---
title: Configuration
description: Every Cache Tags setting, under CacheTags in appsettings.json.
seo:
  image: /og/configuration.png
---

Every setting lives under `CacheTags`. You can add targets in the backoffice instead, and the other settings have defaults that suit most sites.

```json appsettings.json
{
  "CacheTags": {
    "Targets": {
      "nextjs": { "Url": "https://www.example.com/api/cache-tags", "Secret": "<at least 32 characters>" }
    }
  }
}
```

```sh Environment variables
CacheTags__Targets__nextjs__Url=https://www.example.com/api/cache-tags
CacheTags__Targets__nextjs__Secret=<at least 32 characters>
```

## Settings

| Setting | Default | What it does |
| --- | --- | --- |
| `Enabled` | `true` | Whether the package tags responses and plans and sends purges. |
| `Targets` | none | Where the package sends purges, by name. See [Purge targets](/targets). With none, the package still plans and records changes. |
| `Secrets` | none | Secrets that targets added in the backoffice read by name, such as `CacheTags:Secrets:VercelSecret`. A target can read nothing else from configuration. See [Purge targets](/targets#in-the-backoffice). |
| `AllowPrivateNetworkTargets` | `false` | Lets targets added in the backoffice connect to private and reserved addresses, such as `localhost`. See [Purge targets](/targets#in-the-backoffice). |
| `HeaderName` | `X-Umbraco-Cache-Keys` | The response header that carries the keys. `Cache-Tag` for Cloudflare in front of Umbraco. |
| `KeyPrefix` | none | A prefix for every key, such as `shop-`, for a site that shares a CDN zone with another. Lowercase letters, digits and hyphens, ending in a hyphen. |
| `MaxHeaderKeys` | `128` | The most keys a header lists, most needed first, at least 2. 128 is Next.js's limit per cache entry. Raise it when Cloudflare caches the Delivery API directly. See [Cloudflare in front of the Delivery API](/targets#cloudflare-in-front-of-the-delivery-api). |

The timings are fixed: a change waits at most 60 seconds for every server to apply it and 5 minutes for every server's index, a server counts as gone 2 minutes after its last heartbeat, and a failed purge is tried 10 times. [How a purge is timed](/timing) explains each.

## Target settings

| Setting | Default | What it does |
| --- | --- | --- |
| `Type` | `webhook` | `webhook`, `cloudflare`, or the type of a target you registered. |
| `Enabled` | `true` | Whether the package sends purges to this target. |
| `Url` | none | For a webhook, where the package posts purges. https, except on localhost. |
| `Secret` | none | For a webhook, the signing secret, at least 32 characters. |
| `Headers` | none | For a webhook, request headers to send with every purge. See [Purge targets](/targets#request-headers). |
| `Settings` | none | Settings for other types, such as Cloudflare's `ZoneId` and `ApiToken`. |

:::caution
Keep secrets and tokens out of `appsettings.json` in source control. Set them as environment variables, such as `CacheTags__Targets__nextjs__Secret`, or in your host's secret store.
:::