.env Configuration

The .env file is where you define all of the environment-specific variables for your ElmapiCMS application.

Application Settings

Application Name

This sets the name of your application, which is used in various places like page titles.

APP_NAME=ElmapiCMS

Application URL

This should be the full URL where your application is hosted. It is used to generate asset URLs. For local development, this is typically http://localhost. In production, it should be your public domain (e.g., https://elmapicms.com).

APP_URL=http://localhost

Debug Mode

This should be true in local development to show detailed error messages. For security reasons, this must be set to false in production.

APP_DEBUG=true

Maximum File Size

This sets the maximum size for a single file upload. The value should be in megabytes (e.g., 2M for 2 megabytes).

MAX_FILE_SIZE=2M

Note that this value is also limited by your server's PHP configuration (upload_max_filesize and post_max_size). Your server's setting will take precedence if it is lower than MAX_FILE_SIZE.

For large files on S3/Spaces, prefer direct upload (ASSET_DIRECT_UPLOAD) so PHP limits do not apply to the object transfer.

Content Versions

Optional retention for immutable publish versions:

CONTENT_VERSIONS_PER_ENTRY=-1

• -1 (default) — unlimited versions per entry
• Positive integer — keep at most that many versions; older ones are pruned (the currently published version is always kept)

See Creating & Editing Content and the versions API.

Direct Asset Upload (S3 / Spaces)

When the project storage disk is s3, you can enable browser/client uploads straight to the bucket (presigned PUT and multipart), bypassing PHP upload limits:

ASSET_DIRECT_UPLOAD=false
# ASSET_DIRECT_UPLOAD_URL_TTL=15
# ASSET_DIRECT_UPLOAD_MULTIPART_THRESHOLD=104857600
# ASSET_DIRECT_UPLOAD_MULTIPART_PART_SIZE=10485760

• Default false keeps classic POST /api/files (and dashboard upload) for local/public disks
• Bucket CORS must allow your app origin and PUT
• Image finalize runs on a queue worker (ProcessDirectUploadedImageJob)

Details: Asset Library and Direct Upload API.

Authentication

End-user authentication for headless apps. Defaults work without setting these:

# PROJECT_AUTH_ISSUER="${APP_URL}"
# PROJECT_AUTH_ACCESS_TOKEN_TTL_MINUTES=15
# PROJECT_AUTH_REFRESH_TOKEN_TTL_DAYS=30
# PROJECT_AUTH_MAX_SESSIONS_PER_USER=25
# PROJECT_AUTH_VERIFICATION_TOKEN_TTL_MINUTES=60

Authentication JWTs identify the user only. Use project Sanctum tokens for CMS content and admin APIs. See the full list in Authentication configuration.

Webhooks

Outbound webhooks require HTTPS by default (SSRF hardening). For local HTTP receivers only:

# WEBHOOK_ALLOW_INSECURE_HTTP=false

Set to true only in development. Production should use HTTPS endpoints. See Webhooks and queue setup.

API Rate Limit

Maximum requests per minute for the main /api route group (default 300):

API_RATE_LIMIT_PER_MINUTE=300

Raise this locally if frontend template builds hit 429 Too Many Requests. After changing the value, run php artisan optimize:clear. See Troubleshooting.

Database Configuration

These settings define how your application connects to its database. Create the database during installation or deployment. Update the variables below to match your credentials.

DB_CONNECTION=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_DATABASE=elmapicms
DB_USERNAME=root
DB_PASSWORD=

Queue Driver

This setting determines how background jobs are processed (webhooks, direct-upload image finalize, and other queued work).

QUEUE_CONNECTION=sync

• sync: (Default) Jobs run immediately in the same process. This is simple for development but can slow down web requests.
• database: Jobs are stored in the database and processed by a separate queue worker. This is the recommended driver for production environments to ensure webhooks and image processing run reliably without impacting user experience.

For more information on setting up a queue worker, see the Webhook Setup guide.