Configuration settings for Apps

Feature flags and configuration records govern how Apps handle identity propagation, dataset access, and execution limits. The table below summarizes key settings that influence app behavior:

Setting	Type	Purpose
`SecureIdentityPropagationToAppsEnabled`	Feature flag	Enables a limited-scope JSON Web Token (JWT) for identifying the requesting user. Required for deep linking and extended identity propagation.
`com.cerebro.domino.apps.extendedIdentityPropagationToAppsEnabled`	Configuration record	Enables a full-scope JWT for identifying the requesting user. Requires `SecureIdentityPropagationToAppsEnabled`. See extended identity propagation.
`com.cerebro.domino.dataset.mountingEnabledInApps`	Configuration record	Controls whether Datasets are mounted or accessed via API only.
`com.cerebro.domino.apps.maxAppsPerProject`	Configuration record	Limits how many apps can exist within a single project.
`com.cerebro.domino.apps.maxActiveAppRunsPerProject`	Configuration record	Caps how many app sessions can run concurrently per project.

Secure identity propagation and the app host path

Domino uses the SecureIdentityPropagationToAppsEnabled feature flag to control how requests are routed to a running app. When the flag is true, Domino changes the URL routing structure it uses to proxy requests. Defaults by version:

Domino version	Default	Notes
Cloud Release 90 and later	`true`	All Apps should use `DOMINO_RUN_HOST_PATH`.
6.3.0 and later (self-managed)	`true`	All Apps should use `DOMINO_RUN_HOST_PATH`.
Earlier releases	`false`	Migrate to `DOMINO_RUN_HOST_PATH` before enabling the flag.

Symptoms of an incompatible app

An app that manually constructs its path prefix from DOMINO_PROJECT_OWNER, DOMINO_PROJECT_NAME, and DOMINO_RUN_ID produces a path that no longer matches the new routing structure. The app continues to run until it is restarted, then fails on the next start. Common symptoms:

Blank page, 404, or 502 after restart.
Dash (Plotly) app fails to serve assets or callbacks.
The app worked before the flag was enabled or before the last restart.

Update your app to use `DOMINO_RUN_HOST_PATH`

Replace any manually constructed path prefix with the Domino-provided DOMINO_RUN_HOST_PATH environment variable. Domino sets this variable automatically and it always reflects the correct routing path, regardless of the flag state. Before (breaks when the flag is true):

user    = os.environ.get("DOMINO_PROJECT_OWNER")
project = os.environ.get("DOMINO_PROJECT_NAME")
run_id  = os.environ.get("DOMINO_RUN_ID")
runurl  = f"/{user}/{project}/r/notebookSession/{run_id}/"

app = Dash(__name__, routes_pathname_prefix="/", requests_pathname_prefix=runurl)

After (recommended):

runurl = os.environ.get("DOMINO_RUN_HOST_PATH")

app = Dash(__name__, routes_pathname_prefix="/", requests_pathname_prefix=runurl)

Publish a new version with the updated code, then deploy that version. Verify that the page loads and that callbacks and assets resolve.

Any Python web framework that accepts an explicit base path or prefix (Dash, Streamlit, Flask, and others) should read the prefix from DOMINO_RUN_HOST_PATH.

If SecureIdentityPropagationToAppsEnabled is false and you need to allow anonymous access to Domino Apps, also set the Central Config parameter com.cerebro.domino.launchpad.allowPublicModelProducts to true.

Next steps

Apps in Domino gives an overview of how apps work within the Domino ecosystem.
Publish and deploy App versions explains how publishing a version differs from deploying it, and which settings you can change without creating a version.
Learn more about how Apps in Domino run and what identity and permissions are used.

Core Concepts

Features

Configuration settings for Apps

Secure identity propagation and the app host path

Symptoms of an incompatible app

Update your app to use `DOMINO_RUN_HOST_PATH`

Next steps

​Secure identity propagation and the app host path

​Symptoms of an incompatible app

​Update your app to use DOMINO_RUN_HOST_PATH

​Next steps

Secure identity propagation and the app host path

Symptoms of an incompatible app

Update your app to use `DOMINO_RUN_HOST_PATH`

Next steps