.env.example

APP_NAME=Laravel
APP_ENV=local
APP_KEY=
APP_DEBUG=true
APP_URL=http://localhost

LOG_CHANNEL=stack
LOG_LEVEL=debug

DB_CONNECTION=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_DATABASE=laravel
DB_USERNAME=root
DB_PASSWORD=

BROADCAST_DRIVER=log
CACHE_DRIVER=file
QUEUE_CONNECTION=sync
SESSION_DRIVER=file
SESSION_LIFETIME=120

MEMCACHED_HOST=127.0.0.1

REDIS_HOST=127.0.0.1
REDIS_PASSWORD=null
REDIS_PORT=6379

MAIL_MAILER=smtp
MAIL_HOST=mailhog
MAIL_PORT=1025
MAIL_USERNAME=null
MAIL_PASSWORD=null
MAIL_ENCRYPTION=null
MAIL_FROM_ADDRESS=null
MAIL_FROM_NAME="${APP_NAME}"

AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_DEFAULT_REGION=us-east-1
AWS_BUCKET=

PUSHER_APP_ID=
PUSHER_APP_KEY=
PUSHER_APP_SECRET=
PUSHER_APP_CLUSTER=mt1

MIX_PUSHER_APP_KEY="${PUSHER_APP_KEY}"
MIX_PUSHER_APP_CLUSTER="${PUSHER_APP_CLUSTER}"

# Single sign-on (social login). Set to "true" to show the configured buttons on
# the login page. Individual providers appear only when their CLIENT_ID is set.
ENABLE_SOCIAL_LOGIN=false

# Generic OpenID Connect SSO. Works against any OIDC issuer via discovery
# ({OIDC_ISSUER}/.well-known/openid-configuration): Zitadel, Keycloak, Authentik,
# Entra, Auth0, Okta, Google, etc. The id_token is fully validated (signature via
# the issuer's JWKS with automatic key-rotation, iss, aud/azp, exp, nonce, at_hash)
# and PKCE is used. New users are provisioned from a provider-verified email.
# The callback is derived per request from the host being served, so one instance works
# across every apex/domain it answers on — register each apex's callback with the IdP:
#   {each-apex}/social-auth/openidconnect/callback   and   {each-apex}/social-auth/logout/callback
# Set OIDC_REDIRECT_URI below to pin a single redirect instead of deriving it.
OIDC_ISSUER=
OIDC_CLIENT_ID=
OIDC_CLIENT_SECRET=

# Shown on the sign-in button, as "Sign in with {OIDC_DISPLAY_NAME}".
OIDC_DISPLAY_NAME="OpenID Connect"

# Icon on that button: any Bootstrap Icons class, e.g. bi-key or bi-building.
# Set it empty for a button with no icon at all.
# OIDC_ICON=bi-shield-lock

# Connection overrides:
# OIDC_SCOPES="openid profile email"
# OIDC_REDIRECT_URI=                 # pin one redirect instead of deriving it per host
# OIDC_POST_LOGOUT_REDIRECT_URI=     # where the IdP returns after ending its session

# Claim mapping. Providers disagree over which claim carries which field, so each takes a
# comma-separated list and the first claim actually released wins. The defaults are the
# standard OIDC claims; override only for a provider that differs.
# OIDC_EMAIL_CLAIM=email
# OIDC_USERNAME_CLAIM=preferred_username,nickname
# OIDC_NAME_CLAIM=name
# OIDC_PICTURE_CLAIM=picture
# OIDC_GROUPS_CLAIM=groups

# Provisioning. Defaults match how social login behaved before: an unknown user is created,
# a known email is adopted, and an address the IdP flags unverified is refused.
# OIDC_AUTO_REGISTER=true            # false: only users who already exist may sign in
# OIDC_LINK_EXISTING_USER=true       # false: refuse rather than adopt a matching local account
# OIDC_REQUIRE_VERIFIED_EMAIL=true   # reject sign-in when the IdP flags email unverified
# OIDC_REQUIRE_EMAIL=false           # fail the login when no email is released at all
# OIDC_UPDATE_PROFILE_ON_LOGIN=false # true: the provider's name/picture overwrite local edits

# Authorization. Empty places no restriction; naming a list makes it the allow-list, and it
# is re-checked on every sign-in so access can be withdrawn at the provider.
# OIDC_ALLOWED_GROUPS=               # e.g. linkstack-users,staff
# OIDC_ALLOWED_DOMAINS=              # e.g. example.com,example.org
# OIDC_ADMIN_GROUP=                  # members get the admin role; unset leaves roles alone

# Sign-in flow:
# OIDC_AUTO_LAUNCH=false             # true: /login goes straight to the provider.
#                                    # /login?local=1 still reaches the form
# OIDC_IDP_LOGOUT=false              # true: signing out also ends the session at the
#                                    # provider, and so in every other application using it

# Host header allow-list. Empty trusts the APP_URL domain and its subdomains, which is
# right for a single-domain instance. Serving several apexes from one instance requires
# listing them here — the OIDC callback is derived from the incoming host, so an
# unlisted host is rejected rather than trusted.
#   ALLOWED_HOSTS=bio.example.com,bio.example.org
ALLOWED_HOSTS=

# Who may embed this instance in a frame, written into the CSP frame-ancestors directive.
# Empty sends no directive and embedding is unrestricted. Entries are origins, since
# frame-ancestors matches on origin and ignores any path; 'self' is always included.
#   ALLOWED_FRAME_ORIGINS=https://apps.example.com
ALLOWED_FRAME_ORIGINS=

# Session cookie SameSite policy. Embedding this instance in a frame on another site
# needs "none" (which also requires a secure cookie), otherwise the browser withholds
# the session and the framed page renders logged out. Leave as lax unless embedding.
#   SESSION_SAME_SITE=lax | none | strict
SESSION_SAME_SITE=lax