Settings

The Settings screen (/evolve/settings) edits two places. Public business configuration (site name, branding, company identity, mail addresses, tracking IDs, consent, site verifications) is saved to the database settings store since 2.18. Secrets, infrastructure and the environment posture stay in the .env of the environment the panel runs on. Both parts are editors for a fixed list of fields, not free-form editors: anything the form submits that is not on the list is dropped.

Tabs

Tab	Cards	Settings store fields	.env keys
General	Control panel, LLM, Frontend, Performance, Localisation	site name, Analytics property ID, panel colour, login image	APP_URL, OPENAI_API_KEY, APP_PAGE_CACHE, EVOLVE_REGION_REMOVE_DEFAULT_PREFIX
Company 2.18	Identity, Address	legal name, brand name, founding date, site logo, street, postal code, locality, region, country, phone, email, profiles (one URL per line)	none
Mail	Sender, Recipients, Mailer	sender name, sender address, reply-to, notification address, alert address	MAIL_MAILER, MAIL_HOST, MAIL_PORT, MAIL_SCHEME, MAIL_USERNAME, MAIL_PASSWORD
Video	Vimeo	none	VIMEO_CLIENT_ID, VIMEO_CLIENT_SECRET, VIMEO_ACCESS_TOKEN, VIMEO_ALBUM_ID
Tracking	Consent, Google, Facebook / Meta, Server-side tracking, Pinterest, LinkedIn, Hotjar	consent policy, cookie banner, consent via CMP, GTM container, GA4 measurement ID, conversion data, Meta pixel, server-side events, Pinterest tag, LinkedIn partner and lead conversion IDs, Hotjar site ID	ANALYTICS_API_SECRET, GOOGLE_MAPS_API_KEY, GOOGLE_GEOCODING_API_KEY, GOOGLE_RECAPTCHA_SITEKEY, GOOGLE_RECAPTCHA_SECRET, GOOGLE_RECAPTCHA_SCORE, FACEBOOK_CONVERSIONS_API_KEY, FACEBOOK_TEST_EVENT_CODE, TRACKING_DEBUG, TRACKING_LEGACY_VARIABLES
SEO 2.18	Site verification	Google, Bing and Pinterest verification codes	none
Packages	one card per enabled module	none	the keys a module registers, for example BLOG_OVERVIEW_PAGE, BLOG_AUTHOR_TYPE, FAQ_OVERVIEW_PAGE, SCOUT24_MEMBER_ID, SHOPIFY_API_VERSION
Developers	Environment, Mail safety, Tracking emit, Protect, Modules, Developers	none	EVOLVE_ENV_TYPE, APP_ENV, APP_DEBUG, EVOLVE_ENV_BANNER, EVOLVE_MAIL_SAFETY, EVOLVE_MAIL_REDIRECT, TRACKING_EMIT, EVOLVE_PROTECT_USER, EVOLVE_PROTECT_PASSWORD, every EVOLVE_MODULE_*
Health	Checks, Oh Dear, Notifications, Retention	none (the effective alert address is shown, it is edited on the Mail tab)	HEALTH_CHECK_* toggles, HEALTH_CHECK_QUEUE (Auto, On, Off), HEALTH_CHECK_EMAIL_RECIPIENT, HEALTH_KEEP_HISTORY_DAYS, HEALTH_NOTIFICATIONS_ENABLED, OH_DEAR_HEALTH_CHECK_SECRET

The Developers tab exists for the developer role only. An admin who submits one of its keys has them dropped, whatever the form sent. See Roles.

Store fields and inheritance

A store field shows the stored value. Its placeholder shows what an empty field inherits from the .env or the project config ("inherits GTM-ABC1234", or "not set"). Emptying a field and saving stores null, and the .env value applies again. Switches in the store (cookie banner, consent via CMP, server-side events) are selects with three options instead of toggles: the first option inherits and names the inherited state ("Inherit: On"), the other two pin On or Off. Consent policy and conversion data have the same inherit option.

The inherit options exist for sites whose .env still carries these values. A new installation sets them in the panel and leaves them out of the .env.

The login image picker shows the stored image only. When the store is empty and the .env sets APP_LOGIN_IMAGE_ID, a line below the picker names the inherited media ID.

Store values are validated before anything is written: the GTM container must look like GTM-…, the GA4 ID like G-…, the panel colour like #RRGGBB, addresses must be valid email addresses, profile lines valid URLs, and the founding date YYYY, YYYY-MM or YYYY-MM-DD. An invalid value saves nothing and shows the error.

Saving store values needs no rebuild of the configuration cache, because stored values are applied on top of the cached config at runtime. Changes are recorded in the activity log in the same settings-changed entry as .env changes, keyed <group>.<property>.

Import hint

While a group stores nothing but the .env or the project config holds a value other than the package default, the General, Tracking and SEO tabs show an info box. It means the site still runs on its .env values for that group. Run the import once to take them over, see Importing existing values.

Consent rule

Opt-in consent needs somebody who can grant it. Saving the policy opt-in with the cookie banner off and the consent via CMP option off is refused with an error at the top of the form, and nothing is written. Inherited values count: an "inherit" policy that resolves to opt-in in the .env is checked the same way. See Tracking and consent.

Secrets

MAIL_PASSWORD, EVOLVE_PROTECT_PASSWORD, OPENAI_API_KEY, VIMEO_CLIENT_SECRET, VIMEO_ACCESS_TOKEN, OH_DEAR_HEALTH_CHECK_SECRET, ANALYTICS_API_SECRET, FACEBOOK_CONVERSIONS_API_KEY and GOOGLE_RECAPTCHA_SECRET are masked in the form. The field shows that a value exists; leaving it untouched keeps it, typing replaces it. Secrets never go into the settings store, because a database table ends up in dumps and database copies.

What stays in the .env

Kind	Examples	Why
Secrets	the keys above	not in a table that travels with database copies
Infrastructure	APP_URL, MAIL_MAILER, MAIL_HOST, MAIL_PORT, MAIL_SCHEME, MAIL_USERNAME	differ per deployment, not per business decision
Posture and switches	EVOLVE_ENV_TYPE, module switches, HEALTH_*	developer and environment concerns
Debugging	TRACKING_DEBUG, TRACKING_LEGACY_VARIABLES, FACEBOOK_TEST_EVENT_CODE	must stay per environment; a test event code in a shared database would follow a copy to live
Performance	APP_PAGE_CACHE	per environment
API credentials	GOOGLE_MAPS_API_KEY, GOOGLE_GEOCODING_API_KEY, GOOGLE_RECAPTCHA_SITEKEY, GOOGLE_RECAPTCHA_SCORE, VIMEO_CLIENT_ID, VIMEO_ALBUM_ID	credentials or tied to them

Saving .env keys rebuilds the configuration cache in a separate process, so a deployed site stays cached (since 2.12).

What the screen does not cover

• Keys that are not on the list: database, cache, queue, session, filesystem and so on. Those are server configuration, edited with evolve:env:* or over SSH. See Environment Variables.
• The email logo (branding.email_logo_media_id) has no field; set it in code, see Settings store.
• Role lists (evolve.roles) and module access: project code in config/evolve.php.

Verifying

Save a store value and reload: the field keeps the value, the placeholder still shows the .env value underneath, and the .env file is unchanged. GET /api/health-check reports settings as the source of that value under tracking.sources or mail.sources.

Save a .env key and reload: the field shows the new value, and on a deployed site php artisan about --only=cache still reports the config as cached. php artisan evolve:env:show live prints the line with secrets masked. If the panel reports that the cache could not be rebuilt, the site runs uncached until the next deploy; the reason is in the log.