Warning: the two published Settings captures (settings.png and settings-annotated.png) still show a group token in cleartext (clip_3a84902c2650) — re-verified unresolved by reading settings.png in the v0.8.70 round-2 audit. That string is a stale capture artifact — treat it as burned, not as an example to copy, and never share your own: the group token is the credential that joins a device to your group. Both images are queued for a retake with the Group Token field blanked or redacted at capture time, to be shipped independently of any prose or screenshot-freshness work.

The captures also predate the current UI: since v0.8.70 the daemon no longer serves the credential over the API at all. GET /api/settings returns [redacted:<8 hex>] in place of group_token (load_effective_settings_for_api), and when a token is configured the Settings page renders a read-only Configured — hidden for security field with no copy button (web/src/pages/SettingsPage.tsx). A current capture cannot reproduce the leak.

The Settings page is split into collapsible cards. Clipshot remembers which sections you keep open or closed.

The Settings page is organised into collapsible cards, in this order: Connection (Hub Portal URL, Group Token, subscription info), General (theme, startup behavior, and hotkeys), Sync, Storage, Network, Advanced, and File Transfer. At the bottom are Save Changes and Reset to Defaults buttons.

Only the Connection card and the top of the General card fit into the plain settings.png viewport — in the current capture just the General heading and a sliver of its subtitle are visible, a truncation first flagged in v0.8.54 and re-verified still unresolved in the v0.8.70 round-2 audit. The Theme selector, Start on login switch, Toggle Sync Hotkey, and Paste Path Hotkey rows are documented from source and from settings-annotated.png; they are below the fold in the plain capture.

The annotated view highlights: ① Connection card — hub status badge, Hub Portal URL, Group Token with copy button, account buttons, and the Subscription summary. ② Sign in / switch group button — opens the browser sign-in flow. ③ General card — Theme selector, Start on login switch, Toggle Sync Hotkey, and Paste Path Hotkey. The annotated screenshot shows the same session as settings.png (both account buttons, Send File in the sidebar) and additionally shows the full General card that is cut off at the bottom of settings.png. Two things in this capture are defects rather than intentional illustrations: it still leaks the group token in cleartext (the retake must redact or blank the Group Token field — never share your own group token), and its Paste Path Hotkey reads Disabled because that session had it turned off; the shipped default is Cmd+B / Ctrl+B.

The page always shows Save Changes and Reset to Defaults buttons at the bottom. If you have unsaved changes, a sticky bar also appears with Discard and Save buttons.

Connection (hub_url, group_token)

The Connection card controls how your device joins Clipshot Portal. The full card — hub status badge, Hub Portal URL, Group Token, account buttons, and Subscription summary — is visible at the top of the page screenshots above.

Visible items:

• status badge:
  • Not configured
  • Connected
  • Disconnected
• Hub Portal URL
• Group Token — when a token is configured the field is read-only and reads Configured — hidden for security, with no copy button: GET /api/settings serves [redacted:<8 hex>] instead of the credential (load_effective_settings_for_api), so the browser never receives it. The editable input appears only when no token is set yet.
• subscription summary showing:
  • plan: Lite or Pro
  • peer limit
  • relay enabled or disabled

Account buttons under the Group Token field:

• Link current group to account - shown when a group token is set; opens the browser to associate the current group with a Portal account
• Sign in / switch group - opens a browser sign-in (setup session); if you sign in to a different group, a Switch group? confirmation dialog appears before the token is replaced

You may also see:

• Connected · N peers in network
• Connecting to portal...
• device-limit warning with Open Portal Devices button
• Recover access button - shown in an amber warning banner when a group token is set but the portal is disconnected; opens the same browser sign-in flow to repair broken or expired authorization

About relay_url:

• Relay URL affects connectivity too, but in the current UI it is edited in the Network card, not inside Connection.

General (theme, startup, hotkeys)

The General card includes:

• Theme:
  • System
  • Light
  • Dark
• Start on login switch
• Toggle Sync Hotkey selector
• Paste Path Hotkey selector

Notes:

• the default sync toggle hotkey is Cmd+Shift+S (macOS) or Ctrl+Shift+S (Windows/Linux)
• the default paste path hotkey is Cmd+B (macOS) or Ctrl+B (Windows/Linux), from default_paste_path_hotkey() in src/p2p/control/settings.rs — it is enabled out of the box. The selector also has a Disabled option, and settings-annotated.png happens to show a session where it had been switched to Disabled; that capture does not show the shipped default and is queued for a retake
• both hotkey selectors show a restart badge; the hotkey listener updates immediately via HotkeyListener::set_hotkey(), but a restart may be needed for full effect

The card subtitle in the UI reads “Theme, startup behavior, notifications, and hotkey” (web/src/pages/SettingsPage.tsx:699, the General card description), but no Notifications toggle is rendered anywhere in the card. Re-verified against source in the v0.8.70 round-2 audit: that string is still the only occurrence of “notification” in the file. This is a product defect, not a docs defect — either the subtitle should drop the word “notifications” or the toggle should be restored; it is recorded here so the fix is not lost.

The notifications setting itself still exists in the backend (settings.notifications, default true) and can be changed via the HTTP API (POST /api/settings with {"notifications": true}) or settings.toml — it simply has no control on the Settings page. The full General card (subtitle, Theme, Start on login, and both hotkey selectors, with no Notifications toggle) is visible in the annotated screenshot above; in settings.png the card is cut off at the bottom of the viewport.

Sync (max_file_size_mb, broadcast_queue_size)

Note: this capture is not a default-settings fixture. It shows Max file size = 200, an edited value; the shipped default is 10 MB. The amber Large files may timeout warning below the field is a consequence of that edit (it appears above 100 MB), not a normal-state element. Broadcast queue size = 1 in the capture does match the default.

The Sync card includes:

• Max file size (MB)
• Broadcast queue size

What they mean:

• Max file size limits what Clipshot will send. The input on this page accepts 1-500 MB (default 10 MB); the HTTP API validator is wider (1..10240), so values above 500 MB can only be set through POST /api/settings or settings.toml.
• Broadcast queue size controls how many clipboard items are queued for delivery (1-10, default 1). At 1, a new copy overwrites the previous pending item. Higher values keep recent items in the queue.

If you set a file limit above 100 MB, Clipshot warns that large files may time out.

Storage (sync file retention)

The Storage card includes:

• Max files - maximum number of files to keep in the sync directory (0 = unlimited). Input range 0-10000, default 100.
• Max age (days) - delete synced files older than this many days (0 = unlimited). Input range 0-365, default 30; the HTTP API accepts up to 3650.
• Max size (MB) - maximum total size of the sync directory (0 = unlimited). Input range 0-10000, default 200; the HTTP API accepts up to 100000.

These settings control automatic cleanup of ~/.clipshot/sync/.

Where the input range is narrower than the API range, the higher values are reachable only via POST /api/settings or settings.toml — see API reference.

Network (listen_port, max_peers)

The Network card includes:

• Listen Port
• Max Peers
• Auto Discover switch
• Relay URL
• Act as relay for other devices switch (peer_relay_enabled)
• Use public relay fallback switch (n0_relay_enabled)
• a read-only Central relay status line (Enabled/Disabled, Pro-only — hub-authoritative)
• Node Password

What they do:

• Listen Port is the port this device listens on for P2P traffic (input range 1024-65535, default 19231)
• Max Peers caps simultaneous peer connections (input range 1-100, default 10; the HTTP API validator allows 1..1000, so higher caps must be set via POST /api/settings or settings.toml)
• Auto Discover enables local network discovery
• Relay URL is used for NAT traversal and long-distance fallback
• Act as relay for other devices lets other devices in your group relay traffic through this node
• Use public relay fallback falls back to the public iroh relay when a direct connection fails
• Node Password protects your node so only devices with that password can connect

Invalid listen ports are highlighted immediately.

File Transfer (auto_accept_files, received_files_dir)

The File Transfer card controls how incoming file transfers (Pro feature) are handled:

• Auto-accept files switch - when enabled (default), incoming files are saved automatically; when disabled, a notification prompts you to accept or decline
• Received files directory - where incoming files are saved (default: ~/.clipshot/received)

Advanced (polling, browser UI, diagnostics)

The Advanced card includes:

• Poll Interval (ms) — how often the clipboard is checked for changes. The input on this page accepts 100-10000 ms in steps of 100 (default 500 ms). Over HTTP the same field is called sync_interval_ms and is validated as 100..3_600_000, so longer intervals are reachable only via the API or settings.toml — the two ranges do not contradict each other, the UI is simply the narrower surface.
• Direct Send Threshold (MB) — below this size content is sent directly without chunking (input range 1-100, default 1; requires restart)
• Use Browser UI switch — use the web browser instead of the native app (requires restart)

The card also contains the Diagnostics subsection described below.

Diagnostic telemetry (diagnostic_telemetry)

Clipshot has one reusable opt-in switch for its own diagnosis logging: diagnostic_telemetry (src/p2p/control/settings.rs), default false. When enabled, the extra investigation-aid log sites are emitted; they are deliberately off by default because they are investigation aids rather than user-facing diagnostics.

It can be turned on in three ways:

• diagnostic_telemetry = true in settings.toml
• a full-settings save from the native GUI
• the environment variable CLIPSHOT_DEBUG_TELEMETRY=1

It cannot be set through POST /api/settings — remote enablement would amplify log volume, so UpdateSettingsRequest has no field for it and such a request silently no-ops on this key. See the API reference list of fields not accepted over HTTP.

Export / Import

Export Settings and Import Settings sit inside the Advanced card, in a button row directly below the Diagnostics subsection:

• Export Settings downloads the current settings as clipshot-settings.json
• Import Settings loads settings from a JSON file

Import does not apply changes immediately. After import, click Save.

Diagnostics

The Diagnostics subsection at the bottom of the Advanced card shows live runtime information. Each row has its own copy button.

Current fields, in UI order:

• Node Name
• Node ID
• Uptime
• Iroh Address
• Hub Status (Connected / Disconnected)

Use this section when:

• support asks for your node ID
• you want to verify the app is connected to the hub
• you need your device address for manual pairing