Environment variables

Backend (backend/.env)

Application

Variable	Example	Description
APP_NAME	ExchangePro	Application name in emails
APP_VERSION	1.0.0	Product version (Admin → Extra → Application info)
APP_TIMEZONE	UTC	PHP timezone for displayed dates/times (list)
APP_ENV	production	local for dev
APP_KEY	(generated)	php artisan key:generate - required; missing key causes 500 on SPA requests
APP_DEBUG	false	Must be false in production
APP_URL	https://api.yourdomain.com	Public URL of Laravel (public/)
FRONTEND_URL	https://yourdomain.com	Nuxt site URL (password reset links, default CORS origin, Sanctum stateful domain)
CORS_ALLOWED_ORIGINS	(optional)	Comma-separated frontend origins with scheme - CORS

Database

Variable	Description
DB_CONNECTION	mysql, mariadb, or sqlite
DB_HOST	Database host
DB_PORT	3306 for MySQL
DB_DATABASE	Database name
DB_USERNAME	Database user
DB_PASSWORD	Database password

Session & Sanctum

Variable	Local dev	Production (subdomains)	Description
SESSION_DRIVER	database	database	Requires sessions table from migrations
SESSION_DOMAIN	null	.yourdomain.com	Required when API and frontend use different subdomains
SESSION_SECURE_COOKIE	(empty)	true	Send cookies only over HTTPS
SESSION_SAME_SITE	lax	lax	Keep lax for same root domain (e.g. api. + apex)

Sanctum stateful domains are derived from FRONTEND_URL in config/sanctum.php - see CORS & Sanctum.

Queue & cache

Variable	Default	Description
QUEUE_CONNECTION	database	Use redis for higher throughput
CACHE_STORE	database	Application cache

Mail

Variable	Description
MAIL_MAILER	smtp, log, etc.
MAIL_HOST	SMTP host
MAIL_PORT	587 (TLS) common
MAIL_USERNAME	SMTP user
MAIL_PASSWORD	SMTP password
MAIL_FROM_ADDRESS	Sender email
MAIL_FROM_NAME	Sender name

See Mail.

OAuth (optional overrides)

Configured primarily in admin UI; optional env fallbacks in config/services.php:

Variable	Provider
GOOGLE_CLIENT_ID	Google
GOOGLE_CLIENT_SECRET	Google
FACEBOOK_CLIENT_ID	Facebook
FACEBOOK_CLIENT_SECRET	Facebook

Admin settings override runtime via SocialAuthController.

---

Frontend (frontend/.env)

Variable	Example	Description
FRONTEND_URL	https://yourdomain.com	Canonical frontend origin
API_URL	https://api.yourdomain.com	Laravel API origin (no /api suffix)

These map to runtimeConfig.public in nuxt.config.ts:

runtimeConfig: {
  public: {
    baseUrl: FRONTEND_URL,
    apiUrl: API_URL,
    sanctum: { baseUrl: API_URL },
  },
},

Rebuild the frontend after changing API_URL or FRONTEND_URL (npm run build).

---

Cross-app checklist

Backend	Frontend	Must match
APP_URL	API_URL	Same origin
FRONTEND_URL	FRONTEND_URL	Same public site URL
CORS_ALLOWED_ORIGINS (or FRONTEND_URL)	FRONTEND_URL	Frontend origin allowed

When using separate subdomains, also set on the backend:

SESSION_DOMAIN=.yourdomain.com
SESSION_SECURE_COOKIE=true
SESSION_SAME_SITE=lax

---

Example production pair (subdomains)

Real-world layout (replace xorinlab.com with your domain):

Backend .env:

APP_ENV=production
APP_DEBUG=false
APP_KEY=base64:...
APP_URL=https://api-exchangepro.xorinlab.com
FRONTEND_URL=https://exchangepro.xorinlab.com

SESSION_DRIVER=database
SESSION_DOMAIN=.xorinlab.com
SESSION_SECURE_COOKIE=true
SESSION_SAME_SITE=lax

Frontend .env:

FRONTEND_URL=https://exchangepro.xorinlab.com
API_URL=https://api-exchangepro.xorinlab.com

Optional - allow both apex and www:

CORS_ALLOWED_ORIGINS=https://exchangepro.xorinlab.com,https://www.exchangepro.xorinlab.com

After editing backend .env:

php artisan config:clear
php artisan config:cache

---

Example local development

Backend .env:

APP_URL=http://localhost:8000
FRONTEND_URL=http://localhost:4000
SESSION_DOMAIN=null
SESSION_SECURE_COOKIE=
SESSION_SAME_SITE=lax

Frontend .env:

FRONTEND_URL=http://localhost:4000
API_URL=http://localhost:8000