---
url: /panel/settings.md
---
# Settings

The Settings screen (`/evolve/settings`) edits two places. Public business configuration (site name, branding, company identity, mail addresses, tracking IDs, consent, site verifications) is saved to the database [settings store](/panel/settings-store) since 2.18. Secrets, infrastructure and the environment posture stay in the `.env` of the environment the panel runs on. Both parts are editors for a fixed list of fields, not free-form editors: anything the form submits that is not on the list is dropped.

![The Settings screen on the General tab: project name, base URL, Analytics property, login image](/screenshots/panel-settings.png)

## Tabs

| Tab | Cards | Settings store fields | `.env` keys |
|---|---|---|---|
| General | Control panel, LLM, Frontend, Performance, Localisation | site name, Analytics property ID, panel colour, login image | `APP_URL`, `OPENAI_API_KEY`, `APP_PAGE_CACHE`, `EVOLVE_REGION_REMOVE_DEFAULT_PREFIX` |
| Company  | Identity, Address | legal name, brand name, founding date, site logo, street, postal code, locality, region, country, phone, email, profiles (one URL per line) | none |
| Mail | Sender, Recipients, Mailer | sender name, sender address, reply-to, notification address, alert address | `MAIL_MAILER`, `MAIL_HOST`, `MAIL_PORT`, `MAIL_SCHEME`, `MAIL_USERNAME`, `MAIL_PASSWORD` |
| Video | Vimeo | none | `VIMEO_CLIENT_ID`, `VIMEO_CLIENT_SECRET`, `VIMEO_ACCESS_TOKEN`, `VIMEO_ALBUM_ID` |
| Tracking | Consent, Google, Facebook / Meta, Server-side tracking, Pinterest, LinkedIn, Hotjar | consent policy, cookie banner, consent via CMP, GTM container, GA4 measurement ID, conversion data, Meta pixel, server-side events, Pinterest tag, LinkedIn partner and lead conversion IDs, Hotjar site ID | `ANALYTICS_API_SECRET`, `GOOGLE_MAPS_API_KEY`, `GOOGLE_GEOCODING_API_KEY`, `GOOGLE_RECAPTCHA_SITEKEY`, `GOOGLE_RECAPTCHA_SECRET`, `GOOGLE_RECAPTCHA_SCORE`, `FACEBOOK_CONVERSIONS_API_KEY`, `FACEBOOK_TEST_EVENT_CODE`, `TRACKING_DEBUG`, `TRACKING_LEGACY_VARIABLES` |
| SEO  | Site verification | Google, Bing and Pinterest verification codes | none |
| Packages | one card per enabled module | none | the keys a module registers, for example `BLOG_OVERVIEW_PAGE`, `BLOG_AUTHOR_TYPE`, `FAQ_OVERVIEW_PAGE`, `SCOUT24_MEMBER_ID`, `SHOPIFY_API_VERSION` |
| Developers | Environment, Mail safety, Tracking emit, Protect, Modules, Developers | none | `EVOLVE_ENV_TYPE`, `APP_ENV`, `APP_DEBUG`, `EVOLVE_ENV_BANNER`, `EVOLVE_MAIL_SAFETY`, `EVOLVE_MAIL_REDIRECT`, `TRACKING_EMIT`, `EVOLVE_PROTECT_USER`, `EVOLVE_PROTECT_PASSWORD`, every `EVOLVE_MODULE_*` |
| Health | Checks, Oh Dear, Notifications, Retention | none (the effective alert address is shown, it is edited on the Mail tab) | `HEALTH_CHECK_*` toggles, `HEALTH_CHECK_QUEUE` (Auto, On, Off), `HEALTH_CHECK_EMAIL_RECIPIENT`, `HEALTH_KEEP_HISTORY_DAYS`, `HEALTH_NOTIFICATIONS_ENABLED`, `OH_DEAR_HEALTH_CHECK_SECRET` |

The Developers tab exists for the developer role only. An admin who submits one of its keys has them dropped, whatever the form sent. See [Roles](/getting-started/roles#who-is-a-developer).

## Store fields and inheritance

A store field shows the stored value. Its placeholder shows what an empty field inherits from the `.env` or the project config ("inherits GTM-ABC1234", or "not set"). Emptying a field and saving stores `null`, and the `.env` value applies again. Switches in the store (cookie banner, consent via CMP, server-side events) are selects with three options instead of toggles: the first option inherits and names the inherited state ("Inherit: On"), the other two pin On or Off. Consent policy and conversion data have the same inherit option.

The inherit options exist for sites whose `.env` still carries these values. A new installation sets them in the panel and leaves them out of the `.env`.

The login image picker shows the stored image only. When the store is empty and the `.env` sets `APP_LOGIN_IMAGE_ID`, a line below the picker names the inherited media ID.

Store values are validated before anything is written: the GTM container must look like `GTM-…`, the GA4 ID like `G-…`, the panel colour like `#RRGGBB`, addresses must be valid email addresses, profile lines valid URLs, and the founding date `YYYY`, `YYYY-MM` or `YYYY-MM-DD`. An invalid value saves nothing and shows the error.

Saving store values needs no rebuild of the configuration cache, because stored values are applied on top of the cached config at runtime. Changes are recorded in the activity log in the same `settings-changed` entry as `.env` changes, keyed `<group>.<property>`.

### Import hint

While a group stores nothing but the `.env` or the project config holds a value other than the package default, the General, Tracking and SEO tabs show an info box. It means the site still runs on its `.env` values for that group. Run the import once to take them over, see [Importing existing values](/panel/settings-store#importing-existing-values).

## Consent rule

Opt-in consent needs somebody who can grant it. Saving the policy `opt-in` with the cookie banner off and the consent via CMP option off is refused with an error at the top of the form, and nothing is written. Inherited values count: an "inherit" policy that resolves to `opt-in` in the `.env` is checked the same way. See [Tracking and consent](/site/tracking-and-consent#consent).

## Secrets

`MAIL_PASSWORD`, `EVOLVE_PROTECT_PASSWORD`, `OPENAI_API_KEY`, `VIMEO_CLIENT_SECRET`, `VIMEO_ACCESS_TOKEN`, `OH_DEAR_HEALTH_CHECK_SECRET`, `ANALYTICS_API_SECRET`, `FACEBOOK_CONVERSIONS_API_KEY` and `GOOGLE_RECAPTCHA_SECRET` are masked in the form. The field shows that a value exists; leaving it untouched keeps it, typing replaces it. Secrets never go into the settings store, because a database table ends up in dumps and database copies.

## What stays in the `.env`

| Kind | Examples | Why |
|---|---|---|
| Secrets | the keys above | not in a table that travels with database copies |
| Infrastructure | `APP_URL`, `MAIL_MAILER`, `MAIL_HOST`, `MAIL_PORT`, `MAIL_SCHEME`, `MAIL_USERNAME` | differ per deployment, not per business decision |
| Posture and switches | `EVOLVE_ENV_TYPE`, module switches, `HEALTH_*` | developer and environment concerns |
| Debugging | `TRACKING_DEBUG`, `TRACKING_LEGACY_VARIABLES`, `FACEBOOK_TEST_EVENT_CODE` | must stay per environment; a test event code in a shared database would follow a copy to live |
| Performance | `APP_PAGE_CACHE` | per environment |
| API credentials | `GOOGLE_MAPS_API_KEY`, `GOOGLE_GEOCODING_API_KEY`, `GOOGLE_RECAPTCHA_SITEKEY`, `GOOGLE_RECAPTCHA_SCORE`, `VIMEO_CLIENT_ID`, `VIMEO_ALBUM_ID` | credentials or tied to them |

Saving `.env` keys rebuilds the configuration cache in a separate process, so a deployed site stays cached (since 2.12).

## What the screen does not cover

* Keys that are not on the list: database, cache, queue, session, filesystem and so on. Those are server configuration, edited with `evolve:env:*` or over SSH. See [Environment Variables](/getting-started/environment-variables).
* The email logo (`branding.email_logo_media_id`) has no field; set it in code, see [Settings store](/panel/settings-store#reading-and-writing-in-code).
* Role lists (`evolve.roles`) and module access: project code in `config/evolve.php`.

## Verifying

Save a store value and reload: the field keeps the value, the placeholder still shows the `.env` value underneath, and the `.env` file is unchanged. `GET /api/health-check` reports `settings` as the source of that value under `tracking.sources` or `mail.sources`.

Save a `.env` key and reload: the field shows the new value, and on a deployed site `php artisan about --only=cache` still reports the config as cached. `php artisan evolve:env:show live` prints the line with secrets masked. If the panel reports that the cache could not be rebuilt, the site runs uncached until the next deploy; the reason is in the log.