---
title: "Configuration File"
description: "Every key you can set in the Shorebird configuration file, what each one does, and what the build puts in your app."
---

`shorebird.yaml` configures Shorebird for your app. `shorebird init` creates it in the root of your Flutter project and adds it to the assets in your `pubspec.yaml`. It holds no secrets, so check it into version control.

shorebird.yaml

```
app_id: 8c846e87-1461-4b09-8708-170d78331aca
flavors:
  development: 8c846e87-1461-4b09-8708-170d78331aca
  production: 6b6e6631-4fbe-4645-8d9d-d5247656d975
auto_update: false
```

## Keys

| Key                  | Required | Default                     | Set it to                                     |
| -------------------- | -------- | --------------------------- | --------------------------------------------- |
| `app_id`             | Yes      |                             | Your app’s ID. `shorebird init` writes it.    |
| `flavors`            | No       |                             | A flavor name to app ID map, one per flavor.  |
| `base_url`           | No       | `https://api.shorebird.dev` | A server that forwards to Shorebird’s API.    |
| `auto_update`        | No       | `true`                      | `false` to check for patches from your code.  |
| `patch_verification` | No       | `strict`                    | `install_only` to skip the check at each run. |

### `app_id`

Identifies your app to Shorebird. The CLI uses it for every app command run in the project, and your app sends it when it checks for patches. It isn’t a secret.

### `flavors`

One app ID per flavor. `shorebird init` writes this map when your project has flavors, and `app_id` is the app ID used when you build without `--flavor`. When you pass `--flavor`, the build puts that flavor’s app ID in your app, and the CLI uses it for that command. A flavor that isn’t in the map fails with:

```
This project does not have a flavor named "<flavor>". Pass one of: ... (from "flavors" in shorebird.yaml).
```

See [Flavors](/code-push/guides/flavors/android/) for setup.

### `base_url`

Where your app sends patch checks and patch events. Set it only to route that traffic through your own domain; see [Using a reverse proxy](/system/firewalls-and-mirrors/#using-a-reverse-proxy). Leave out the trailing slash.

The CLI also sends its own API requests in this project to `base_url`, unless the `SHOREBIRD_HOSTED_URL` environment variable is set.

### `auto_update`

With `true` (the default), your app checks for a patch on the `stable` track in the background at every launch and installs it. With `false`, it checks only when your code calls `checkForUpdate()` or `update()` from [`package:shorebird_code_push`](https://pub.dev/packages/shorebird_code_push). See [Update strategies](/code-push/update-strategies/), including what turning it off means for [rollback](/code-push/rollback/).

### `patch_verification`

When a [signed](/code-push/guides/patch-signing/) patch’s signature is checked:

* `strict` (the default): when the patch installs, and every time your app launches it.
* `install_only`: only when the patch installs. Read the [trade-offs](/code-push/guides/patch-signing/#trade-offs) before you use it.

## Keys you can’t set

The CLI accepts only the keys above. Any other key makes the CLI commands that read `shorebird.yaml`, such as `shorebird release`, fail with an error like this:

```
Unrecognized keys: [channel]; supported keys: [app_id, flavors, base_url, auto_update, patch_verification]
```

Two keys people add that don’t belong here:

* `channel`. Which [track](/code-push/tracks/) a device checks is set in your code: pass `track:` to `checkForUpdate()` or `update()` from `package:shorebird_code_push`. See [Subscribing a device to a track](/code-push/tracks/#subscribing-a-device-to-a-track).
* `patch_public_key`. The build adds the public key for [patch signing](/code-push/guides/patch-signing/) to the copy of the file in your app. Don’t add it yourself.

## What ends up in your app

`shorebird release` and `shorebird patch` bundle a trimmed copy of `shorebird.yaml` into your app. It holds the app ID for the flavor you built, your `base_url`, `auto_update` and `patch_verification` if you set them, and, for a signed release, the patch signing public key. `flavors` isn’t in it. Your project’s `shorebird.yaml` doesn’t change.

Your app reads this copy when it starts, so a change to `shorebird.yaml` reaches devices only in a new release. A patch can’t change it.