Configuration

All configuration lives in two places:

  1. .env — server-level secrets and connection strings (this page)
  2. Admin → Settings — everything a store manager should touch day-to-day (business info, payment toggles, email sender, storage provider, AI keys). See the Settings guide.

Many integrations can be configured in either place: seeding reads the .env values once as defaults, and the admin Settings pages let you change them later without touching the server.

After editing .env in production

Re-run php artisan config:cache so the changes take effect.

Core

KeyDescription
APP_NAMEYour store name (used in emails and titles)
APP_ENVproduction on a live site
APP_DEBUGMust be false in production — preflight enforces this
APP_URLFull public URL, e.g. https://shop.example.com
APP_KEYSet by php artisan key:generate, or written for you by the setup wizard — never share it
APP_INSTALLEDfalse sends every request to the setup wizard; the wizard sets it to true when it finishes. Set it back to false to re-run the installer
DEMO_MODEtrue turns the store into a public read-only showcase — see below

Demo mode

Set DEMO_MODE=true to publish the store as a showcase anyone can click through without being able to damage it:

  • Nothing is hidden. Every page, button and action stays visible and clickable — admin included — so visitors see the whole product.
  • Writes are rejected. Creating, editing and deleting data returns a "demo mode is active" message instead. This is a default-deny rule applied to every write request, not a per-screen setting.
  • Sign-up and purchase still work. Visitors can register, sign in, add addresses, check out and pay through the gateway, so the buying flow can be demonstrated end to end.
  • Contact details are masked. Emails and phone numbers render as s***@*** / +***78 so a public demo cannot be scraped for real PII.
  • A demo bar is pinned to the bottom of every page, so nobody mistakes the demo for their live store.

The flag is read at runtime: flip it in .env, run php artisan config:clear (only needed if you cached the config), and the next request picks it up. No front-end rebuild is required.

Database

KeyDescription
DB_CONNECTIONmysql
DB_HOST / DB_PORTUsually 127.0.0.1 / 3306
DB_DATABASE / DB_USERNAME / DB_PASSWORDYour database credentials

First admin account

Only used by the CLI install — the setup wizard asks for these on screen instead and ignores the keys. Read once by the seeder; see CLI installation step 6.

KeyDescription
ADMIN_EMAILEmail for the first super admin (default [email protected])
ADMIN_PASSWORDPassword for it — leave empty to get a generated one printed at seed time

Mail

Transactional email (order confirmations, password resets) and marketing campaigns:

KeyDescription
MAIL_MAILERsmtp for real delivery, log for testing
MAIL_HOST / MAIL_PORTYour SMTP server
MAIL_USERNAME / MAIL_PASSWORDSMTP credentials
MAIL_FROM_ADDRESS / MAIL_FROM_NAMESender identity

SMTP can also be configured from Admin → Settings → Email Config, including a test-send button.

Payments

Cash on Delivery works with zero configuration. Online gateways activate when their keys are present — via .env at seed time or later in Admin → Settings → Payments.

Stripe

KeyDescription
STRIPE_SECRET_KEYsk_live_… (or sk_test_…)
STRIPE_PUBLISHABLE_KEYpk_live_…
STRIPE_WEBHOOK_SECRETwhsec_… — register the webhook in your Stripe dashboard
STRIPE_CHARGE_CURRENCIESCurrencies Stripe should charge in

PayPal

KeyDescription
PAYPAL_ENABLEDtrue / false
PAYPAL_MODEsandbox or live
PAYPAL_CLIENT_ID / PAYPAL_CLIENT_SECRETREST API credentials
PAYPAL_WEBHOOK_IDFor webhook signature verification

bKash (Bangladesh)

KeyDescription
BKASH_USERNAME / BKASH_PASSWORDMerchant credentials
BKASH_APP_KEY / BKASH_APP_SECRETApp credentials
BKASH_SANDBOXtrue for testing

SSLCommerz (Bangladesh)

KeyDescription
SSLCOMMERZ_STORE_ID / SSLCOMMERZ_STORE_PASSWORDStore credentials
SSLCOMMERZ_SANDBOXtrue for testing
SSLCOMMERZ_*_URLInit / validation / refund / callback / IPN endpoints

Register your webhooks

Each gateway needs its webhook/IPN URL registered in the provider's dashboard so payment confirmations reach your store. The exact URLs are listed in deploy/DEPLOYMENT.md § "Webhooks to register with each provider".

Media storage

Local disk works out of the box. For S3 or DigitalOcean Spaces:

KeyDescription
STORAGE_PROVIDERlocal, s3, …
STORAGE_ACCESS_KEY_ID / STORAGE_SECRET_ACCESS_KEYProvider credentials
STORAGE_REGION / STORAGE_BUCKET_NAMEBucket location
STORAGE_ENDPOINT / STORAGE_PUBLIC_URLFor S3-compatible providers (Spaces, MinIO)
STORAGE_FORCE_PATH_STYLEtrue for most S3-compatible services

Also configurable in Admin → Settings → Storage.

AI (all optional)

Claude — text features

Product copy, review moderation, support chatbot, fraud scoring, email copy, merchandising insights:

KeyDescription
ANTHROPIC_API_KEYYour Anthropic API key — get one at console.anthropic.com
AI_MODELModel id (a sensible default ships in .env.example)
AI_EFFORT / AI_MAX_TOKENS / AI_CACHE_TTLTuning knobs — defaults are fine
AI_EMBEDDINGS_PROVIDEROptional semantic search provider
VOYAGE_API_KEY / VOYAGE_MODELOnly if using Voyage embeddings

AI Studio — image & video generation

Configure any subset; providers appear in the AI Studio UI when their key is present:

KeyProvider
GEMINI_API_KEYGoogle Gemini
OPENAI_API_KEYOpenAI
FAL_KEYFAL
REPLICATE_API_TOKENReplicate

You pay providers directly

AI usage is billed by each provider to your account. StoreMine never proxies or meters your AI traffic.

Shipping & currency

KeyDescription
STEADFAST_BASE_URLSteadfast courier API (Bangladesh) — credentials go in Admin → Settings → Courier
FX_PROVIDER / FX_BASE_URLExchange-rate source for php artisan currency:refresh (default: exchangerate.host)

Queue & scheduler

KeyDescription
QUEUE_CONNECTIONdatabase by default; redis for higher volume
CRON_SECRETProtects HTTP-triggered scheduled endpoints

Remember: the queue worker and the cron entry from After the wizard must be running in production — campaigns, emails and AI jobs all depend on them.