> For the complete documentation index, see [llms.txt](https://ans-dev.gitbook.io/datareplicator/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ans-dev.gitbook.io/datareplicator/information/configuration-server-side-internals.md).

# Configuration (Server-Side Internals)

Several core behaviors of `DataReplicator` are controlled by constants at the top of the `Core.lua` (server-side) script. While the default values are balanced for general use, you can fine-tune them to match the specific needs of your game.

{% tabs %}
{% tab title="Authorization" %}

* `REQUIRE_AUTHORIZATION_CALLBACK` ([boolean](https://create.roblox.com/docs/luau/booleans), default: `false`)

  A critical security toggle. If `true`, any client request for a key that does not have an explicit rule in your [`:SetAuthorizationCallback()`](/datareplicator/api-reference/server-side-api/setauthorizationcallback.md) function will be automatically denied. This is a "fail-safe" approach. If `false`, requests for keys without a specific rule are allowed by default. It is strongly recommended to set this to true for production games.
  {% endtab %}

{% tab title="Rate Limiting & Reputation" %}

* `RATE_LIMIT_BUCKET_CAPACITY` ([number](https://create.roblox.com/docs/luau/numbers), default: `100`)

  The maximum number of requests a player's "token bucket" can hold. This determines the size of a legitimate "burst" of requests a client can make before being limited. Higher values are more forgiving to short, intense bursts of activity.
* `RATE_LIMIT_TOKEN_REFILL_RATE` ([number](https://create.roblox.com/docs/luau/numbers), default: `2.5`)

  The number of tokens added back to a player's bucket per second. This determines the sustained, long-term request rate a player can maintain.
* `REPUTATION_UNREGISTERED_KEY_PENALTY` ([number](https://create.roblox.com/docs/luau/numbers), default: `5`)

  The penalty score added when a client requests a key that has never been registered with [`:RegisterKey()`](/datareplicator/api-reference/server-side-api/registerkey.md) or [`:Create()`](/datareplicator/api-reference/server-side-api/create.md). This is a strong indicator of malicious probing by an exploiter.
* `REPUTATION_UNAUTHORIZED_PENALTY` ([number](https://create.roblox.com/docs/luau/numbers), default: `25`)

  The penalty score added when a client's request is denied by the [`:SetAuthorizationCallback()`](/datareplicator/api-reference/server-side-api/setauthorizationcallback.md). This is an even stronger indicator of malicious behavior.
* `REPUTATION_SUSPICIOUS_THRESHOLD` ([number](https://create.roblox.com/docs/luau/numbers), default: `50`)

  The penalty score at which a player is flagged as "suspicious." Once this threshold is crossed, any future rate-limiting cooldowns they receive will be significantly longer, as defined by `DYNAMIC_PENALTY_SUSPICIOUS_MULTIPLIER`.
* `REPUTATION_DECAY_RATE_PER_SECOND` ([number](https://create.roblox.com/docs/luau/numbers), default: `0.5`)

  The rate at which a player's penalty score decreases over time. This "forgiveness" factor ensures that a player who accidentally triggered a penalty due to a lag spike or a minor bug isn't permanently flagged.
* `DYNAMIC_PENALTY_COOLDOWNS` ([table](https://create.roblox.com/docs/luau/tables), default: `{ [1] = 5, [2] = 20, [3] = 60 }`)

  A table defining the escalating cooldown durations (in seconds) for rate-limiting offenses. The key is the offense number. The system will use the highest defined cooldown for any subsequent offenses (e.g., the 4th, 5th, etc., offense will also use the 60-second cooldown).
* `DYNAMIC_PENALTY_SUSPICIOUS_MULTIPLIER` ([number](https://create.roblox.com/docs/luau/numbers), default: `3`)

  A multiplier applied to the cooldown duration if the offending player is currently flagged as "suspicious" (i.e., their `PenaltyScore` is above the `REPUTATION_SUSPICIOUS_THRESHOLD`). This makes penalties for consistently badly-behaved clients much harsher.
  {% endtab %}
  {% endtabs %}

*(These values are currently internal and must be changed in the `Core.lua` script. A future version may expose a configuration function.)*