One-time link API

One call makes a link. It works like Thinfinity Workspace 8.5's one-time link API (One-Time URL): the same path, option names, types, defaults and answer.

Most callers send 3 values: apikey, apiuser, model. Everything else lives in the model, set once on the Anping server (models).

curl -X POST https://anping.example.com/ws/oturl/get \
  --data-urlencode "apikey=$ANPING_API_KEY" \
  --data-urlencode "apiuser=alice@example.com" \
  --data-urlencode "model=sales-desktop"

Answer: /oturl.html?key=...&pass=.... Put the Anping address in front and send the user there.

One link, start to end

Solid arrows are requests, dashed arrows are answers. Steps 4, 9 and 10 are calls the link page makes by itself.

Request

Rule	Detail
Method	Send a form (`POST`) from your server. More Form bodies: `application/x-www-form-urlencoded` or `multipart/form-data`. `GET /ws/oturl/get?apikey=...` is the Thinfinity form, for programs moving over (when to switch): it puts the key, and any password, into URLs that proxies and telemetry record.
Same name twice	If a name is both in the form and in the address, the form wins, except `apikey`. More A key in the query string is checked first, before the body is read.
Body	Up to 64 KB; bigger gets error 413. JSON is not read.
Names	Upper or lower case doesn't matter. Unknown names are ignored.
Yes/no values	Yes or no values: `true`/`false`, `1`/`0`, `yes`/`no`, `on`/`off`.

Model, overrideDefaults, no model

A model is one computer set up on the Anping server (Targets:N:*), like an Access Profile; its Id can be your profile's key. The three modes work as in Thinfinity:

You send	Settings come from	Notes
`model=<id>`	the model only	Connection options in the request are ignored, except a user name or password the model lacks. More Even invalid ones are ignored. `apiuser`, `plen`, `expires` and `format` still count.
`model=<id>` `overrideDefaults=true`	the request, then the model	Only within the model's limits (`Allow` flags) and its program (security). More A `computer` from the request never gets the model's credentials, security or certificate settings, only its own (link computers).
no `model`	the request	`computer` is required and must be allowed.

Options nobody gives use the defaults below. Whoever gives the user name also gives the password; the link page asks for whatever is missing.

Parameters

Each table shows the option, its default, what it does, and how it compares with Thinfinity: ✓ works as documented, Partly works with a difference, Not possible with the desktop engine (guacd 1.6.0 from Apache Guacamole), Anping only an extra. Allow limits are the model's, or Oturl:ComputerPolicy for a computer named in the request.

The request

Parameter	Default	What it does	Thinfinity
`apikey`	required	One of `Oturl:ApiKeys`. Missing or wrong: error 401. More Compared in constant time. After `Oturl:MaxFailuresPerMinute` wrong keys from one address in a minute, further wrong keys get 429; a valid key is never blocked. Each key makes at most `Oturl:MaxLinksPerKeyPerMinute` links a minute.	✓
`apiuser`	required	Who asked, such as an e-mail; for the connection log. More Up to 256 characters. Kept with the link and written with each session; the Anping server's own log names only the link id.	✓
`model`	none	The name of a computer setup (`Targets:N:Id`), exact case. Unknown: error 400.	✓
`overrideDefaults`	`false`	`true`: options in the request win over the model's.	✓
`plen`	8	Length of the pass, 8 to 64. More Other values are clamped. Letters and digits without look-alikes (no 0, O, 1, l, I).	✓
`expires`	10	Minutes an unused link works, 1 to 1440. More Other values are clamped. Default and limit: `Oturl:DefaultExpiresMinutes`, `Oturl:MaxExpiresMinutes`.	✓
`format`	text	`json` answers `{"url": "...", "expiresAt": "..."}` instead of plain text.	Anping only

Computer and sign-in

Parameter	Default	What it does	Thinfinity
`computer`	the model's	Which computer: `host`, `host:port` or `[IPv6]:port`. It must be allowed by `Oturl:AllowedComputers`, or you get error 403. More Port 3389, or 2179 with `desttype=VMID`. Its security and certificate check come from `Oturl:ComputerSettings` (link computers).	✓
`username` `password`	the model's	Missing ones: the link page asks; they are never stored. More A rejected one brings the form back with the user name kept; failed sign-ins are limited (sign-in limits). `DOMAIN\user` becomes domain and user; `user@domain` is sent as is.	✓

Program

Parameter	Default	What it does	Thinfinity
`startprg`	0	0 the desktop, 1 one program, 2 a single program window (RemoteApp). More A RemoteApp uses classic RDP graphics (the graphics pipeline is off). A model that starts a program keeps it, also with `overrideDefaults=true`, unless it sets `AllowProgramOverride`.	✓
`command`	none	For 1: the program's path. For 2: the RemoteApp's name or `\|\|alias`. More Required when `startprg` is 1 or 2. A path with spaces is quoted, then `cmdargs` follow.	✓
`cmdargs`	none	Arguments for the program.	✓
`directory`	none	Start folder of a RemoteApp.	Partly Why With `startprg=1` it is ignored: guacd 1.6.0 has no start folder for a program.

Display

Parameter	Default	What it does	Thinfinity
`bpp`	32	Colour depth in bits: 8, 15, 16, 24 or 32. More 15 is sent as 16. Below 32 turns the RDP graphics pipeline off. Not given: 32-bit colour with the graphics pipeline (Thinfinity's default is 16).	✓
`resolution`	`fittobrowser`	`fittobrowser` follows the window, `fittoscreen` the screen, `fixed` is `width` x `height`. More `fittoscreen` and `fixed` show centred and at most at their own size, smaller when the window is smaller; More > Fit to window in the toolbar scales them up to fill it.	✓
`width` `height`	the user's screen	For `fixed`: 1 to 8192 pixels. More At 96 dpi (Windows at 100%). A missing one is the user's screen size.	✓
`imagequality`	1	0 sharpest (lossless); 1 adjusts to the connection. More 1: guacd lowers JPEG/WebP quality as the connection slows and keeps still content lossless.	Partly Why 2 and 3 behave like 1: guacd 1.6.0 has no separate levels.
`desktopbackground` `visualstyles` `menuwindowanimation` `fontsmoothing` `showwindowcontent` `desktopcomposition`	`false`	Wallpaper, themes, menu animations, font smoothing, window contents while dragging, desktop composition.	✓

Keyboard

Parameter	Default	What it does	Thinfinity
`unicodekeyboard`	`true`	Keys go as key presses; other characters as text (Unicode). More Uses the model's keyboard layout (US by default). Keys the layout has go as key presses, so shortcuts work.	Partly Why Text is right while the remote session uses the same layout. A session set to another layout types by that layout.
`keyboardlayout`	`00000409`	With `unicodekeyboard=false`: a Windows keyboard layout number (24 known). More Others get the model's layout. Mapped: English US and UK, German, Swiss German and French, French, Belgian, Canadian French, Italian, Spanish, Latin American, Portuguese, Brazilian, Swedish, Danish, Norwegian, Polish, Czech, Hungarian, Romanian, Turkish, Japanese.	✓

Session and security

Parameter	Default	What it does	Thinfinity
`console`	`false`	Connect to the computer's main screen (console session).	✓
`wscompression`	`true`	Compress the live connection (WebSocket) when the browser can. More permessage-deflate, without context takeover in either direction.	✓
`disablenla`	`false`	Skip the early sign-in check (NLA), for servers that don't support it (a non-Microsoft CredSSP). The certificate is still checked.	✓
`desttype` `destinfo`	none	`VMID`: a Hyper-V virtual machine. `RDS`: a server farm (RD Connection Broker). More `VMID`: `destinfo` is the VM id, port 2179. `RDS`: `destinfo` goes to the broker as load balance info. Any other value: a regular connection.	✓ Not yet tested

Shared folder and clipboard

Parameter	Default	What it does	Thinfinity
`diskenabled`	`true`	The shared folder, within `AllowUpload` and `AllowDownload`.	✓
`diskname`	`Anping`	The shared folder's name (Thinfinity's default is `ThinDisk`). More Anping server default: `Oturl:DefaultDiskName`. The page calls it <name> drive (Shared drive if the Anping server does not say).	Partly Why Not yet checked whether Windows shows it under this name or as `GUACFS`.
`diskautodownload`	`true`	Files saved into the shared folder come to the browser by themselves. More Once closed and untouched for 2 seconds (`Files:AutoDownloadSettleMs`). `false`: files stay on the drive for the Files panel. Not sent: files there at the start, uploads, empty and temporary files, files only renamed or opened, and files a program keeps open. Over `Files:MaxUploadBytes`, or with no room in the drive's limit for the Anping server's copy, a file stays on the drive and Transfers says so. Outside the `Download` folder this needs an Anping server on Linux (deploying).	✓ Not yet checked with Windows
`clipboard`	`true`	Copy and paste of text, within `AllowCopy` and `AllowPaste`. More `false`: off both ways, enforced by the Anping server too. Pasting files where the remote's focus is also needs the shared folder's upload (`AllowUpload`); without paste they can still be uploaded.	✓

Sound and printing

Parameter	Default	What it does	Thinfinity
`soundenabled`	`false`	The remote computer's sound, within `AllowAudio`. More It starts after the first click or key press in the page.	✓
`soundquality`	1	0 to 3 (below).	✓
`printerenabled`	`false`	A PDF printer, within `AllowPrinting`, only where printing is turned on (`Guacd:Printing`, off by default). More Each job downloads as a PDF. Works with the drive off. With printing off the link still opens, without a printer, and the dry run says why. Turning it on needs a desktop engine with Ghostscript, which is AGPL-3 or a commercial license from Artifex.	✓
`printersetasdefault`	`true`	The printer is the remote computer's default printer.	Partly Why `false` is not possible: guacd 1.6.0 always makes its printer the default.
`printername`	`Anping PDF Printer`	Its name on the remote computer. More Anping server default: `Oturl:DefaultPrinterName`.	✓
`printerdriver`	none	Ignored.	Not possible Why guacd 1.6.0 always uses its own PostScript driver name.

Sound quality

`soundquality`	Sound	Data (kbit/s)
0	as Windows sends it (usually 44.1 kHz stereo, 16-bit)	1411
1 (default)	22.05 kHz stereo, 16-bit	706
2	22.05 kHz mono, 16-bit	353
3	11.025 kHz mono, 8-bit	88

More about sound

Rates are before base64 and compression. Sound that arrives while the browser still blocks it is dropped, not queued. Until the first click or key press the toolbar shows Enable sound, then Mute and Unmute.

Answer

`format`	Answer (success, 200)
none	Plain text (`text/plain; charset=utf-8`): the end of the link, to put after the Anping address: `/oturl.html?key=<43 characters>&pass=<plen characters>`
`json`	JSON (`application/json`): `{"url": "/oturl.html?key=...&pass=...", "expiresAt": "2026-11-01T05:41:42.0640041+00:00"}`

Answers are never cached (Cache-Control: no-store).

Errors

Errors come as plain text (text/plain): a short reason that names the option but never repeats its value.

Error number	When	Message, for example
400	An option is missing or wrong. More Values longer than their limit or with control characters are refused too.	`Unknown model.` More `apiuser is required.` `computer or model is required.` `computer must be host or host:port.` `command is required when startprg is 1 or 2.` `destinfo is required with desttype.` `bpp must be one of 8, 15, 16, 24, 32.` `console must be true or false.`
401	Missing or wrong key, or the Anping server has none.	`Invalid API key.`
403	`computer` not in `Oturl:AllowedComputers`.	`computer is not allowed.`
413	The request is bigger than 64 KB.	`Request body too large.`
429	Too many wrong keys from your address, or too many links for one key. More Wrong keys: this minute, from your address; a valid key is never blocked. Links: over `Oturl:MaxLinksPerKeyPerMinute` for one key in a minute.	`Too many failed attempts. Try again later.` `Too many links for this API key. Try again later.`
503	Anping already holds `Oturl:MaxLinks` links. More Unused, open or in their reconnect window.	`Too many open links. Try again later.`

Link lifetime and reconnect

Defaults shown.

When	What happens
Unused	Works until `expires` minutes after it was made.
First open	Used, and tied to that browser (with a cookie). More A cookie for that link only (HttpOnly, `Path=/ws/oturl`). The address bar keeps only the link id (`?link=`).
Reload, Reconnect	Same browser only, within `Oturl:ReconnectMinutes` (10) of the last disconnect and `Oturl:MaxLifetimeHours` (12) of the first open. More A live connection ends at that hour too (`max_duration`).
Network drop	The page reconnects by itself for 60 seconds. More It shows Reconnecting… and reuses the credentials the user typed, which only the page's memory holds. It never retries a rejected sign-in, a used or expired link, or an Anping server restart.
Another tab	The newest connection wins; the older page offers Use here. More One connection at a time: a reload, a reconnect or another tab of the same browser takes over at once. The older page shows This desktop was opened in another tab or window.
No input, time limit	The session and the link end after `Sessions:IdleTimeoutMinutes` (60) idle or `Sessions:MaxDurationMinutes` (720). More Input is what the user sends through the page: keys, mouse, touch, clipboard and file transfers; a video playing on the remote does not count. A countdown shows a minute before the idle end (any input takes it back) and five minutes before the time limit. No reload or Reconnect after either.
End, Disconnect	End closes the link for good; Disconnect keeps the reconnect window. More End asks first, so the next person at a shared computer can't reload into the session. Either way Windows keeps the session signed in (disconnected) until its own time limits end it.
Anping server restart	Every session ends; users need a new link. More Links live in the Anping server's memory. A restart or deploy shows The remote desktop service restarted.
Anyone else	One message for used, expired, unknown or wrong links. More This link has already been used or has expired.
Missing user name or password	The page asks; used for that connection only, never stored. More The user name and password the link lacks go to the Anping server for that one connection. Failed sign-ins are limited (below).

So a link holder can't guess Windows passwords through Anping.

Limit	Default	Then
Per link	5 in a row (`Oturl:MaxSignInFailures`)	The link locks. Waits of 2, 4, 8, 16 seconds in between (`Oturl:SignInDelaySeconds`). More An accepted sign-in starts the count again. The page waits by itself before the next typed sign-in.
Link with its own user name and password	1	Locked at the first rejection, so the Windows account never locks out.
Per network	20 in 10 min (`Oturl:MaxSignInFailuresPerIp`, `Oturl:SignInFailureWindowMinutes`)	Sign-ins typed from that network wait until the 10 minutes are over. More Counted across links, per address (IPv6: per /64).

Messages and what is not covered

The Anping server learns whether the remote accepted a sign-in before the browser does.
Failed sign-ins never extend a link's reconnect window. Tried passwords and user names are never logged.
The user sees Wrong user name or password. 4 tries left., and at the end This link was locked after failed sign-ins.
Not covered: without NLA (disablenla=true, or Security tls or rdp) Windows shows its own sign-in screen in the session; there only the Windows account lockout policy limits guessing.

Security

Topic	In short
Link secrets	Long random secrets (256-bit), stored only in scrambled form (a hash), and removed from the address bar at once. More Only SHA-256 hashes of key and pass are kept. The page removes both before anything else and sends no Referer (`Referrer-Policy: no-referrer`).
API keys	Checked safely (in constant time); several at once so you can swap them; at least 32 characters. More Outside Development the Anping server won't start with the public dev key or a key under 32 characters: make keys with `openssl rand -hex 32`.
Which computers	Only `Oturl:AllowedComputers`, so a stolen key can't reach other machines. More A host, a host and port, or an IP range. Names are not resolved; an empty list allows only models.
Computer certificates	Sign-in checked first (NLA); only computers with a certificate trusted for their name, or pinned (SHA-256). More A refused certificate ends the session with `target_cert_invalid`, and the Anping server log says what the computer presents (certificates).
Limits	A request can turn features off, never on beyond the model's limits (`Allow` flags). More `AllowCopy`, `AllowPaste`, `AllowUpload`, `AllowDownload`, `AllowAudio` and `AllowPrinting` bind requests and profiles alike. A model that starts a program keeps it unless `AllowProgramOverride`. Links to a computer from the request: `Oturl:ComputerPolicy`.
Attempt limits	Wrong keys and failed link opens are limited per network address; users can never block your program. More After 10 wrong API keys in a minute from one address (IPv6: per /64), further wrong keys get 429 for the rest of that minute; a valid key is never blocked. 30 failed link opens in a minute from one address block opening links for that minute. Reconnects are never counted. Sign-ins: own limits.
Browser protections	Standard browser protections in every answer (CSP, nosniff, Permissions Policy, HSTS). Only the link page can be shown in a frame, and only on `Oturl:FrameAncestors`. More On every answer: Content Security Policy, `X-Content-Type-Options: nosniff`, a Permissions Policy, and HSTS over https; no `Server` header; request bodies up to 64 KB. Every answer but `/oturl.html`: `frame-ancestors 'none'` and `X-Frame-Options: DENY`.
Logs	Anping's logs never hold web addresses, keys, passes or passwords. More A test checks this. Your proxies and telemetry may record URLs: drop query strings for `/ws/oturl/get`, `/ws/log` and `/oturl.html`, or use POST.
Server side only	The browser never sends a computer name, port or connection setting. More It adds only its display size and time zone (the Anping server checks both), and the user name and password a link lacks, typed by its user.
Time and size, start checks	Session time and shared-folder size limits (lifetime, settings); unsafe settings stop the Anping server (host).

Connection log

One line per session: who (apiuser), the link's code, the computer, the user's network address, start, duration, how it ended and how many reconnects. No passwords or keys. You read it with an API key:

Where	How
Page	`/log.html`: paste the key, pick the days, filter, then Show or Download CSV. More Filter by `apiuser` or link id. Totals show above the list, and how each session ended as a label with a mark: ✓ normal, ⚠ a limit or a dropped connection, ✕ a failure, ◐ still running. Your product's name or logo, if set, heads the page. It works on a phone.
API	`GET\|POST /ws/log`, as `format=json` or `csv`. More Parameters: `apikey` (a POST form keeps it out of URLs), `from` and `to` (`yyyy-MM-dd`, UTC days; by default the last 7 days), `apiuser`, `linkid`, `model`, `limit`, `format` (`csv` for Excel). Wrong keys here are counted apart, so they never block link creation.
Storage	In the folder `ConnectionLog:Path`, kept `ConnectionLog:RetentionDays` (90) days. More JSON Lines files on a volume only the Anping server mounts; older days are deleted. No path: kept in memory, and a restart loses it.
Helpdesk	The Reference in the message box when a session ends, and the computer name Windows sees (`Anping-`…), both find the line. More When a session ends the page shows Reference: <link id>, <UTC time>. Windows sees the client as `Anping-` and the first 8 characters of the link id (`%CLIENTNAME%`, Task Manager), unless the model sets `ClientName`.
How it ended	`closed`, `page_closed`, `taken_over`, `ended`, `gateway_stop` or an error code. More `closed`: Disconnect, or the remote ended. `page_closed`: the page was closed or reloaded. `taken_over`: the same browser opened the link again. `ended`: End session. `gateway_stop`: an Anping server stop or crash still ends each record. Error codes such as `auth_failed`, `target_cert_invalid`, `idle_timeout`, `max_duration`, `drive_full`. A session the license refused has a line too, ended at once: `license_limit` (all licensed sessions in use) or `license_expired`.

License

GET|POST /ws/license with the API key answers the license and the sessions in use, as JSON; /log.html shows the same on top (install and renew).

apikey as for /ws/log (a POST form keeps it out of URLs; wrong keys count with /ws/log's).
{v, state, customer, licenseId, expires, lastGraceDay, daysLeft, maxSessions, gatewayMaxSessions, inUse, trialSessions, graceDays, problem, source, keyId}. state: licensed, grace, expired (new sessions refused) or unlicensed (a trial of trialSessions, 2). Dates are UTC days; daysLeft counts today. problem says why an installed license is not valid.
Never the license's signed line or a key, only the key's id.

Dry run

/ws/oturl/check takes the same request as /ws/oturl/get but never makes a link. Its answer (JSON) lists every problem and what the link would get (use it with the replay tool).

Same parameters, API key and wrong-key limit as /ws/oturl/get; says whether it would accept the request.
Every problem, not only the first; which parameters have no effect and why; where Anping differs from Thinfinity; the settings and capabilities the link would get.
Also timeZone (the model's TimeZone, or browser), clientName (the model's ClientName, or Anping-<link id>) and touch (Mouse or Native). Warnings name a model TimeZone or ClientName that sessions would drop, and Touch: Native, not yet tried with Windows.
It never returns an API key, password or user name. Use it before you move from Thinfinity.

Anping server settings

Set these in appsettings.json or as environment variables, where : is written __ (Oturl__ApiKeys__0). Keep keys and passwords in a secret store. Each table shows the setting, its default and what it means.

One-time links

Setting	Default	Meaning
`Oturl:ApiKeys`	none	The API keys Anping accepts. None set: every request gets error 401. More Each at least 32 random characters outside Development.
`Oturl:AllowedComputers`	none	Which computers a request may name in `computer`: `host`, `host:port` or a range of addresses (CIDR). More `host` allows any port; a range such as `10.0.0.0/24` matches IP addresses.
`Oturl:ComputerPolicy:` `AllowCopy`, `AllowPaste`, `AllowUpload`, `AllowDownload`, `AllowAudio`, `AllowPrinting`	`true`	Limits for computers named in the request.
`Oturl:FrameAncestors`	none	Sites (origins) that may show the link page (`/oturl.html`) in a frame. More `https://app.example.com` (http or https, host and port, no path or trailing slash) or `'self'`. Other entries are ignored.
`Oturl:DefaultExpiresMinutes` `Oturl:MaxExpiresMinutes`	10, 1440	`expires` when not given, and its largest value.
`Oturl:ReconnectMinutes`	10	How long a link can reconnect after each disconnect.
`Oturl:MaxLifetimeHours`	12	This long after the first open, no new connection, and a live one ends.
`Oturl:MaxLinks`	10000	Links Anping holds at once; beyond that, error 503.
`Oturl:MaxLinksPerKeyPerMinute`	300	Links per key per minute; beyond that, error 429.
`Oturl:MaxFailuresPerMinute`	10	Wrong keys per network address per minute; beyond that, error 429.
`Oturl:MaxLinkFailuresPerMinute`	30	Failed link opens per network address per minute; beyond that, error 429.
`Oturl:MaxSignInFailures` `Oturl:SignInDelaySeconds`	5, 2	Failures in a row that lock a link; first wait, doubled per failure (sign-in limits).
`Oturl:MaxSignInFailuresPerIp` `Oturl:SignInFailureWindowMinutes`	20, 10	Failed typed sign-ins per network address, across links, in that many minutes.
`Oturl:DefaultDiskName` `Oturl:DefaultPrinterName`	`Anping`, `Anping PDF Printer`	Names when neither model nor request gives `diskname` or `printername`.

Computers named in links (`Oturl:ComputerSettings:N`)

For a computer a link names in computer. Without an entry, the early sign-in check (NLA) is on and the certificate must be trusted for its name. A link can change only disablenla.

Setting	Default	Meaning
`Computer`	required	`host` or `host:port` (wins over `host`); no address ranges.
`Security`	`nla`	As for a model; `tls` for a computer without the early sign-in check (NLA).
`CertFingerprints`	none	Fingerprints (SHA-256) its certificate may have; list several while you replace a certificate (certificates). More Written `sha256:..`.
`IgnoreCert`	`false`	No certificate check. For development and lab servers only.

Computers and models (`Targets:N`)

Setting	Default	Meaning
`Id`, `Name`	required, the Id	The `model` value; the toolbar's name.
`Host`, `Port`	required, 3389	The Windows computer (it listens for remote desktop on port 3389).
`Username`, `Password`, `Domain`	none	Missing ones come from the request or the user.
`Security`	`nla`	`nla`, `nla-ext`, `tls`, `vmconnect`, `any` or `rdp`. More `tls` is for a computer without NLA. `any` and `rdp` allow standard RDP security, which has no certificate check: the startup log warns.
`CertFingerprints`	none	Fingerprints (SHA-256) its certificate may have; without them it must be trusted for the name in `Host` (certificates).
`IgnoreCert`	`false`	No certificate check. For development and lab servers only. More Elsewhere the Anping server won't start with it, unless `Dev:AllowIgnoreCert` is set.
`KeyboardLayout`	`en-us-qwerty`	The session's keyboard layout, by the desktop engine's names (`de-de-qwertz`).
`AllowCopy`, `AllowPaste`, `AllowUpload`, `AllowDownload`, `AllowAudio`, `AllowPrinting`	`true`	Limits no request can raise. More Copy from the remote, paste to it, file transfer each way, sound, printer. `false`: no link can turn that on.
`ClipboardLineEndings`	`windows`	How copied text ends its lines: `windows`, `unix` or `preserve`.
`TimeZone`	the browser's	One time zone (IANA name, such as `Asia/Taipei`) for every session. More Empty: each browser's own. Windows applies either only with a policy turned on (Windows computers).
`ClientName`	`Anping-` + 8 characters of the link id	The computer name Windows sees for the user. More `%CLIENTNAME%`: 1 to 15 letters, digits, `-` or `_`. Never put a user name or secret here.
`Touch`	`Mouse`	`Mouse`, or `Native`: Windows' own multi-touch (not yet tried with Windows). More `Mouse`: touches work as a mouse on any computer. `Native`: multi-touch once Windows opens that channel, a mouse until then.
`WindowsIme`	unset	The toolbar's Windows IME menu: `true` for everyone, `false` for no one. More Unset: only when the browser's languages include Chinese, Japanese or Korean. Never without a mouse or trackpad.
`AllowProgramOverride`	`false`	`true`: `overrideDefaults=true` may replace the model's program, as Thinfinity does.
`Oturl:<parameter>`	none	Any link option, such as `Targets__0__Oturl__startprg=2`. More Not `computer` or credentials, which are the fields above. A bad value stops the Anping server outside Development and is a warning in it.

Settings no request can set

TimeZone, ClientName, Touch and WindowsIme are not OTURL parameters: a request can't set them, in any mode. An unknown TimeZone or an invalid ClientName is a warning in the startup log and is dropped.

Address, load balancer and limits

Setting	Default	Meaning
`ASPNETCORE_ENVIRONMENT`	`Production`	`Production` refuses unsafe settings; `Development` only warns. More The image's default. Outside `Development` the Anping server refuses to start when an API key is the public dev key or shorter than 32 characters, dev pages or the dev network simulation are on, the proxy setting below is missing, `AllowedHosts` is `*`, or a setting is invalid; the log says which. `Development` is for your own computer only.
`AllowedHosts`	`localhost;127.0.0.1;[::1]`	The names Anping answers to: add your public name; never `*`.
`ForwardedHeaders:KnownNetworks`	none	The networks (CIDR) of your load balancer that handles https (TLS proxy). More Only from there do `X-Forwarded-For` and `X-Forwarded-Proto` count: the client address for rate limits, https for HSTS and cookies.
`ForwardedHeaders:NoProxy`	`false`	`true`: browsers connect directly, with no load balancer. Outside development, set this or the one above.
`Tunnel:MaxSessions`	100	Sessions plus connections being set up, per Anping server; beyond that the page says it is busy. More The license's number of sessions applies too; the smaller one counts.
`License:Path`	`/etc/anping/license/anping.license`	The license file (license). Read again at every new session, so a renewal needs no restart.
`License:Content`	none	The license file's content instead of a file (environment variable `License__Content`); wins over the path. More Neither setting can make Anping trust another signing key: those are built into Anping.
`Sessions:IdleTimeoutMinutes`	60	No input this long ends a session (warning a minute before). 0: off.
`Sessions:MaxDurationMinutes`	720 (12 hours)	Longest session (warning five minutes before). 0: off. More A link's session also ends at `Oturl:MaxLifetimeHours`.

Desktop engine, files and log

Setting	Default	Meaning
`Guacd:Host`, `Guacd:Port`	`localhost`, 4822	Where Anping finds its desktop engine (guacd), right next to it; never public (deploying).
`Guacd:Printing`	`false`	Printing is off by default: no link gets a printer. Set `true` only if the desktop engine has Ghostscript, which is AGPL-3 or a commercial license from Artifex. More The desktop engine turns each print job into a PDF with Ghostscript. The official `guacamole/guacd:1.6.0` image has it; Anping's own engine image leaves it out.
`Files:DriveRoot`	none	Folder for the shared folders, at the same path for Anping and the desktop engine. More Empty: no file transfer at all, and `diskenabled` silently does nothing.
`Files:MaxUploadBytes`	104857600 (100 MB)	Largest upload, and largest automatic download.
`Files:DriveQuotaBytes`	1073741824 (1 GB)	The most a session's shared folder may hold. 0: no limit. More An upload that does not fit is refused (The remote drive is full.); a remote that writes past it ends the session (`drive_full`), which deletes the drive. The Anping server's own copy of a file it downloads or keeps counts too. The volume needs this times the sessions per replica.
`Files:AutoDownloadSettleMs`	2000	How long a saved file must stay untouched before it downloads, in milliseconds. More How long a file must stay untouched after it was closed or renamed into place. Programs save through temporary files and renames.
`Files:QuotaCheckSeconds`	5	How often a shared folder in use is measured. More The remote's own writes can't be refused, so a fast writer goes over by up to this many seconds of writing before its session ends.
`ConnectionLog:Path` `ConnectionLog:RetentionDays`	none, 90	Connection log folder and days kept (0: forever). More On a volume only the Anping server mounts. Empty: kept in memory, and a restart loses it.

Your brand (`Brand`)

Setting	Default	Meaning
`Brand:ProductName`	none	Your product name in the toolbar and the browser tab, up to 64 characters.
`Brand:LogoUrl`	none	Your logo: a path on the Anping server or a `data:image` address, never another site. More Toolbar logo and favicon, such as `/brand/logo.svg`, or a base64 `data:image` URL (png, svg+xml, webp, jpeg or gif). No other host, so no third party learns who opens a desktop.
`Brand:AccentColor`	built in	Your colour: `#rgb` or `#rrggbb`.

When unset

The page names no product: the tab title says Remote desktop, the toolbar has no name, and the accent colour is the built-in one. The page reads these from GET /api/brand. Invalid values are a warning in the startup log and are dropped.