Website & Admin Panel

.env Reference

The .env file holds your environment settings. The package ships .env.example only — copy it to .env during installation (cp .env.example .env); the install wizard then writes your database credentials, APP_URL and app key into it for you. This page is for the values you may want to change afterwards.

🔑

Most third-party keys (payments, SMS, maps, analytics, AI, social login) are not in .env — you enter them in the admin panel. The .env only covers core app, database, mail and storage.

Application

APP_NAME="Your Brand"
APP_ENV=production
APP_KEY=                 # auto-generated on the first request
APP_DEBUG=false          # MUST be false in production
APP_URL=https://your-domain.com

APP_LOCALE=en
APP_FALLBACK_LOCALE=en

APP_DEBUG

Always false live — true leaks errors to visitors.

APP_URL

Your full HTTPS URL. Used for links, assets and webhooks.

APP_KEY

Encryption key. Written automatically on the first request (the file must be writable); never change it after data exists.

Database

DB_CONNECTION=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_DATABASE=your_db
DB_USERNAME=your_db_user
DB_PASSWORD=your_db_password

Sessions, cache & queue

SESSION_DRIVER=file
SESSION_LIFETIME=120
CACHE_STORE=file
QUEUE_CONNECTION=database

🚫

Leave SESSION_DRIVER and CACHE_STORE on file. The application has to boot before a database exists — that is how the /install wizard is able to run at all. Switching either to database breaks the installer, and .env.example carries the same warning. The queue does use the database (QUEUE_CONNECTION=database), which is correct.

Running Redis? You can point QUEUE_CONNECTION at redis once the site is installed and working.

Mail (SMTP)

📭

.env.example ships MAIL_MAILER=log — so after install, mail is written to the log file, not sent. The normal way to fix that is Admin → Settings → Mail Setting: SMTP details saved there are applied at send time and override .env completely. Only edit the values below if you prefer to configure mail in the file instead.

MAIL_MAILER=smtp
MAIL_HOST=smtp.your-provider.com
MAIL_PORT=465
MAIL_USERNAME=you@your-domain.com
MAIL_PASSWORD=your-mail-password
MAIL_FROM_ADDRESS="no-reply@your-domain.com"
MAIL_FROM_NAME="${APP_NAME}"

Port 465 uses implicit SSL and 587 uses STARTTLS — both are detected automatically, so there is no MAIL_ENCRYPTION setting to add. See Email / SMTP for provider examples and testing.

File storage (optional S3)

FILESYSTEM_DISK=local
# For Amazon S3 / compatible storage:
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_DEFAULT_REGION=us-east-1
AWS_BUCKET=

Local storage is the default. To use S3 see Media Storage (you can also configure it from the admin panel).

Logging & other stock keys

The remaining keys in .env.example are standard Laravel plumbing — all safe to leave at their defaults:

LOG_CHANNEL=stack        # where logs go (stack = storage/logs/laravel.log)
LOG_STACK=single
LOG_LEVEL=debug          # set to error in production (see below)
LOG_DEPRECATIONS_CHANNEL=null

BCRYPT_ROUNDS=12         # password hashing cost
APP_MAINTENANCE_DRIVER=file
APP_FAKER_LOCALE=en_US   # only used by test data generators

SESSION_ENCRYPT=false
SESSION_PATH=/
SESSION_DOMAIN=null      # leave null unless sharing cookies across subdomains

BROADCAST_CONNECTION=log
FILESYSTEM_DISK=local
MAIL_SCHEME=null         # SSL/TLS is auto-detected from the port
VITE_APP_NAME="${APP_NAME}"   # only read at asset build time
CRON_SECRET=             # see Production hardening below

Production hardening

Add these for a live HTTPS site:

APP_URL=https://your-domain.com
SESSION_SECURE_COOKIE=true
LOG_LEVEL=error
CRON_SECRET=paste-a-long-random-string-here

APP_URL

Set it to the https:// address — generated links, assets, e-mails and gateway return URLs all come from this value. There is no separate "force https" switch.

SESSION_SECURE_COOKIE

Cookies only sent over HTTPS.

LOG_LEVEL

error keeps logs lean in production.

CRON_SECRET

Secret key for triggering scheduled tasks over HTTP (/cron/run/…?key=…). Required if you use an external cron service — see Cron & Queue Workers.

♻️

After editing .env, always run php artisan config:clear then php artisan config:cache so changes take effect.

👉

Next: Build & First Run.