Environment variables

The complete reference. Values come from .env; the authoritative list is .env.example plus config/cbox-id.php (this app) and the framework config it merges from (cboxdk/laravel-id). Run php artisan cbox-id:doctor any time to have the security-critical ones checked for you.

Identity platform (required)

Environments (multi-plane hosting)

An environment is the hard identity boundary — its own users, signing keys, and issuer — resolved per request from the host.

Self-service signup

Note that a self-serve signup provisions the workspace, its owner and its first project immediately, but its environment only once the owner confirms their email address — so an unverified signup never stands up a routable IdP. Nothing configures this; it is how self-serve signup works. See Adaptive risk.

Bot protection (CAPTCHA)

Optional. Wires Cloudflare Turnstile in as the CAPTCHA for a signup the risk scorer challenges (it is never shown to everyone). Both keys must be set for the feature to exist at all: with either missing, no widget renders, no Cloudflare script is loaded, the CSP keeps its strict same-origin script-src, and signup behaves exactly as it does without the feature. The challenge only bites when RISK_MODE=enforce.

Enterprise self-serve (SSO, SCIM & Admin Portal)

Gate the self-serve SSO/SCIM screens on a billing-fed entitlement, and tune the external IT-admin setup link. See Enterprise self-serve for the full story.

Branding

Override the wordmark/hero without editing Blade.

CBOX_ID_BRAND_NAME is also the product name in the hosted emails and on the error pages.

Languages

The languages used by the hosted pages (sign-in, consent, Admin Portal) and the emails they send. The admin console is always English. An environment can override both values in its own settings. See the languages guide.

Login lockout

On by default since laravel-id 1.22: a person whose password is guessed wrong too often inside the window is locked out for a while, then unlocked on their own — never until an administrator intervenes, which would hand anyone who knows an address a way to lock its owner out. A threshold set in the console's Authentication policy (lockoutThreshold on the environment or an organization) wins over the default; the window and duration are deployment-wide only.

Every failure is on the audit trail (user.sign_in_failed), and the lock itself is user.locked_out.

Sessions

Session lifetime knobs applied by the identity engine (in addition to the standard Laravel SESSION_* keys below).

OAuth / OIDC endpoint policy

These are read as documented. Published config is merged key by key, not block by block, so this app's partial oauth and webauthn blocks — it pins authorization_endpoint_path, rp_id and origin, which are properties of this app's routes rather than of a deployment — override only those keys and leave every framework default beside them intact.

This was not always true. Laravel's mergeConfigFrom is a shallow array_merge, so before cboxdk/laravel-id v0.57.0 each partial block replaced the framework's entirely and every variable below was silently inert. If you are on an older framework release, they still are. Confirm what is actually in effect:

php artisan tinker --execute="var_dump(config('cbox-id.oauth'), config('cbox-id.webauthn'));"

A regression test (tests/Feature/PackageConfigDefaultsTest.php) asserts that no package default is left unreachable at any depth, so this cannot silently regress.

Webhooks

Delivery is queued, not inline — see the note on QUEUE_CONNECTION under Standard Laravel keys. Without a running worker nothing is delivered and nothing errors.

Log streams (SIEM)

Log streams need nothing configured to ship to an HTTP collector, Datadog, Google Cloud Storage, or an Amazon S3 bucket with the customer's own access key. These three are only for S3 through an assumed role, where the customer stores no secret with you: their IAM role trusts your AWS principal and requires the stream's external ID, and the platform calls sts:AssumeRole with the identity below.

The IAM user needs exactly one permission and nothing else, because it can do nothing on its own — every write happens as the customer's role:

{
  "Version": "2012-10-17",
  "Statement": [{ "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": "*" }]
}

Narrow Resource to arn:aws:iam::*:role/<a naming convention> if you ask customers to name their roles one way. The SIEM package's other settings (SIEM_AWS_STS_ENDPOINT, SIEM_AWS_STS_REGION, SIEM_AWS_ROLE_DURATION, SIEM_GCS_TOKEN_URI, SIEM_DATADOG_SOURCE, SIEM_DATADOG_SERVICE) default correctly for AWS, Google and Datadog; see laravel-siem's configuration.

Domain-event outbox

Every subscriber in the platform hangs off the outbox relay — webhooks, usage metering, outbound provisioning, token revocation on role change. The relay itself is scheduled (see Scheduled work); these tune it.

Outbound provisioning (SCIM push)

Inbound federation

External actions (hooks)

Synchronous HTTP callouts during a flow — a host-owned decision point inside token issuance and login.

Access control (RBAC and app manifests)

Undeclared key: cbox-id.access_control.schedule. The hourly manifest re-pull (cbox-id:app-manifests:sync) is registered only when this config value is true, and it is read with a hard-coded true fallback — but it is declared in neither config file and has no CBOX_ID_ variable, so .env cannot turn it off. To disable the hourly pull you must set cbox-id.access_control.schedule to something other than true in config/cbox-id.php itself. Note the comparison is strict: the string "false" is not true, so any non-true value disables it.

One-time passcodes (OTP)

SAML identity provider (this platform AS the IdP)

Published in /sso/saml/idp/metadata and consumed by every downstream service provider that federates to you.

Data retention (pruning)

cbox-id:prune sweeps expired rows out of the operational tables. Values are retention in days, counted from each table's own expiry/creation column, and the sweep deletes in chunks so a first run on a never-swept table is not one enormous transaction.

An empty value disables pruning for that table — it does not fall back to the default. CBOX_ID_PRUNE_EVENTS= in .env resolves to '', and the pruner treats '' (like null and false) as "retention disabled" and skips the table entirely, forever. Only a numeric value sets a retention; a non-numeric, non-empty value falls back to the built-in default. If you mean the default, delete the line — do not leave it blank. Check with php artisan cbox-id:prune --dry-run, which reports each table as pruned or skipped.

audit_logs is deliberately not prunable and has no key. The audit trail is the evidentiary record; it is retained by export/archival policy, not by a sweep that can be misconfigured into deleting it.

Scheduled work

Every one of these needs schedule:run (or schedule:work) actually running — see Deployment. They are on by default; setting one to false removes that command from the schedule with no other signal.

The hourly app-manifest re-pull is scheduled too, but has no environment variable — see the undeclared-key note under Access control.

Token vault, usage metering and user API tokens

Trusted devices (push)

The phone-as-authenticator module: approval pushes and security alerts. Off by default — a deployment with no mobile app has no devices to notify. See Trusted devices for how the pieces fit together.

REST management API rate limits

Buckets are keyed on the API key, not the caller's IP — a customer whose CI egresses through a shared NAT gets its own allowance instead of sharing one with every other tenant behind that address. Each value is requests per minute, per credential.

A throttled request returns 429 with the standard { "error": "rate_limited", "message": … } envelope plus Retry-After and the X-RateLimit-* headers.

Risk scoring

Reverse proxy

Security posture (defaults you should keep)

These make the deployment safe to expose. cbox-id:doctor flags THREE of them in production — APP_DEBUG, SESSION_SECURE_COOKIE and SESSION_ENCRYPT. The rest of this table is yours to hold: nothing checks them for you, and a green doctor is not a statement about SESSION_SAME_SITE, HASH_DRIVER or SESSION_DRIVER.

Standard Laravel keys

The usual APP_KEY, DB_*, REDIS_*, MAIL_* apply as in any Laravel app — but two of them carry more weight here than the framework defaults suggest:

• CACHE_STORE should be redis in anything but a throwaway install. The platform leans hard on the cache: JWKS and verification keys, host → environment resolution on every request, the entitlement hot path, and the active inline-hook set on every token mint. On the database store each of those becomes a query against the cache table — the very round trip the caching exists to remove — so database quietly undoes it and adds write contention on top. database is the zero-dependency default for a first php artisan serve, and nothing more. docker-compose.yml already uses Redis.
• QUEUE_CONNECTION is not cosmetic. Webhook delivery and back-channel logout are dispatched to the queue, so a deployment without a running queue manager (php artisan queue:autoscale) delivers nothing and raises no error — deliveries simply sit Pending until the retry sweep re-drives them into the same empty queue. See Queue workers for the process a real deployment runs, and CBOX_ID_WEBHOOKS_QUEUE_CONNECTION / CBOX_ID_WEBHOOKS_QUEUE above if you isolate egress onto its own queue: the workers follow it.

Queue workers

The queue manager (cboxdk/laravel-queue-autoscale) and the job monitor (cboxdk/laravel-queue-monitor). Most of their settings are values in config/queue-autoscale.php and config/queue-monitor.php, deliberately not environment variables; these are the ones a deployment sets. See Queue workers.

APP_KEY is required and distinct from CBOX_ID_CRYPTO_KEY — the former protects Laravel's own encryption/cookies, the latter protects the identity platform's sealed secrets. Both must be backed up; neither is recoverable if lost.

Signing keys are not env vars

Signing keys live in the database, are minted on install/first use, and are rotated with cbox-id:keys:rotate (see Operations). The public half is published at /.well-known/jwks.json.

Optional subsystems

• Risk scoring (cboxdk/laravel-risk) — bot/abuse scoring on signup/login. Ships in monitor mode (RISK_MODE, above); see the package docs to enforce.
• Social/enterprise SSO — Socialite + connection config per organization; managed from the admin console, not env.

Where to go next

• Operations — key backup/rotation, upgrades, break-glass.
• Framework config reference: config/cbox-id.php in the cboxdk/laravel-id package (installation guide).