Files and settings

Where things live

Path	What
%LOCALAPPDATA%\Flarebox\	The app, with the per-user setup (flarebox.exe, uninstall.exe). The MSI installs to Program Files instead
%APPDATA%\Flarebox\flarebox.json	Settings. No credentials
%APPDATA%\Flarebox\history.json	The last 50 deploys, rollbacks, splits and remote migrations per project
%APPDATA%\Flarebox\snapshots\<project>\*.zip	State snapshots
%APPDATA%\Flarebox\cloudflare.sqlite	The last state seen per zone (offline view, drift), the change history for undo, and every post-quantum check. No credentials
%APPDATA%\Flarebox\bundles\…	The bundle from the last deploy, for Review changes
Windows Credential Manager, service Flarebox	cloudflare-api-read and cloudflare-api-write
%TEMP%\flarebox-*	Short-lived files for bundles, edits and queue batches

Set FLAREBOX_DATA_DIR to use another folder instead of %APPDATA%\Flarebox.

Dev-server logs aren’t written to disk. Flarebox keeps the last 5,000 lines per project in memory; Save logs… writes them where you choose.

Files you choose where to save

File	From
pq-fix-report-<host>.html	Post-quantum → Fix report
CBOM (.json, CycloneDX 1.6)	Post-quantum → CBOM
<zone>.zone.txt	DNS → Export → Zone file (BIND)
<host>.origin.pem, <host>.origin.key	SSL/TLS → Origin certificates → Issue
<zone>.mldsa-ca.pem / .key, <host>.mldsa.pem / .key	SSL/TLS → Post-quantum origin certificates
CSV, JSONL, values	Explorer exports, tail Export as JSONL, KV / R2 Save as…

Key and certificate files are always created new. Flarebox never overwrites an existing file.

flarebox.json

Written atomically (to flarebox.json.tmp, then renamed). A missing or unreadable file starts fresh, and unknown fields are ignored. Field names are camelCase.

Top level

Field
roots	Watched folders
pinned	Pinned project folders
hidden	Hidden projects
projects	Per-project settings, keyed by the project’s path (lowercased)
app	App preferences

app

Field	Default
theme	"system"	"system", "light" or "dark"
notifyOnCrash	true	Windows notification when a dev server crashes
launchAtLogin	false	Start with Windows, into the tray
cloudflareReadOnly	false	Read-only mode
cloudflareAlerts	true	Tray alerts every 15 minutes
pqRecheck	true	Daily post-quantum re-check

projects[path]

Field
script	null runs wrangler dev. A name like "dev" runs <package manager> run dev
port	Fixed port, or empty for automatic
autoStart	Start when Flarebox opens
autoRestart	Restart after a crash, up to 3 times a minute
openOnReady	Open in the browser when the server is ready
env	[{ "key", "value" }] environment variables for the dev server. Plain text: put secrets in .dev.vars
links	[{ "label", "path" }] quick-link buttons
wranglerEnv	The --env name
remote	Run with --remote
deployScript	A package.json script to deploy with, instead of wrangler deploy
accountId	Passed as CLOUDFLARE_ACCOUNT_ID. 32 lowercase hex characters

%APPDATA%\Flarebox\flarebox.json

{
  "roots": ["C:\\Users\\you\\Sites"],
  "pinned": [],
  "hidden": [],
  "projects": {
    "c:\\users\\you\\sites\\aurora-api": {
      "script": null,
      "port": 8787,
      "autoStart": true,
      "autoRestart": true,
      "openOnReady": false,
      "env": [],
      "links": [{ "label": "Admin", "path": "/admin" }],
      "wranglerEnv": null,
      "remote": false,
      "deployScript": null,
      "accountId": null
    }
  },
  "app": {
    "theme": "system",
    "notifyOnCrash": true,
    "launchAtLogin": false,
    "cloudflareReadOnly": false,
    "cloudflareAlerts": true,
    "pqRecheck": true
  }
}

Environment variables

Variable
FLAREBOX_DATA_DIR	Use this folder instead of %APPDATA%\Flarebox
FLAREBOX_CLOUDFLARED	Path to cloudflared.exe, if it isn’t found on its own

The window

Size and position are remembered between runs. The app starts hidden in the tray when launched at login.