---
displayed_sidebar: homepage
---

import TypeList from "@site/src/components/TypeList"

# ConfigModule

The configurations for your Medusa backend are in `medusa-config.js` located in the root of your Medusa project. The configurations include database, modules, and plugin configurations, among other configurations.

`medusa-config.js` exports an object having the following properties:

- [projectConfig](medusa.ConfigModule-1.mdx#projectconfig): (required): An object that holds general configurations related to the Medusa backend, such as database or CORS configurations.
- [plugins](medusa.ConfigModule-1.mdx#plugins): An array of plugin configurations that defines what plugins are installed and optionally specifies each of their configurations.
- [modules](medusa.ConfigModule-1.mdx#modules): An object that defines what modules are installed and optionally specifies each of their configurations.
- [featureFlags](medusa.ConfigModule-1.mdx#featureflags): An object that enables or disables features guarded by a feature flag.

For example:

```js title="medusa-config.js"
module.exports = {
  projectConfig,
  plugins,
  modules,
  featureFlags,
}
```

---

## Environment Variables

It's highly recommended to store the values of configurations in environment variables, then reference them within `medusa-config.js`.

During development, you can set your environment variables in the `.env` file at the root of your Medusa backend project. In production,
setting the environment variables depends on the hosting provider.

---

## Properties

<TypeList types={[{"name":"projectConfig","type":"[ProjectConfigOptions](medusa.ProjectConfigOptions.mdx)","description":"This property holds essential configurations related to the Medusa backend, such as database and CORS configurations.","optional":false,"defaultValue":"","expandable":false,"children":[{"name":"database_logging","type":"`LoggerOptions`","description":"This configuration specifies what database messages to log. Its value can be one of the following:\n\n- (default) A boolean value that indicates whether any messages should be logged.\n- The string value `all` that indicates all types of messages should be logged.\n- An array of log-level strings to indicate which type of messages to show in the logs. The strings can be `query`, `schema`, `error`, `warn`, `info`, `log`, or `migration`. Refer to [Typeorm’s documentation](https://typeorm.io/logging#logging-options) for more details on what each of these values means.\n\nIf this configuration isn't set, its default value is `false`, meaning no database messages are logged.","optional":false,"defaultValue":"","expandable":false,"children":[]},{"name":"store_cors","type":"`string`","description":"The Medusa backend’s API Routes are protected by Cross-Origin Resource Sharing (CORS). So, only allowed URLs or URLs matching a specified pattern can send requests to the backend’s API Routes.\n\n`store_cors` is a string used to specify the accepted URLs or patterns for store API Routes. It can either be one accepted origin, or a comma-separated list of accepted origins.\n\nEvery origin in that list must either be:\n\n1. A URL. For example, `http://localhost:8000`. The URL must not end with a backslash;\n2. Or a regular expression pattern that can match more than one origin. For example, `.example.com`. The regex pattern that the backend tests for is `^([/~@;%#'])(.*?)\\1([gimsuy]*)$`.","optional":true,"defaultValue":"","expandable":false,"children":[]},{"name":"admin_cors","type":"`string`","description":"The Medusa backend’s API Routes are protected by Cross-Origin Resource Sharing (CORS). So, only allowed URLs or URLs matching a specified pattern can send requests to the backend’s API Routes.\n\n`admin_cors` is a string used to specify the accepted URLs or patterns for admin API Routes. It can either be one accepted origin, or a comma-separated list of accepted origins.\n\nEvery origin in that list must either be:\n\n1. A URL. For example, `http://localhost:7001`. The URL must not end with a backslash;\n2. Or a regular expression pattern that can match more than one origin. For example, `.example.com`. The regex pattern that the backend tests for is `^([/~@;%#'])(.*?)\\1([gimsuy]*)$`.","optional":true,"defaultValue":"","expandable":false,"children":[]},{"name":"cookie_secret","type":"`string`","description":"A random string used to create cookie tokens. Although this configuration option is not required, it’s highly recommended to set it for better security.\n\nIn a development environment, if this option is not set, the default secret is `supersecret` However, in production, if this configuration is not set, an error is thrown and\nthe backend crashes.","optional":true,"defaultValue":"","expandable":false,"children":[]},{"name":"jwt_secret","type":"`string`","description":"A random string used to create authentication tokens. Although this configuration option is not required, it’s highly recommended to set it for better security.\n\nIn a development environment, if this option is not set the default secret is `supersecret` However, in production, if this configuration is not set an error, an\nerror is thrown and the backend crashes.","optional":true,"defaultValue":"","expandable":false,"children":[]},{"name":"database_database","type":"`string`","description":"The name of the database to connect to. If specified in `database_url`, then it’s not required to include it.\n\nMake sure to create the PostgreSQL database before using it. You can check how to create a database in\n[PostgreSQL's documentation](https://www.postgresql.org/docs/current/sql-createdatabase.html).","optional":true,"defaultValue":"","expandable":false,"children":[]},{"name":"database_url","type":"`string`","description":"The connection URL of the database. The format of the connection URL for PostgreSQL is:\n\n```bash\npostgres://[user][:password]@[host][:port]/[dbname]\n```\n\nWhere:\n\n- `[user]`: (required) your PostgreSQL username. If not specified, the system's username is used by default. The database user that you use must have create privileges. If you're using the `postgres` superuser, then it should have these privileges by default. Otherwise, make sure to grant your user create privileges. You can learn how to do that in [PostgreSQL's documentation](https://www.postgresql.org/docs/current/ddl-priv.html).\n- `[:password]`: an optional password for the user. When provided, make sure to put `:` before the password.\n- `[host]`: (required) your PostgreSQL host. When run locally, it should be `localhost`.\n- `[:post]`: an optional port that the PostgreSQL server is listening on. By default, it's `5432`. When provided, make sure to put `:` before the port.\n- `[dbname]`: (required) the name of the database.\n\nYou can learn more about the connection URL format in [PostgreSQL’s documentation](https://www.postgresql.org/docs/current/libpq-connect.html).","optional":true,"defaultValue":"","expandable":false,"children":[]},{"name":"database_schema","type":"`string`","description":"The database schema to connect to. This is not required to provide if you’re using the default schema, which is `public`.\n\n```js title=\"medusa-config.js\"\nmodule.exports = {\n  projectConfig: {\n    database_schema: process.env.DATABASE_SCHEMA ||\n      \"custom\",\n    // ...\n  },\n  // ...\n}\n```","optional":true,"defaultValue":"","expandable":false,"children":[]},{"name":"database_extra","type":"`Record<string, unknown>` & `object`","description":"An object that includes additional configurations to pass to the database connection. You can pass any configuration. One defined configuration to pass is\n`ssl` which enables support for TLS/SSL connections.\n\nThis is useful for production databases, which can be supported by setting the `rejectUnauthorized` attribute of `ssl` object to `false`.\nDuring development, it’s recommended not to pass this option.","optional":true,"defaultValue":"","expandable":false,"children":[]},{"name":"redis_url","type":"`string`","description":"Used to specify the URL to connect to Redis. This is only used for scheduled jobs. If you omit this configuration, scheduled jobs won't work.\n\n:::note\n\nYou must first have Redis installed. You can refer to [Redis's installation guide](https://redis.io/docs/getting-started/installation/).\n\n:::\n\nThe Redis connection URL has the following format:\n\n```bash\nredis[s]://[[username][:password]@][host][:port][/db-number]\n```\n\nFor a local Redis installation, the connection URL should be `redis://localhost:6379` unless you’ve made any changes to the Redis configuration during installation.","optional":true,"defaultValue":"","expandable":false,"children":[]},{"name":"redis_prefix","type":"`string`","description":"The prefix set on all keys stored in Redis. The default value is `sess:`.\n\nIf this configuration option is provided, it is prepended to `sess:`.","optional":true,"defaultValue":"","expandable":false,"children":[]},{"name":"redis_options","type":"`RedisOptions`","description":"An object of options to pass ioredis. You can refer to [ioredis’s RedisOptions documentation](https://redis.github.io/ioredis/index.html#RedisOptions)\nfor the list of available options.","optional":true,"defaultValue":"","expandable":false,"children":[]},{"name":"session_options","type":"[SessionOptions](medusa.SessionOptions.mdx)","description":"An object of options to pass to [express-session](https://www.npmjs.com/package/express-session).","optional":true,"defaultValue":"","expandable":false,"children":[]},{"name":"http_compression","type":"[HttpCompressionOptions](medusa.HttpCompressionOptions.mdx)","description":"Configure HTTP compression from the application layer. If you have access to the HTTP server, the recommended approach would be to enable it there.\nHowever, some platforms don't offer access to the HTTP layer and in those cases, this is a good alternative.\n\nIts value is an object that has the following properties:\n\nIf you enable HTTP compression and you want to disable it for specific API Routes, you can pass in the request header `\"x-no-compression\": true`.","optional":true,"defaultValue":"","expandable":false,"children":[]},{"name":"jobs_batch_size","type":"`number`","description":"Configure the number of staged jobs that are polled from the database. Default is 1000.","optional":true,"defaultValue":"","expandable":false,"children":[]}]},{"name":"plugins","type":"(`string` \\| `object`)[]","description":"On your Medusa backend, you can use [Plugins](https://docs.medusajs.com/development/plugins/overview) to add custom features or integrate third-party services.\nFor example, installing a plugin to use Stripe as a payment processor.\n\nAside from installing the plugin with NPM, you need to pass the plugin you installed into the `plugins` array defined in `medusa-config.js`.\n\nThe items in the array can either be:\n\n- A string, which is the name of the plugin to add. You can pass a plugin as a string if it doesn’t require any configurations.\n- An object having the following properties:\n    - `resolve`: The name of the plugin.\n    - `options`: An object that includes the plugin’s options. These options vary for each plugin, and you should refer to the plugin’s documentation for available options.","optional":false,"defaultValue":"","expandable":false,"children":[]},{"name":"featureFlags","type":"`Record<string, string \\| boolean>`","description":"Some features in the Medusa backend are guarded by a feature flag. This ensures constant shipping of new features while maintaining the engine’s stability.\n\nYou can specify whether a feature should or shouldn’t be used in your backend by enabling its feature flag. Feature flags can be enabled through either environment\nvariables or through this configuration exported in `medusa-config.js`.\n\nIf you want to use the environment variables method, learn more about it in the [Feature Flags documentation](https://docs.medusajs.com/development/feature-flags/toggle#method-one-using-environment-variables).\n\nThe `featureFlags` configuration is an object. Its properties are the names of the feature flags. Each property’s value is a boolean indicating whether the feature flag is enabled.\n\nYou can find available feature flags and their key name [here](https://github.com/medusajs/medusa/tree/master/packages/medusa/src/loaders/feature-flags).","optional":false,"defaultValue":"","expandable":false,"children":[]},{"name":"modules","type":"`Record<string, boolean \\| Partial&#60;[InternalModuleDeclaration](../types/medusa.InternalModuleDeclaration.mdx) \\| [ExternalModuleDeclaration](../types/medusa.ExternalModuleDeclaration.mdx)&#62;>`","description":"In Medusa, commerce and core logic are modularized to allow developers to extend or replace certain [modules](https://docs.medusajs.com/development/modules/overview)\nwith custom implementations.\n\nAside from installing the module with NPM, you must add it to the exported object in `medusa-config.js`.\n\nThe keys of the `modules` configuration object refer to the type of module. Its value can be one of the following:\n\n1. A boolean value indicating whether the module type is enabled;\n2. Or a string value indicating the name of the module to be used for the module type. This can be used if the module does not require any options;\n3. Or an object having the following properties, but typically you would mainly use the `resolve` and `options` properties only:\n    1. `resolve`: a string indicating the name of the module.\n    2. `options`: an object indicating the options to pass to the module. These options vary for each module, and you should refer to the module’s documentation for details on them.\n    3. `resources`: a string indicating whether the module shares the dependency container with the Medusa core. Its value can either be `shared` or `isolated`. Refer to the [Modules documentation](https://docs.medusajs.com/development/modules/create#module-scope) for more details.\n    4. `alias`: a string indicating a unique alias to register the module under. Other modules can’t use the same alias.\n    5. `main`: a boolean value indicating whether this module is the main registered module. This is useful when an alias is used.","optional":true,"defaultValue":"","expandable":false,"children":[]}]} expandUrl="https://docs.medusajs.com/development/entities/repositories#retrieving-a-list-of-records" sectionTitle="ConfigModule"/>