Store API credentials safely
Put API keys in the environment and refer to them with{{secret.NAME}}.
With the default prefix, Mikting reads MIKTING_NAME. Missing secrets fail the
action and set mikting_error. Do not commit credentials or paste them into
Discord scripts.
When logging.redactContent is enabled (the default), the logger redacts
configured secret values and Bearer or Basic credential patterns. Log lines
are capped at 2000 characters. Content redaction depends on that setting.
Restrict outbound requests
http.allowPrivateIps defaults to true, which can be necessary when an API
runs on a private network. Set it to false to resolve request hosts and
redirect targets and reject private, loopback, and link-local addresses,
including the cloud metadata address 169.254.169.254. Enable request rate
limits where event traffic could overload a service.
Mikting also applies timeouts and response-size limits. It retries only
idempotent methods by default. Its HTTP cache key includes a hash of the
Authorization value, and responses with Set-Cookie or Cache-Control: no-store or private are not cached.
Secure inbound hooks
The webhook listener uses one port. WhenautoDetect is enabled, it reads
SERVER_PORT, ALLOC_PORT, or PORT and SERVER_IP, with configured values
as fallbacks. The public URL prefers PUBLIC_DOMAIN, then baseUrl.
Hook IDs should be hard to guess. Set MIKTING_HOOK_<ID> to require an HMAC
signature, especially if a hook can change roles or trigger moderation. Hooks
without a secret remain open for compatibility and produce a warning. Payloads
are limited to 256 KiB by default. See HTTP and webhooks
for signature formats.
Keep storage between restarts
Setstorage.path to a file on a persistent Pterodactyl volume. The default is
configs/Mikting/store.db. If SQLite cannot open its database, Mikting logs a
warning and uses memory storage; /mikting-status shows memory(fallback).
Memory data is lost on restart. A configured user, guild, or other scoped
write falls back to the shared global scope if its context ID is missing. Pass
a member or other matching context when scripts depend on scoped storage.
Expressions and includes
miktingMath, miktingExpr, miktingBranch.when, and miktingWhile.cond
use filtrex expressions, not JavaScript evaluation. miktingString.regex
compiles a JavaScript regular expression from YAML, so avoid patterns with
pathological backtracking. Errors set mikting_error.
Library functions and included files are action data executed by the bot’s
action engine. miktingInclude paths are confined to the bot working
directory.
Documentation home · Source Markdown