.env settings

The web installer writes backend/.env for you (app URL, database, admin account). Most other settings are saved from the admin dashboard, so you rarely edit the file by hand. When you do, run php artisan config:cache afterwards; with a cached config, changes to .env are ignored until you do.

The full list, with comments, is in backend/.env.example.

App

Setting	What it does
APP_NAME	Your marketplace’s name in emails and page titles.
APP_ENV	production on a live server, local on your own computer.
APP_KEY	The encryption key. The installer generates it; never change it on a live site (saved secrets and sessions would stop working).
APP_DEBUG	Always false on a live server: debug pages show your settings and queries to visitors.
APP_URL	Your site’s address with https://, for example https://yourdomain.com. Links in emails and the apps’ image URLs use it.
APP_TIMEZONE	Leave it at UTC. Each market has its own time zone (Admin → Markets → Market List).
APP_LOCALE	The default language when a visitor’s language isn’t available.
DEMO_MODE	Leave it false. It is only for a public demo site: it blocks settings, accounts, uploads and deleting.
TRUSTED_PROXIES	Behind Cloudflare or a load balancer, set it to the proxy’s IP ranges (or *), so visitors get their own IP for rate limits and sign-in lockouts.
SESSION_SECURE_COOKIE	true on an HTTPS site.

Database

DB_CONNECTION=mysql with DB_HOST, DB_PORT, DB_DATABASE, DB_USERNAME and DB_PASSWORD. The installer fills these in from its Database screen.

Queue worker and scheduler

Setting	What it does
QUEUE_CONNECTION	database (works everywhere, the default) or redis if your server has Redis.
BROADCAST_QUEUE	The queue realtime updates use (realtime). Run the worker with --queue=realtime,default.
BROADCAST_SYNC	true sends realtime updates without the queue worker, for shared hosting (Settings → Realtime → Send without the queue worker).
CACHE_STORE	database by default, redis if available.

The scheduler has no setting: it is one cron job. The worker is a process that keeps running. Both are described in Server setup.

Firebase

The service account is normally pasted in Admin → Settings → Integrations → Firebase Admin SDK (Firebase). The .env settings are a fallback for servers where you’d rather keep the file on disk:

Setting	What it does
FIREBASE_CREDENTIALS	Full path to the service account JSON file, outside public/.
FIREBASE_PROJECT	Leave it at app.
FIREBASE_WEB_API_KEY, FIREBASE_WEB_AUTH_DOMAIN, FIREBASE_WEB_PROJECT_ID, FIREBASE_WEB_APP_ID	The store web panel’s sign-in, only used when nothing is saved in Admin → Settings → Integrations → Store panel sign-in.

Realtime (Reverb or Pusher)

Saved from Admin → Settings → Realtime, which writes these lines. See Realtime for the full setup.

Setting	What it does
BROADCAST_CONNECTION	reverb (self-hosted, included), pusher (hosted), or log to turn realtime off.
REVERB_APP_ID, REVERB_APP_KEY, REVERB_APP_SECRET	Reverb’s keys. Generated when you pick Reverb in the admin and save.
REVERB_HOST, REVERB_PORT, REVERB_SCHEME	The public address the apps and browsers connect to, for example ws.yourdomain.com, 443, https.
REVERB_SERVER_HOST, REVERB_SERVER_PORT	Where php artisan reverb:start listens on the server, for example 127.0.0.1 and 8080.
PUSHER_APP_ID, PUSHER_APP_KEY, PUSHER_APP_SECRET, PUSHER_APP_CLUSTER	Your Pusher Channels app’s keys and cluster.

Email

Saved from Admin → Settings → Email delivery (Email): MAIL_MAILER, MAIL_HOST, MAIL_PORT, MAIL_USERNAME, MAIL_PASSWORD, MAIL_SCHEME, MAIL_FROM_ADDRESS, MAIL_FROM_NAME.

Payment gateways and webhooks

Gateway keys are not in .env. Each gateway is set up in Admin → Settings → Payment gateways, where its card shows the webhook URL to add in the gateway’s dashboard, in the form https://yourdomain.com/api/payments/webhook/<gateway> (for example …/webhook/stripe). The webhook secret the gateway gives you is pasted back into the same card. Step by step, per gateway: Payments.

AI features

GEMINI_API_KEY or OPENAI_API_KEY, only if you’d rather not save the key in Admin → Settings → AI. A key saved in the admin wins. See AI features.

Website app links

MARKETING_CUSTOMER_IOS_URL, MARKETING_CUSTOMER_ANDROID_URL and the same for SELLER and RIDER: your App Store and Google Play links on the public website. Empty hides the badge (Branding).

Logs and limits

Setting	What it does
LOG_STACK, LOG_DAILY_DAYS	One log file per day in storage/logs/, kept for this many days.
LOG_LEVEL	error on a busy live site keeps logs small.
SANCTUM_EXPIRATION	How long an app sign-in lasts, in minutes (60 days by default). The apps sign in again by themselves.
RATE_LIMIT_SCALE	Multiplies every API rate limit. Keep it at 1.