREDENTIALS__USERNAME</code>. For even more config loading features, including merging and case-insensitive Windows support, try a dedicated library such as <a class="reference external" href="https://www.dynaconf.com/">Dynaconf</a>, which includes integration with Flask. </section> <section id="configuration-best-practices"> <h2>Configuration Best Practices<a class="headerlink" href="#configuration-best-practices" title="Link to this heading">¶</a></h2> The downside with the approach mentioned earlier is that it makes testing a little harder. There is no single 100% solution for this problem in general, but there are a couple of things you can keep in mind to improve that experience: <ol class="arabic simple"> <li>Create your application in a function and register blueprints on it. That way you can create multiple instances of your application with different configurations attached which makes unit testing a lot easier. You can use this to pass in configuration as needed.</li> <li>Do not write code that needs the configuration at import time. If you limit yourself to request-only accesses to the configuration you can reconfigure the object later on as needed.</li> <li>Make sure to load the configuration very early on, so that extensions can access the configuration when calling <code class="docutils literal notranslate">init_app</code>.</li> </ol> </section> <section id="development-production"> <h2>Development / Production<a class="headerlink" href="#development-production" title="Link to this heading">¶</a></h2> Most applications need more than one configuration. There should be at least separate configurations for the production server and the one used during development. The easiest way to handle this is to use a default configuration that is always loaded and part of the version control, and a separate configuration that overrides the values as necessary as mentioned in the example above: <div class="highlight-default notranslate"><div class="highlight"><pre>app = Flask(__name__) app.config.from_object('yourapplication.default_settings') app.config.from_envvar('YOURAPPLICATION_SETTINGS') </pre></div> </div> Then you just have to add a separate <code class="file docutils literal notranslate">config.py</code> file and export <code class="docutils literal notranslate">YOURAPPLICATION_SETTINGS=/path/to/config.py</code> and you are done. However there are alternative ways as well. For example you could use imports or subclassing. What is very popular in the Django world is to make the import explicit in the config file by adding <code class="docutils literal notranslate">from yourapplication.default_settings import *</code> to the top of the file and then overriding the changes by hand. You could also inspect an environment variable like <code class="docutils literal notranslate">YOURAPPLICATION_MODE</code> and set that to <code class="code docutils literal notranslate">production</code>, <code class="code docutils literal notranslate">development</code> etc and import different hard-coded files based on that. An interesting pattern is also to use classes and inheritance for configuration: <div class="highlight-default notranslate"><div class="highlight"><pre>class Config(object): TESTING = False class ProductionConfig(Config): DATABASE_URI = 'mysql://user@localhost/foo' class DevelopmentConfig(Config): DATABASE_URI = "sqlite:////tmp/foo.db" class TestingConfig(Config): DATABASE_URI = 'sqlite:///:memory:' TESTING = True </pre></div> </div> To enable such a config you just have to call into <a class="reference internal" href="../api/#flask.Config.from_object" title="flask.Config.from_object"><code class="xref py py-meth docutils literal notranslate">from_object()</code></a>: <div class="highlight-default notranslate"><div class="highlight"><pre>app.config.from_object('configmodule.ProductionConfig') </pre></div> </div> Note that <a class="reference internal" href="../api/#flask.Config.from_object" title="flask.Config.from_object"><code class="xref py py-meth docutils literal notranslate">from_object()</code></a> does not instantiate the class object. If you need to instantiate the class, such as to access a property, then you must do so before calling <a class="reference internal" href="../api/#flask.Config.from_object" title="flask.Config.from_object"><code class="xref py py-meth docutils literal notranslate">from_object()</code></a>: <div class="highlight-default notranslate"><div class="highlight"><pre>from configmodule import ProductionConfig app.config.from_object(ProductionConfig()) # Alternatively, import via string: from werkzeug.utils import import_string cfg = import_string('configmodule.ProductionConfig')() app.config.from_object(cfg) </pre></div> </div> Instantiating the configuration object allows you to use <code class="docutils literal notranslate">@property</code> in your configuration classes: <div class="highlight-default notranslate"><div class="highlight"><pre>class Config(object): """Base config, uses staging database server.""" TESTING = False DB_SERVER = '192.168.1.56' @property def DATABASE_URI(self): # Note: all caps return f"mysql://user@{self.DB_SERVER}/foo" class ProductionConfig(Config): """Uses production database server.""" DB_SERVER = '192.168.19.32' class DevelopmentConfig(Config): DB_SERVER = 'localhost' class TestingConfig(Config): DB_SERVER = 'localhost' DATABASE_URI = 'sqlite:///:memory:' </pre></div> </div> There are many different ways and it’s up to you how you want to manage your configuration files. However here a list of good recommendations: <ul class="simple"> <li>Keep a default configuration in version control. Either populate the config with this default configuration or import it in your own configuration files before overriding values.</li> <li>Use an environment variable to switch between the configurations. This can be done from outside the Python interpreter and makes development and deployment much easier because you can quickly and easily switch between different configs without having to touch the code at all. If you are working often on different projects you can even create your own script for sourcing that activates a virtualenv and exports the development configuration for you.</li> <li>Use a tool like <a class="reference external" href="https://www.fabfile.org/">fabric</a> to push code and configuration separately to the production server(s).</li> </ul> </section> <section id="instance-folders"> <h2>Instance Folders<a class="headerlink" href="#instance-folders" title="Link to this heading">¶</a></h2> <details class="changelog"> <summary>Changelog</summary><div class="versionadded"> Added in version 0.8. </div> </details>Flask 0.8 introduces instance folders. Flask for a long time made it possible to refer to paths relative to the application’s folder directly (via <code class="xref py py-attr docutils literal notranslate">Flask.root_path</code>). This was also how many developers loaded configurations stored next to the application. Unfortunately however this only works well if applications are not packages in which case the root path refers to the contents of the package. With Flask 0.8 a new attribute was introduced: <code class="xref py py-attr docutils literal notranslate">Flask.instance_path</code>. It refers to a new concept called the “instance folder”. The instance folder is designed to not be under version control and be deployment specific. It’s the perfect place to drop things that either change at runtime or configuration files. You can either explicitly provide the path of the instance folder when creating the Flask application or you can let Flask autodetect the instance folder. For explicit configuration use the <code class="code docutils literal notranslate">instance_path</code> parameter: <div class="highlight-default notranslate"><div class="highlight"><pre>app = Flask(__name__, instance_path='/path/to/instance/folder') </pre></div> </div> Please keep in mind that this path must be absolute when provided. If the <code class="code docutils literal notranslate">instance_path</code> parameter is not provided the following default locations are used: <ul> <li>Uninstalled module: <div class="highlight-default notranslate"><div class="highlight"><pre>/myapp.py /instance </pre></div> </div> </li> <li>Uninstalled package: <div class="highlight-default notranslate"><div class="highlight"><pre>/myapp /__init__.py /instance </pre></div> </div> </li> <li>Installed module or package: <div class="highlight-default notranslate"><div class="highlight"><pre>$PREFIX/lib/pythonX.Y/site-packages/myapp $PREFIX/var/myapp-instance </pre></div> </div> <code class="docutils literal notranslate">$PREFIX</code> is the prefix of your Python installation. This can be <code class="docutils literal notranslate">/usr</code> or the path to your virtualenv. You can print the value of <code class="docutils literal notranslate">sys.prefix</code> to see what the prefix is set to. </li> </ul> Since the config object provided loading of configuration files from relative filenames we made it possible to change the loading via filenames to be relative to the instance path if wanted. The behavior of relative paths in config files can be flipped between “relative to the application root” (the default) to “relative to instance folder” via the <code class="code docutils literal notranslate">instance_relative_config</code> switch to the application constructor: <div class="highlight-default notranslate"><div class="highlight"><pre>app = Flask(__name__, instance_relative_config=True) </pre></div> </div> Here is a full example of how to configure Flask to preload the config from a module and then override the config from a file in the instance folder if it exists: <div class="highlight-default notranslate"><div class="highlight"><pre>app = Flask(__name__, instance_relative_config=True) app.config.from_object('yourapplication.default_settings') app.config.from_pyfile('application.cfg', silent=True) </pre></div> </div> The path to the instance folder can be found via the <code class="xref py py-attr docutils literal notranslate">Flask.instance_path</code>. Flask also provides a shortcut to open a file from the instance folder with <code class="xref py py-meth docutils literal notranslate">Flask.open_instance_resource()</code>. Example usage for both: <div class="highlight-default notranslate"><div class="highlight"><pre>filename = os.path.join(app.instance_path, 'application.cfg') with open(filename) as f: config = f.read() # or via open_instance_resource: with app.open_instance_resource('application.cfg') as f: config = f.read() </pre></div> </div> </section> </section> <div class="clearer"></div> </div> </div> </div> <div class="sphinxsidebar" role="navigation" aria-label="Main"> <div class="sphinxsidebarwrapper"> <a href="../"> <img class="logo" src="../_static/flask-vertical.png" alt="Logo of Flask"/> </a> <h3>Contents</h3> <ul> <li><a class="reference internal" href="#">Configuration Handling</a><ul> <li><a class="reference internal" href="#configuration-basics">Configuration Basics</a></li> <li><a class="reference internal" href="#debug-mode">Debug Mode</a></li> <li><a class="reference internal" href="#builtin-configuration-values">Builtin Configuration Values</a><ul> <li><a class="reference internal" href="#DEBUG"><code class="docutils literal notranslate">DEBUG</code></a></li> <li><a class="reference internal" href="#TESTING"><code class="docutils literal notranslate">TESTING</code></a></li> <li><a class="reference internal" href="#PROPAGATE_EXCEPTIONS"><code class="docutils literal notranslate">PROPAGATE_EXCEPTIONS</code></a></li> <li><a class="reference internal" href="#TRAP_HTTP_EXCEPTIONS"><code class="docutils literal notranslate">TRAP_HTTP_EXCEPTIONS</code></a></li> <li><a class="reference internal" href="#TRAP_BAD_REQUEST_ERRORS"><code class="docutils literal notranslate">TRAP_BAD_REQUEST_ERRORS</code></a></li> <li><a class="reference internal" href="#SECRET_KEY"><code class="docutils literal notranslate">SECRET_KEY</code></a></li> <li><a class="reference internal" href="#SECRET_KEY_FALLBACKS"><code class="docutils literal notranslate">SECRET_KEY_FALLBACKS</code></a></li> <li><a class="reference internal" href="#SESSION_COOKIE_NAME"><code class="docutils literal notranslate">SESSION_COOKIE_NAME</code></a></li> <li><a class="reference internal" href="#SESSION_COOKIE_DOMAIN"><code class="docutils literal notranslate">SESSION_COOKIE_DOMAIN</code></a></li> <li><a class="reference internal" href="#SESSION_COOKIE_PATH"><code class="docutils literal notranslate">SESSION_COOKIE_PATH</code></a></li> <li><a class="reference internal" href="#SESSION_COOKIE_HTTPONLY"><code class="docutils literal notranslate">SESSION_COOKIE_HTTPONLY</code></a></li> <li><a class="reference internal" href="#SESSION_COOKIE_SECURE"><code class="docutils literal notranslate">SESSION_COOKIE_SECURE</code></a></li> <li><a class="reference internal" href="#SESSION_COOKIE_PARTITIONED"><code class="docutils literal notranslate">SESSION_COOKIE_PARTITIONED</code></a></li> <li><a class="reference internal" href="#SESSION_COOKIE_SAMESITE"><code class="docutils literal notranslate">SESSION_COOKIE_SAMESITE</code></a></li> <li><a class="reference internal" href="#PERMANENT_SESSION_LIFETIME"><code class="docutils literal notranslate">PERMANENT_SESSION_LIFETIME</code></a></li> <li><a class="reference internal" href="#SESSION_REFRESH_EACH_REQUEST"><code class="docutils literal notranslate">SESSION_REFRESH_EACH_REQUEST</code></a></li> <li><a class="reference internal" href="#USE_X_SENDFILE"><code class="docutils literal notranslate">USE_X_SENDFILE</code></a></li> <li><a class="reference internal" href="#SEND_FILE_MAX_AGE_DEFAULT"><code class="docutils literal notranslate">SEND_FILE_MAX_AGE_DEFAULT</code></a></li> <li><a class="reference internal" href="#TRUSTED_HOSTS"><code class="docutils literal notranslate">TRUSTED_HOSTS</code></a></li> <li><a class="reference internal" href="#SERVER_NAME"><code class="docutils literal notranslate">SERVER_NAME</code></a></li> <li><a class="reference internal" href="#APPLICATION_ROOT"><code class="docutils literal notranslate">APPLICATION_ROOT</code></a></li> <li><a class="reference internal" href="#PREFERRED_URL_SCHEME"><code class="docutils literal notranslate">PREFERRED_URL_SCHEME</code></a></li> <li><a class="reference internal" href="#MAX_CONTENT_LENGTH"><code class="docutils literal notranslate">MAX_CONTENT_LENGTH</code></a></li> <li><a class="reference internal" href="#MAX_FORM_MEMORY_SIZE"><code class="docutils literal notranslate">MAX_FORM_MEMORY_SIZE</code></a></li> <li><a class="reference internal" href="#MAX_FORM_PARTS"><code class="docutils literal notranslate">MAX_FORM_PARTS</code></a></li> <li><a class="reference internal" href="#TEMPLATES_AUTO_RELOAD"><code class="docutils literal notranslate">TEMPLATES_AUTO_RELOAD</code></a></li> <li><a class="reference internal" href="#EXPLAIN_TEMPLATE_LOADING"><code class="docutils literal notranslate">EXPLAIN_TEMPLATE_LOADING</code></a></li> <li><a class="reference internal" href="#MAX_COOKIE_SIZE"><code class="docutils literal notranslate">MAX_COOKIE_SIZE</code></a></li> <li><a class="reference internal" href="#PROVIDE_AUTOMATIC_OPTIONS"><code class="docutils literal notranslate">PROVIDE_AUTOMATIC_OPTIONS</code></a></li> </ul> </li> <li><a class="reference internal" href="#configuring-from-python-files">Configuring from Python Files</a></li> <li><a class="reference internal" href="#configuring-from-data-files">Configuring from Data Files</a></li> <li><a class="reference internal" href="#configuring-from-environment-variables">Configuring from Environment Variables</a></li> <li><a class="reference internal" href="#configuration-best-practices">Configuration Best Practices</a></li> <li><a class="reference internal" href="#development-production">Development / Production</a></li> <li><a class="reference internal" href="#instance-folders">Instance Folders</a></li> </ul> </li> </ul> <h3>Navigation</h3> <ul> <li><a href="../">Overview</a> <ul> <li>Previous: <a href="../logging/" title="previous chapter">Logging</a> <li>Next: <a href="../signals/" title="next chapter">Signals</a> </ul> </li> </ul> <search id="searchbox" style="display: none" role="search"> <h3 id="searchlabel">Quick search</h3> <div class="searchformwrapper"> <form class="search" action="../search/" method="get"> <input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"/> <input type="submit" value="Go" /> </form> </div> </search> <script>document.getElementById('searchbox').style.display = "block"</script><div id="ethical-ad-placement"></div> </div> </div> <div class="clearer"></div> </div> <div class="footer" role="contentinfo"> © Copyright 2010 Pallets. Created using <a href="https://www.sphinx-doc.org/">Sphinx</a> 8.1.3. </div> </body> </html>