Configuration reference - Shortspan documentation

Application

Variable	Does	Notes
`APP_NAME`	Displayed name.	Also the default mail sender name.
`APP_ENV`	Environment.	`production` enables the strict checks - chiefly, refusing to run without a root key.
`APP_KEY`	Signs cookies and sessions.	`php artisan key:generate`. Not the secret store root.
`APP_DEBUG`	Stack traces.	Must be `false` in production. `true` leaks configuration.
`APP_URL`	Absolute base URL.	Used in emails and canonical URLs. Get it wrong and every link in every email is wrong.

Encryption

Variable	Does	Notes
`SHORTSPAN_MASTER_KEY`	Roots the secret store.	Required in production. No recovery if lost. `php artisan encryption:generate-key`.
`PASSKEYS_USER_HANDLE_SECRET`	Derives passkey user handles.	Defaults to `APP_KEY`, which couples passkey identity to a rotatable key. Set it explicitly.

Database, cache, queue, sessions

Variable	Does
`DB_CONNECTION`	`pgsql`, `mysql`, or `sqlite`. PostgreSQL for production.
`DB_HOST` / `DB_PORT` / `DB_DATABASE` / `DB_USERNAME` / `DB_PASSWORD`	Connection details.
`CACHE_STORE`	`database` by default. `redis` once it matters.
`QUEUE_CONNECTION`	`database` by default. Must not be `sync` - notifications are queued.
`SESSION_DRIVER`	`database` by default.
`SESSION_LIFETIME`	Minutes. Default 120.

Trusted proxies

Value	When
unset	Behind Cloudflare. Trusts their published ranges, which is the default.
`*`	A PaaS, or an origin only the platform proxy can reach.
`10.0.0.0/16`	A load balancer inside a private network.
`127.0.0.1`	nginx rewriting the address itself.

php artisan proxies:check diffs the built-in Cloudflare list against the live one. Worth running on a schedule - a stale list does not fail loudly, it silently starts recording edge addresses in your audit log.

Mail

Variable	Does
`MAIL_MAILER`	`resend`, `smtp`, or `log`. `log` sends nothing.
`RESEND_API_KEY`	For the Resend transport.
`MAIL_HOST` / `MAIL_PORT` / `MAIL_USERNAME` / `MAIL_PASSWORD`	For SMTP.
`MAIL_FROM_ADDRESS`	Default sender. Must be on the verified domain.
`MAIL_FROM_NAME`	Default sender name.
`MAIL_MARKDOWN_THEME`	`shortspan` for the branded design, `default` for Laravel's stock look.

Individual messages override the sender per category - security, support, privacy, sales - from config/company.php. Those addresses must accept mail: several templates invite a reply.

bash

php artisan shortspan:preview-mail

Renders every transactional email with sample data to storage/app/mail-previews/index.html. The fastest way to check the branding after changing the theme.

Documentation site

Variable	Does
`DOCS_DOMAIN`	Hostname the documentation answers on. Unset, it mounts at `/docs` on the application domain instead.
`DOCS_URL`	Absolute origin for canonical URLs and the sitemap. Include the port if it is non-standard.
`DOCS_PATH`	Mount path when no domain is configured. Defaults to `docs`.
`DOCS_INDEXABLE`	`false` serves a blanket robots.txt disallow. Set it on anything that is not the real documentation site.

Point a second server block at the same document root with a server_name matching DOCS_DOMAIN. Routing is by hostname; nothing else differs.

CLI releases

Variable	Does
`SHORTSPAN_RELEASE_TOKEN`	Bearer token the build pipeline publishes with. Unset closes the endpoint, which is correct for any deployment that does not cut releases.
`SHORTSPAN_ARTIFACT_HOSTS`	Comma-separated hosts a download URL may point at. Defaults to `github.com,objects.githubusercontent.com`.
`SHORTSPAN_UPDATE_CHECK_TTL_HOURS`	How long a CLI may cache an update check. Default 24.

Workspaces and onboarding

Variable	Does
`SHORTSPAN_INVITATION_TTL_DAYS`	How long an invitation stays valid. Default 7.
`SHORTSPAN_TERMS_VERSION`	Recorded against every acceptance. Bump it - as a date - when the terms materially change.

Reserved workspace slugs live in config/workspaces.php. Add to that list if you introduce a hostname or route that a workspace slug could collide with.

Billing

Variable	Does
`PADDLE_API_KEY`	Paddle API key.
`PADDLE_CLIENT_SIDE_TOKEN`	Client-side token for the checkout.
`PADDLE_WEBHOOK_SECRET`	Verifies incoming webhooks.
`PADDLE_SANDBOX`	`true` against the sandbox.
`PADDLE_PRICE_PRO` / `PADDLE_PRICE_TEAM`	Price ids for the paid tiers.

Company identity

COMPANY_* variables drive config/company.php, which is the single source for the entity details rendered in the footer, the contact page, all eight legal documents, and the email templates.

Variable	Does
`COMPANY_LEGAL_NAME`, `COMPANY_DOMAIN`	Entity identity.
`COMPANY_ADDRESS_*`	Registered address.
`COMPANY_JURISDICTION`, `COMPANY_GOVERNING_LAW`	Governing law for the Terms.
`COMPANY_EMAIL_*`	The role addresses: support, sales, security, privacy, legal, abuse, dpo.
`COMPANY_LINK_*`	Docs, status page, and social profiles.
`COMPANY_LEGAL_EFFECTIVE`, `COMPANY_LEGAL_UPDATED`	Dates shown on every policy and in the sitemap.