.env.example

APP_NAME="TryPost"
APP_ENV=local
APP_KEY=
APP_DEBUG=true
APP_URL=http://localhost

# Public base URL inbound webhooks (e.g. Telegram) are registered on.
# Defaults to APP_URL; set a tunnel URL (e.g. ngrok) for local development.
WEBHOOK_URL=

# Proxies whose X-Forwarded-* headers are trusted. Defaults to Cloudflare's
# ranges; behind another proxy, list its IPs or ranges (comma-separated),
# or * for any proxy (a client can then fake its IP).
# TRUSTED_PROXIES=

# Self-hosted mode (skips payment requirements)
SELF_HOSTED=true

# Allow more than one connected account per social network in a workspace.
# Independent of SELF_HOSTED (Cloud default is false). Self-hosted typically wants true.

# Rewrite links in the X version of a post as non-clickable (example(.)com), so
# X does not bill them at the link-post rate. Self-hosted installs publish through
# their own X app and pay their own bill, so set true only if you want it.
X_DEFUSE_LINKS=false

# Show the "What's New" sidebar card and modal (entries under
# resources/changelog/, synced with `php artisan changelog:sync`).
CHANGELOG_ENABLED=true
META_PAGE_WALK_SECONDS=20

# Domain verification tokens served at /.well-known/{name} (config trypost.well_known).
# Leave empty unless you list the app in that provider's directory.
OPENAI_APPS_CHALLENGE=

# Passport OAuth keys (API tokens / MCP). Prefer env vars over key files so
# every node behind a load balancer shares the same key pair. Use literal \n
# for newlines in the PEM. When unset, Passport falls back to storage/oauth-*.key
# (generate with: php artisan passport:keys).
# PASSPORT_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----"
# PASSPORT_PUBLIC_KEY="-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----"

TELESCOPE_ENABLED=false

APP_LOCALE=en
APP_FALLBACK_LOCALE=en
APP_FAKER_LOCALE=en_US

APP_MAINTENANCE_DRIVER=file

BCRYPT_ROUNDS=12

LOG_CHANNEL=stack
LOG_STACK=single
LOG_DEPRECATIONS_CHANNEL=null
LOG_LEVEL=debug

# Database (PostgreSQL or MySQL)
# PostgreSQL: DB_CONNECTION=pgsql, DB_PORT=5432, DB_USERNAME=postgres
# MySQL: DB_CONNECTION=mysql, DB_PORT=3306, DB_USERNAME=root
DB_CONNECTION=pgsql
DB_HOST=127.0.0.1
DB_PORT=5432
DB_DATABASE=trypost
DB_USERNAME=postgres
DB_PASSWORD=

# Session
SESSION_DRIVER=database
SESSION_LIFETIME=1440
SESSION_ENCRYPT=false
SESSION_PATH=/
SESSION_DOMAIN=null

# Broadcasting, Queue, Cache
BROADCAST_CONNECTION=reverb
QUEUE_CONNECTION=redis
CACHE_STORE=redis

# File Storage
# Options: local, s3, r2 (or any S3-compatible: MinIO, DigitalOcean Spaces, etc.)
FILESYSTEM_DISK=local

# Redis
REDIS_HOST=127.0.0.1
REDIS_PASSWORD=null
REDIS_PORT=6379

# Mail
MAIL_MAILER=smtp
MAIL_HOST=127.0.0.1
MAIL_PORT=2525
MAIL_USERNAME=null
MAIL_PASSWORD=null
MAIL_ENCRYPTION=null
MAIL_FROM_ADDRESS="hello@example.com"
MAIL_FROM_NAME="${APP_NAME}"

# Reverb (WebSockets)
REVERB_APP_ID=1001
REVERB_APP_KEY=your-reverb-key
REVERB_APP_SECRET=your-reverb-secret
REVERB_HOST="localhost"
REVERB_PORT=8080
REVERB_SCHEME=http

# AWS S3 (set FILESYSTEM_DISK=s3)
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_DEFAULT_REGION=us-east-1
AWS_BUCKET=
AWS_URL=

# Cloudflare R2 (set FILESYSTEM_DISK=r2)
R2_ACCESS_KEY_ID=
R2_SECRET_ACCESS_KEY=
R2_ENDPOINT=
R2_REGION=auto
R2_BUCKET=
R2_URL=

# DigitalOcean Spaces (set FILESYSTEM_DISK=spaces)
SPACES_ACCESS_KEY_ID=
SPACES_SECRET_ACCESS_KEY=
SPACES_ENDPOINT=
SPACES_REGION=
SPACES_BUCKET=

# ============================================
# Social Platform Credentials
# ============================================
# Get your API keys from each platform's developer portal

# LinkedIn (https://developer.linkedin.com)
LINKEDIN_CLIENT_ID=
LINKEDIN_CLIENT_SECRET=
LINKEDIN_CLIENT_REDIRECT="${APP_URL}/accounts/linkedin/callback"
# LINKEDIN_SCOPES="openid,profile,email,w_member_social"
# LINKEDIN_PAGE_SCOPES="openid,profile,email,w_organization_social,r_organization_social,rw_organization_admin,w_member_social"

# X / Twitter (https://developer.twitter.com)
X_CLIENT_ID=
X_CLIENT_SECRET=
X_CLIENT_REDIRECT="${APP_URL}/accounts/x/callback"

# TikTok (https://developers.tiktok.com)
TIKTOK_CLIENT_ID=
TIKTOK_CLIENT_SECRET=
TIKTOK_CLIENT_REDIRECT="${APP_URL}/accounts/tiktok/callback"
# Trim when the TikTok app lacks Display API (no longer offered to new apps):
# TIKTOK_SCOPES="user.info.basic,video.publish,video.upload"

# Facebook (https://developers.facebook.com)
FACEBOOK_CLIENT_ID=
FACEBOOK_CLIENT_SECRET=
FACEBOOK_CLIENT_REDIRECT="${APP_URL}/accounts/facebook/callback"

# Instagram (https://developers.facebook.com)
INSTAGRAM_CLIENT_ID=
INSTAGRAM_CLIENT_SECRET=
INSTAGRAM_CLIENT_REDIRECT="${APP_URL}/accounts/instagram/callback"

# Threads (https://developers.facebook.com)
THREADS_CLIENT_ID=
THREADS_CLIENT_SECRET=
THREADS_CLIENT_REDIRECT="${APP_URL}/accounts/threads/callback"

# Google (https://console.cloud.google.com)
# Used for YouTube social account connection AND Google login/signup
GOOGLE_AUTH_ENABLED=false
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=
GOOGLE_CLIENT_REDIRECT="${APP_URL}/accounts/youtube/callback"
GOOGLE_AUTH_CALLBACK="${APP_URL}/auth/google/callback"

# Google Business Profile (https://console.cloud.google.com)
# Dedicated OAuth app, isolated from YouTube
GOOGLE_BUSINESS_CLIENT_ID=
GOOGLE_BUSINESS_CLIENT_SECRET=
GOOGLE_BUSINESS_CLIENT_REDIRECT="${APP_URL}/accounts/google-business/callback"

# GitHub (https://github.com/settings/developers)
# Used for GitHub login/signup
GITHUB_AUTH_ENABLED=false
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=
GITHUB_AUTH_CALLBACK="${APP_URL}/auth/github/callback"

# Pinterest (https://developers.pinterest.com)
PINTEREST_CLIENT_ID=
PINTEREST_CLIENT_SECRET=
PINTEREST_CLIENT_REDIRECT="${APP_URL}/accounts/pinterest/callback"

# Telegram (single shared bot — create one via https://t.me/BotFather)
# After setting these, run: php artisan telegram:set-webhook
TELEGRAM_BOT_TOKEN=
TELEGRAM_BOT_USERNAME=
# TELEGRAM_DEEP_LINK=https://t.me
TELEGRAM_WEBHOOK_SECRET=

# Discord (single shared app+bot — create one via https://discord.com/developers/applications)
# OAuth2 → add the redirect below; Bot → enable "Server Members Intent" for mention search.
DISCORD_CLIENT_ID=
DISCORD_CLIENT_SECRET=
DISCORD_BOT_TOKEN=
DISCORD_CLIENT_REDIRECT="${APP_URL}/accounts/discord/callback"

# AI Services
OPENAI_API_KEY=
ANTHROPIC_API_KEY=
GEMINI_API_KEY=
OPENROUTER_API_KEY=
ELEVENLABS_API_KEY=
# Only needed if you point one of the AI_*_PROVIDER vars below at these providers.
# XAI_API_KEY=
# GROQ_API_KEY=
# MISTRAL_API_KEY=
# DEEPSEEK_API_KEY=
# Ollama runs locally and needs no key — set the URL only if it isn't on the default port.
# OLLAMA_URL=http://localhost:11434
# Any OpenAI-compatible endpoint (LM Studio, vLLM, LocalAI, ...) via AI_TEXT_PROVIDER=openai-compatible.
# It has no built-in default model, so OPENAI_COMPATIBLE_TEXT_MODEL is required for that provider.
# OPENAI_COMPATIBLE_URL=
# OPENAI_COMPATIBLE_API_KEY=
# OPENAI_COMPATIBLE_TEXT_MODEL=

# AI Provider Selection
# text:  openai | anthropic | gemini | openrouter | xai | groq | mistral | deepseek | ollama | ...
# audio: openai | elevenlabs | gemini | openrouter | ...
# OpenRouter is a first-class laravel/ai provider (AI_TEXT_PROVIDER=openrouter + OPENROUTER_API_KEY).
AI_TEXT_PROVIDER=openai
AI_AUDIO_PROVIDER=elevenlabs

# AI Model Overrides (optional)
# Each provider picks a sensible default model per capability on its own -
# these are NOT shared across capabilities, so overriding one (e.g. a text
# model) never affects another (e.g. that same provider's audio model).
# Uncomment only the ones you want to override; every provider in play above
# (AI_TEXT_PROVIDER / AI_AUDIO_PROVIDER) reads its own set.
# The values below are laravel/ai's current defaults, shown as format examples -
# they move with the package, so don't treat them as a contract.
# OPENAI_TEXT_MODEL=gpt-5.4
# OPENAI_AUDIO_MODEL=gpt-4o-mini-tts
# ANTHROPIC_TEXT_MODEL=claude-sonnet-5
# GEMINI_TEXT_MODEL=gemini-3.6-flash
# GEMINI_AUDIO_MODEL=gemini-2.5-flash-preview-tts
# XAI_TEXT_MODEL=grok-4.20-non-reasoning
# OPENROUTER_TEXT_MODEL=anthropic/claude-sonnet-4.6
# OPENROUTER_AUDIO_MODEL=google/gemini-3.1-flash-tts-preview
# ELEVENLABS_AUDIO_MODEL=eleven_multilingual_v2
# GROQ_TEXT_MODEL=openai/gpt-oss-120b
# MISTRAL_TEXT_MODEL=mistral-medium-latest
# DEEPSEEK_TEXT_MODEL=deepseek-v4-flash
# OLLAMA_TEXT_MODEL=llama3.1:8b
# Ollama has no audio-capable driver in laravel/ai - text only.

# ============================================
# Stripe (Cashier — billing)
# ============================================
# Required when SELF_HOSTED=false. Get keys at https://dashboard.stripe.com/apikeys
STRIPE_KEY=
STRIPE_SECRET=
STRIPE_WEBHOOK_SECRET=

# Stripe Plan Price IDs (one per plan × interval). Used by PlanSeeder.
STRIPE_WORKSPACE_MONTHLY=
STRIPE_WORKSPACE_YEARLY=
STRIPE_SOCIALS_MONTHLY=
STRIPE_SOCIALS_YEARLY=
STRIPE_WORKSPACES_MONTHLY=
STRIPE_WORKSPACES_YEARLY=

# Laravel Nightwatch (production telemetry — disabled by default in dev)
NIGHTWATCH_ENABLED=false
NIGHTWATCH_TOKEN=
# Jobs, commands and scheduled tasks send only queries at least this slow (ms)
# NIGHTWATCH_SLOW_QUERY_MS=500

# Platform feature flags (all default to true; set to false to hide a platform)
# TIKTOK_ENABLED=true
# PINTEREST_ENABLED=true
# MASTODON_ENABLED=true
# BLUESKY_ENABLED=true
# TELEGRAM_ENABLED=true
# GOOGLE_BUSINESS_ENABLED=true

# Media Services
UNSPLASH_ACCESS_KEY=
UNSPLASH_SECRET_KEY=

# Composer media sources (Google Drive, Google Photos, Canva).
# Each source is hidden until its flag is on AND its keys are set. Nothing falls back to GOOGLE_CLIENT_ID
# or GOOGLE_BUSINESS_*. Canva and Google Photos are Cloud-only in practice (Canva needs an approved public
# integration; Photos needs Google verification of a sensitive scope).
# Google "media" project (https://console.cloud.google.com), shared by Drive and Photos (Web application OAuth client).
# Authorized redirect URI: GOOGLE_MEDIA_CLIENT_REDIRECT
GOOGLE_MEDIA_CLIENT_ID=
GOOGLE_MEDIA_CLIENT_SECRET=
GOOGLE_MEDIA_CLIENT_REDIRECT="${APP_URL}/integrations/google/callback"
GOOGLE_MEDIA_API_KEY=
GOOGLE_MEDIA_APP_ID=
GOOGLE_DRIVE_ENABLED=true
GOOGLE_PHOTOS_ENABLED=false
# Canva Connect API (https://www.canva.com/developers/integrations/connect-api)
# Redirect URL: ${APP_URL}/integrations/canva/callback · Return URL: ${APP_URL}/integrations/canva/return
CANVA_ENABLED=true
CANVA_CLIENT_ID=
CANVA_CLIENT_SECRET=
# Optional host overrides (defaults shown)
# UNSPLASH_API_URL=https://api.unsplash.com
# UNSPLASH_WEBSITE_URL=https://unsplash.com
# UNSPLASH_DOWNLOAD_HOSTS=images.unsplash.com
# UNSPLASH_REQUESTS_PER_MINUTE=30
# GOOGLE_PICKER_SDK_URL=https://apis.google.com/js/api.js
# GOOGLE_MEDIA_AUTHORIZE_URL=https://accounts.google.com/o/oauth2/v2/auth
# GOOGLE_MEDIA_OAUTH_API=https://oauth2.googleapis.com
# GOOGLE_DRIVE_API_URL=https://www.googleapis.com/drive/v3
# GOOGLE_DRIVE_DOWNLOAD_HOSTS=www.googleapis.com,*.googleusercontent.com
# GOOGLE_PHOTOS_PICKER_API_URL=https://photospicker.googleapis.com
# GOOGLE_PHOTOS_DOWNLOAD_HOSTS=lh3.googleusercontent.com,lh4.googleusercontent.com,lh5.googleusercontent.com,lh6.googleusercontent.com,video-downloads.googleusercontent.com
# GOOGLE_PHOTOS_POLLS_PER_MINUTE=60
# GOOGLE_PHOTOS_MAX_ITEMS=10
# CANVA_API_URL=https://api.canva.com/rest/v1
# CANVA_AUTHORIZE_URL=https://www.canva.com/api/oauth/authorize
# CANVA_CODE_CHALLENGE_METHOD=s256
# CANVA_DOWNLOAD_HOSTS=*.canva.com
# CANVA_EDITOR_HOSTS=*.canva.com
# CANVA_EXPORT_TIMEOUT_SECONDS=120
# CANVA_EXPORT_POLL_SECONDS=2
# MEDIA_IMPORT_TIMEOUT_SECONDS=600
# MEDIA_IMPORTS_PER_MINUTE=30

# Media processing and retention
# HEIC/HEIF uploads are converted to JPEG when Imagick is built with HEIC; false rejects them with a clear message
MEDIA_HEIC_CONVERSION=true
# Imagick limits for decoding a HEIC upload
# MEDIA_HEIC_MEMORY_LIMIT_MB=256
# MEDIA_HEIC_MAP_LIMIT_MB=512
# MEDIA_HEIC_DISK_LIMIT_MB=1024
# MEDIA_HEIC_AREA_LIMIT_MB=1024
# MEDIA_HEIC_WIDTH_LIMIT_PX=16384
# MEDIA_HEIC_HEIGHT_LIMIT_PX=16384
# Unused temporary uploads are deleted after this many hours (media:prune-uploads)
MEDIA_UPLOAD_RETENTION_HOURS=24
# Published posts older than this are deleted with their media (posts:prune-history). 0/empty is rejected.
POST_HISTORY_RETENTION_DAYS=730

# Google Tag Manager (optional - analytics)
GTM_ID=

# PostHog (optional - analytics; off by default, self-hosted installs can ignore)
POSTHOG_ENABLED=false
POSTHOG_API_KEY=
POSTHOG_HOST=https://us.i.posthog.com

# Vite
VITE_APP_NAME="${APP_NAME}"
VITE_REVERB_APP_KEY="${REVERB_APP_KEY}"
VITE_REVERB_HOST="${REVERB_HOST}"
VITE_REVERB_PORT="${REVERB_PORT}"
VITE_REVERB_SCHEME="${REVERB_SCHEME}"
VITE_POSTHOG_ENABLED="${POSTHOG_ENABLED}"
VITE_POSTHOG_API_KEY="${POSTHOG_API_KEY}"
VITE_POSTHOG_HOST="${POSTHOG_HOST}"

REPURPOSE_POLL_INTERVAL_MINUTES=15
REPURPOSE_BACKOFF_MINUTES=60

# External posts import (Sent shows posts made directly on the networks)
# Newest posts per channel imported into Sent. 0 turns the import off.
EXTERNAL_POSTS_IMPORT_LIMIT=50
# On X, only posts from the last N days are imported.
X_EXTERNAL_POSTS_IMPORT_DAYS=30
# Minutes around a network post in which a TryPost post with the same text is treated as that post instead of importing a copy.
EXTERNAL_POSTS_MATCH_WINDOW_MINUTES=120
# Network API calls per minute, per network, spent fetching imported posts' media.
EXTERNAL_POSTS_MEDIA_REQUESTS_PER_MINUTE=30
# How often (in hours, 1-24) channels are checked for new posts. X is separate because X bills every read.
# Pick a divisor of 24 (1, 2, 3, 4, 6, 8, 12, 24) so the checks stay evenly spaced across midnight.
PUBLICATION_DISCOVERY_INTERVAL_HOURS=3
X_PUBLICATION_DISCOVERY_INTERVAL_HOURS=24
# Hours read back from the newest post already seen on each check.
PUBLICATION_DISCOVERY_OVERLAP_HOURS=6

# RSS feeds (Create › Feeds)
# RSS_FEEDS_POLL_INTERVAL_MINUTES=480
# RSS_FEEDS_MAX_BACKOFF_MINUTES=1440
# RSS_FEEDS_REFRESH_COOLDOWN_MINUTES=5
# RSS_FEEDS_MAX_ITEMS_PER_FEED=100
# RSS_FEEDS_MAX_PER_WORKSPACE=50
# RSS_FEEDS_OG_IMAGE_MAX_ITEMS=20
# RSS_FEEDS_OG_IMAGE_MAX_AGE_DAYS=14
# RSS_FEEDS_OG_IMAGE_MAX_PAGE_BYTES=262144
# RSS_FEEDS_MAX_RESPONSE_BYTES=5242880
# RSS_FEEDS_FETCH_BUDGET_SECONDS=10
# FAVICON_API=https://icons.duckduckgo.com