app = Flask(__name__)
app.config['TESTING'] = True

app.testing = True

app.config.update(
    TESTING=True,
    SECRET_KEY='192b9bdd22ab9ed4d12e236c78afcb9a393ec15f71bbf5dc987d54727823bcbf'
)

$ flask --app hello run --debug

Whether debug mode is enabled. When using ``flask run`` to start the development
server, an interactive debugger will be shown for unhandled exceptions, and the
server will be reloaded when code changes. The :attr:`~flask.Flask.debug` attribute
maps to this config key. This is set with the ``FLASK_DEBUG`` environment variable.
It may not behave as expected if set in code.

**Do not enable debug mode when deploying in production.**

Default: ``False``

Enable testing mode. Exceptions are propagated rather than handled by the
the app's error handlers. Extensions may also change their behavior to
facilitate easier testing. You should enable this in your own tests.

Default: ``False``

Exceptions are re-raised rather than being handled by the app's error
handlers. If not set, this is implicitly true if ``TESTING`` or ``DEBUG``
is enabled.

Default: ``None``

If there is no handler for an ``HTTPException``-type exception, re-raise it
to be handled by the interactive debugger instead of returning it as a
simple error response.

Default: ``False``

Trying to access a key that doesn't exist from request dicts like ``args``
and ``form`` will return a 400 Bad Request error page. Enable this to treat
the error as an unhandled exception instead so that you get the interactive
debugger. This is a more specific version of ``TRAP_HTTP_EXCEPTIONS``. If
unset, it is enabled in debug mode.

Default: ``None``

A secret key that will be used for securely signing the session cookie
and can be used for any other security related needs by extensions or your
application. It should be a long random ``bytes`` or ``str``. For
example, copy the output of this to your config::

    $ python -c 'import secrets; print(secrets.token_hex())'
    '192b9bdd22ab9ed4d12e236c78afcb9a393ec15f71bbf5dc987d54727823bcbf'

**Do not reveal the secret key when posting questions or committing code.**

Default: ``None``

A list of old secret keys that can still be used for unsigning. This allows
a project to implement key rotation without invalidating active sessions or
other recently-signed secrets.

Keys should be removed after an appropriate period of time, as checking each
additional key adds some overhead.

Order should not matter, but the default implementation will test the last
key in the list first, so it might make sense to order oldest to newest.

Flask's built-in secure cookie session supports this. Extensions that use
:data:`SECRET_KEY` may not support this yet.

Default: ``None``

.. versionadded:: 3.1

The name of the session cookie. Can be changed in case you already have a
cookie with the same name.

Default: ``'session'``

The value of the ``Domain`` parameter on the session cookie. If not set, browsers
will only send the cookie to the exact domain it was set from. Otherwise, they
will send it to any subdomain of the given value as well.

Not setting this value is more restricted and secure than setting it.

Default: ``None``

.. warning::
    If this is changed after the browser created a cookie is created with
    one setting, it may result in another being created. Browsers may send
    send both in an undefined order. In that case, you may want to change
    :data:`SESSION_COOKIE_NAME` as well or otherwise invalidate old sessions.

.. versionchanged:: 2.3
    Not set by default, does not fall back to ``SERVER_NAME``.

The path that the session cookie will be valid for. If not set, the cookie
will be valid underneath ``APPLICATION_ROOT`` or ``/`` if that is not set.

Default: ``None``

Browsers will not allow JavaScript access to cookies marked as "HTTP only"
for security.

Default: ``True``

Browsers will only send cookies with requests over HTTPS if the cookie is
marked "secure". The application must be served over HTTPS for this to make
sense.

Default: ``False``

Browsers will send cookies based on the top-level document's domain, rather
than only the domain of the document setting the cookie. This prevents third
party cookies set in iframes from "leaking" between separate sites.

Browsers are beginning to disallow non-partitioned third party cookies, so
you need to mark your cookies partitioned if you expect them to work in such
embedded situations.

Enabling this implicitly enables :data:`SESSION_COOKIE_SECURE` as well, as
it is only valid when served over HTTPS.

Default: ``False``

.. versionadded:: 3.1

Restrict how cookies are sent with requests from external sites. Can
be set to ``'Lax'`` (recommended) or ``'Strict'``.
See :ref:`security-cookie`.

Default: ``None``

.. versionadded:: 1.0

If ``session.permanent`` is true, the cookie's expiration will be set this
number of seconds in the future. Can either be a
:class:`datetime.timedelta` or an ``int``.

Flask's default cookie implementation validates that the cryptographic
signature is not older than this value.

Default: ``timedelta(days=31)`` (``2678400`` seconds)

Control whether the cookie is sent with every response when
``session.permanent`` is true. Sending the cookie every time (the default)
can more reliably keep the session from expiring, but uses more bandwidth.
Non-permanent sessions are not affected.

Default: ``True``

When serving files, set the ``X-Sendfile`` header instead of serving the
data with Flask. Some web servers, such as Apache, recognize this and serve
the data more efficiently. This only makes sense when using such a server.

Default: ``False``

When serving files, set the cache control max age to this number of
seconds. Can be a :class:`datetime.timedelta` or an ``int``.
Override this value on a per-file basis using
:meth:`~flask.Flask.get_send_file_max_age` on the application or
blueprint.

If ``None``, ``send_file`` tells the browser to use conditional
requests will be used instead of a timed cache, which is usually
preferable.

Default: ``None``

Validate :attr:`.Request.host` and other attributes that use it against
these trusted values. Raise a :exc:`~werkzeug.exceptions.SecurityError` if
the host is invalid, which results in a 400 error. If it is ``None``, all
hosts are valid. Each value is either an exact match, or can start with
a dot ``.`` to match any subdomain.

Validation is done during routing against this value. ``before_request`` and
``after_request`` callbacks will still be called.

Default: ``None``

.. versionadded:: 3.1

Inform the application what host and port it is bound to.

Must be set if ``subdomain_matching`` is enabled, to be able to extract the
subdomain from the request.

Must be set for ``url_for`` to generate external URLs outside of a
request context.

Default: ``None``

.. versionchanged:: 3.1
    Does not restrict requests to only this domain, for both
    ``subdomain_matching`` and ``host_matching``.

.. versionchanged:: 1.0
    Does not implicitly enable ``subdomain_matching``.

.. versionchanged:: 2.3
    Does not affect ``SESSION_COOKIE_DOMAIN``.

Inform the application what path it is mounted under by the application /
web server.  This is used for generating URLs outside the context of a
request (inside a request, the dispatcher is responsible for setting
``SCRIPT_NAME`` instead; see :doc:`/patterns/appdispatch`
for examples of dispatch configuration).

Will be used for the session cookie path if ``SESSION_COOKIE_PATH`` is not
set.

Default: ``'/'``

Use this scheme for generating external URLs when not in a request context.

Default: ``'http'``

The maximum number of bytes that will be read during this request. If
this limit is exceeded, a 413 :exc:`~werkzeug.exceptions.RequestEntityTooLarge`
error is raised. If it is set to ``None``, no limit is enforced at the
Flask application level. However, if it is ``None`` and the request has no
``Content-Length`` header and the WSGI server does not indicate that it
terminates the stream, then no data is read to avoid an infinite stream.

Each request defaults to this config. It can be set on a specific
:attr:`.Request.max_content_length` to apply the limit to that specific
view. This should be set appropriately based on an application's or view's
specific needs.

Default: ``None``

.. versionadded:: 0.6

The maximum size in bytes any non-file form field may be in a
``multipart/form-data`` body. If this limit is exceeded, a 413
:exc:`~werkzeug.exceptions.RequestEntityTooLarge` error is raised. If it is
set to ``None``, no limit is enforced at the Flask application level.

Each request defaults to this config. It can be set on a specific
:attr:`.Request.max_form_memory_parts` to apply the limit to that specific
view. This should be set appropriately based on an application's or view's
specific needs.

Default: ``500_000``

.. versionadded:: 3.1

The maximum number of fields that may be present in a
``multipart/form-data`` body. If this limit is exceeded, a 413
:exc:`~werkzeug.exceptions.RequestEntityTooLarge` error is raised. If it
is set to ``None``, no limit is enforced at the Flask application level.

Each request defaults to this config. It can be set on a specific
:attr:`.Request.max_form_parts` to apply the limit to that specific view.
This should be set appropriately based on an application's or view's
specific needs.

Default: ``1_000``

.. versionadded:: 3.1

Reload templates when they are changed. If not set, it will be enabled in
debug mode.

Default: ``None``

Log debugging information tracing how a template file was loaded. This can
be useful to figure out why a template was not loaded or the wrong file
appears to be loaded.

Default: ``False``

Warn if cookie headers are larger than this many bytes. Defaults to
``4093``. Larger cookies may be silently ignored by browsers. Set to
``0`` to disable the warning.

Set to ``False`` to disable the automatic addition of OPTIONS
responses. This can be overridden per route by altering the
``provide_automatic_options`` attribute.

Added :data:`ENV` to reflect the :envvar:`FLASK_ENV` environment
variable.

Added :data:`SESSION_COOKIE_SAMESITE` to control the session
cookie's ``SameSite`` option.

Added :data:`MAX_COOKIE_SIZE` to control a warning from Werkzeug.

app = Flask(__name__)
app.config.from_object('yourapplication.default_settings')
app.config.from_envvar('YOURAPPLICATION_SETTINGS')

  .. code-block:: text

     $ export YOURAPPLICATION_SETTINGS=/path/to/settings.cfg
     $ flask run
      * Running on http://127.0.0.1:5000/

  .. code-block:: text

     $ set -x YOURAPPLICATION_SETTINGS /path/to/settings.cfg
     $ flask run
      * Running on http://127.0.0.1:5000/

  .. code-block:: text

     > set YOURAPPLICATION_SETTINGS=\path\to\settings.cfg
     > flask run
      * Running on http://127.0.0.1:5000/

  .. code-block:: text

     > $env:YOURAPPLICATION_SETTINGS = "\path\to\settings.cfg"
     > flask run
      * Running on http://127.0.0.1:5000/

# Example configuration
SECRET_KEY = '192b9bdd22ab9ed4d12e236c78afcb9a393ec15f71bbf5dc987d54727823bcbf'

import tomllib
app.config.from_file("config.toml", load=tomllib.load, text=False)

import json
app.config.from_file("config.json", load=json.load)

  .. code-block:: text

     $ export FLASK_SECRET_KEY="5f352379324c22463451387a0aec5d2f"
     $ export FLASK_MAIL_ENABLED=false
     $ flask run
      * Running on http://127.0.0.1:5000/

  .. code-block:: text

     $ set -x FLASK_SECRET_KEY "5f352379324c22463451387a0aec5d2f"
     $ set -x FLASK_MAIL_ENABLED false
     $ flask run
      * Running on http://127.0.0.1:5000/

  .. code-block:: text

     > set FLASK_SECRET_KEY="5f352379324c22463451387a0aec5d2f"
     > set FLASK_MAIL_ENABLED=false
     > flask run
      * Running on http://127.0.0.1:5000/

  .. code-block:: text

     > $env:FLASK_SECRET_KEY = "5f352379324c22463451387a0aec5d2f"
     > $env:FLASK_MAIL_ENABLED = "false"
     > flask run
      * Running on http://127.0.0.1:5000/

app.config.from_prefixed_env()
app.config["SECRET_KEY"]  # Is "5f352379324c22463451387a0aec5d2f"

$ export FLASK_MYAPI__credentials__username=user123

app.config["MYAPI"]["credentials"]["username"]  # Is "user123"

app = Flask(__name__)
app.config.from_object('yourapplication.default_settings')
app.config.from_envvar('YOURAPPLICATION_SETTINGS')

class Config(object):
    TESTING = False

class ProductionConfig(Config):
    DATABASE_URI = 'mysql://user@localhost/foo'

class DevelopmentConfig(Config):
    DATABASE_URI = "sqlite:////tmp/foo.db"

class TestingConfig(Config):
    DATABASE_URI = 'sqlite:///:memory:'
    TESTING = True

app.config.from_object('configmodule.ProductionConfig')

from configmodule import ProductionConfig
app.config.from_object(ProductionConfig())

# Alternatively, import via string:
from werkzeug.utils import import_string
cfg = import_string('configmodule.ProductionConfig')()
app.config.from_object(cfg)

class Config(object):
    """Base config, uses staging database server."""
    TESTING = False
    DB_SERVER = '192.168.1.56'

    @property
    def DATABASE_URI(self):  # Note: all caps
        return f"mysql://user@{self.DB_SERVER}/foo"

class ProductionConfig(Config):
    """Uses production database server."""
    DB_SERVER = '192.168.19.32'

class DevelopmentConfig(Config):
    DB_SERVER = 'localhost'

class TestingConfig(Config):
    DB_SERVER = 'localhost'
    DATABASE_URI = 'sqlite:///:memory:'

app = Flask(__name__, instance_path='/path/to/instance/folder')

app = Flask(__name__, instance_relative_config=True)

app = Flask(__name__, instance_relative_config=True)
app.config.from_object('yourapplication.default_settings')
app.config.from_pyfile('application.cfg', silent=True)

filename = os.path.join(app.instance_path, 'application.cfg')
with open(filename) as f:
    config = f.read()

# or via open_instance_resource:
with app.open_instance_resource('application.cfg') as f:
    config = f.read()