ConfigPress

ConfigPress is AAM’s INI-based configuration overlay. Put dotted configuration keys in an [aam] section. AAM parses the text with PHP INI_SCANNER_TYPED, then merges those keys into its loaded configuration. Keys are flat strings: service.jwt.expires_in is one key, not a nested INI section.

[aam]
service.secure_login.brute_force_lockout = true
service.secure_login.login_attempts = 5
service.secure_login.time_window = "+20 minutes"
service.security_audit.application_password_ttl = 180

This enables login lockout and sets the application-password age used by the audit. Use quoted strings for values containing spaces; PHP parses unquoted true, false, and numbers into typed values.

Read and change values

In PHP, call AAM::api()->config->get('service.secure_login.login_attempts', 5) to read the effective value. AAM::api()->config->set($key, $value) writes a separate stored configuration.
The REST API exposes GET /wp-json/aam/v2/configpress, POST /wp-json/aam/v2/configpress with an ini string, and DELETE /wp-json/aam/v2/configpress. These routes require configuration-management permission.
ConfigPress is loaded during AAM initialization. A changed INI document takes effect on a later request. In multisite, a site inherits the main site’s config, then its own values replace matching keys.
Never paste a real JWT secret, certificate passphrase, or provider key into public documentation or source control.

Keys used by current code

Each key has its own page with its default, source, and an explained INI example. Service *.enabled flags are generally read with true as the fallback when bootstrapping.

Core and site settings

Key	Purpose
`core.settings.cache.capability`	Maximum entries for the capability cache.
`core.settings.merge.preference`	Choose which effect wins when inherited permissions conflict (`allow` or `deny`).
`core.settings.multi_access_levels`	Enable multiple role access levels for one user.
`core.settings.multisite.ignore_resources`	Resource types excluded from multisite synchronization.
`core.settings.multisite.members_only`	Restrict a multisite site to its members.
`core.settings.multisite.sync`	Synchronize access configuration across a network.
`core.settings.object_cache.enabled`	Enable AAM object caching.
`core.settings.parent_roles`	Premium role-parent mapping.
`core.settings.restful_enabled`	Enable AAM management REST routes.
`core.settings.term.merge.preference`	Premium merge preference for term rules.
`core.settings.ui.error_notifications`	Show error notifications in the AAM UI.
`core.settings.ui.render_access_metabox`	Show AAM access controls in the post editor.
`core.settings.ui.tips`	Show tips in the AAM UI.
`core.settings.xmlrpc_enabled`	Allow WordPress XML-RPC requests.
`page.capability`	Fallback WordPress capability for an unregistered `aam_` capability.

Service switches

Key	Purpose
`service.ability.enabled`	Enable the ability service.
`service.access_denied_redirect.enabled`	Enable the access denied redirect service.
`service.admin_toolbar.enabled`	Enable the admin toolbar service.
`service.api_route.enabled`	Enable the api route service.
`service.application_passwords.enabled`	Enable the application passwords service.
`service.backend_menu.enabled`	Enable the backend menu service.
`service.capability.enabled`	Enable the capability service.
`service.content.enabled`	Enable the content service.
`service.geo_lookup.enabled`	Enable the geo lookup service.
`service.hooks.enabled`	Enable the hooks service.
`service.identity.enabled`	Enable the identity service.
`service.jwt.enabled`	Enable the jwt service.
`service.login_redirect.enabled`	Enable the login redirect service.
`service.logout_redirect.enabled`	Enable the logout redirect service.
`service.metabox.enabled`	Enable the metabox service.
`service.metaboxes.enabled`	Enable the metaboxes service.
`service.not_found_redirect.enabled`	Enable the not found redirect service.
`service.policies.enabled`	Enable the policies service.
`service.secure_login.enabled`	Enable the secure login service.
`service.security_audit.enabled`	Enable the security audit service.
`service.shortcodes.enabled`	Enable the shortcodes service.
`service.url.enabled`	Enable the url service.
`service.urls.enabled`	Enable the urls service.
`service.welcome.enabled`	Enable the welcome service.
`service.widget.enabled`	Enable the widget service.
`service.widgets.enabled`	Enable the widgets service.

JWT

Key	Purpose
`service.jwt.bearer`	Comma-separated token carriers: `header`, `query_param`, `post_param`, `cookie`, or a custom name.
`service.jwt.cookie_name`	Cookie name used to read a JWT.
`service.jwt.expires_in`	JWT lifetime as a relative date string.
`service.jwt.header_name`	PHP server header key used to read a JWT.
`service.jwt.post_param_name`	POST parameter used to read a JWT.
`service.jwt.private_cert_passphrase`	Passphrase for the private signing key.
`service.jwt.private_cert_path`	Private signing key file path for asymmetric algorithms.
`service.jwt.public_cert_path`	Public verification certificate path for asymmetric algorithms.
`service.jwt.query_param_name`	Query parameter used to read a JWT.
`service.jwt.registry_size`	Maximum stored JWT registry entries per user.
`service.jwt.signing_algorithm`	JWT signing algorithm, such as `HS256` or `RS256`.
`service.jwt.signing_secret`	Shared signing secret for symmetric algorithms.

Key	Purpose
`service.secure_login.brute_force_lockout`	Enable failed-login lockout.
`service.secure_login.login_attempts`	Failed attempts allowed within the lockout window.
`service.secure_login.login_message`	Message displayed on the AAM login form.
`service.secure_login.single_session`	Limit an account to one session.
`service.secure_login.time_window`	Rolling failed-login window.
`service.secure_login.track_last_access`	Record last account access for security audits.
`service.security_audit.application_password_ttl`	Application-password age threshold in days.
`service.security_audit.inactive_application_password_threshold`	Application-password inactivity threshold in days.
`service.security_audit.inactive_user_account_threshold`	User-account inactivity threshold in days.
`service.security_audit.max_users_to_check`	Maximum users inspected by elevated-access audit checks.
`service.security_audit.recommended_admins_count`	Suggested administrator count.
`service.security_audit.recommended_editors_count`	Suggested editor count.

Content, redirects, and capabilities

Key	Purpose
`service.capability.edit_caps`	Allow capability edits in the AAM UI and REST API.
`service.content.exclude.taxonomies`	Taxonomies excluded from premium content checks.
`service.content.inherit_from_parent_post`	Inherit premium access rules from a parent post.
`service.content.media_category`	Enable premium media category controls.
`service.content.page_category`	Enable premium page category controls.
`service.content.password_ttl`	Lifetime of a successful content-password verification.
`service.login_redirect.suppress_redirect_to`	Ignore WordPress `redirect_to` when applying the login redirect.
`service.post_types.manage_all`	Include non-public post types in content management.
`service.posts.decorate_teaser`	Render teaser content for restricted posts.
`service.taxonomies.manage_all`	Include non-public taxonomies in content management.

Premium geolocation and inheritance

Key	Purpose
`service.geo_lookup.geoapi.adapter`	Select the premium geolocation provider.
`service.geo_lookup.geoapi.api_key`	API key for the selected geolocation provider.
`service.geo_lookup.geoapi.test_ip`	Override the client IP for geolocation testing.
`service.geo_lookup.ipstack.fields`	Fields requested from the Ipstack provider.
`service.geo_lookup.ipstack.schema`	Ipstack request URL schema.

Common mistakes

Use the current key name. Older ConfigPress examples may show names migrated in AAM 7; those are not the active keys listed above.
service.jwt.header_name is a PHP $_SERVER key, such as HTTP_AUTHENTICATION, rather than the literal HTTP header spelling.
service.secure_login.login_attempts defaults to 5.
Set service.jwt.signing_secret for symmetric signing, or supply certificate paths for an asymmetric algorithm. Keep signing material out of publicly readable files.