config/config.php is written by the installer. It holds the settings that must be known before the database is opened, plus the security settings. Everything else is set in the admin area.
Warning:config.php contains the database password and the app key. The app key encrypts these:
the gateway keys;
the server API keys and passwords;
the SMTP password;
the vault.
If you lose or change it, they can no longer be read. Back it up together with the database, and keep the file private (chmod 600).
General
Key
Default
Meaning
app_url
| The address of the billing, for example https://billing.example.com. The license is bound to its host name.
base_path
''
Set it when the billing runs in a subfolder, for example /billing.
admin_path
| The secret part of the admin URL
company_name
| Shown in the client area and in e-mails
theme
default
The client area theme (themes/<name>)
languages
all 9
The enabled languages, for example ['en', 'de', 'es']
default_language
en
timezone
UTC
Used for dates and the hour of the daily run
debug
false
Shows errors in the browser. Never use it in production.
noindex
true
Asks search engines not to index the billing
asset_version
| Raise it to make browsers reload the CSS and JS.
app_key
| 32 random bytes, base64. Never change it.
public_dir
| Where theme:publish copies the theme assets
extensions
[]
Optional extensions in extensions/<name>
Security
Key
Default
Meaning
secure_cookies
true
Cookies only over HTTPS. Keep it on.
trusted_proxies
the server’s own IPs
Proxies and CDNs in front of the billing. Their X-Forwarded-For is trusted, so the real client IP is logged.
admin_ip_allow
[]
IPs and CIDR ranges that may always open the admin area, in addition to the list under Staff
admin_bind_ip
true
A staff session ends if the IP changes.
admin_idle_minutes
1440
Staff are logged out after this much time without activity.
client_idle_minutes
120
The same for clients
Tickets and vault
Key
Default
Meaning
ticket_prefix
''
Prefix for new ticket numbers (prefix + 6 digits)
vault_ttl_days
7
Ticket credentials are deleted after this many days. Staff can extend them.
vault_max_days
30
The hard limit after sending, extensions included
support_ssh_key
''
Your public SSH key, shown to clients as an alternative to sending a password
Database and e-mail
Key
Meaning
db
host, name, user, pass, charset (utf8mb4)
mail.mode
send delivers e-mails. log only writes them to storage/mail/, for test installations.
mail.from
The default sender
mail.allow
With send: deliver only to addresses that match this regular expression (staging)
WHMCS migration
Key
Meaning
whmcs
Read-only access to the old WHMCS database: host, name, user, pass, attachments_dir, cc_encryption_hash (from the WHMCS configuration.php, decrypts passwords)
legacy_hosts
Old host names that this installation serves after the move. Old links and gateway callbacks keep working.
bridge_secret
Shared secret for tools/whmcs-bridge, only needed if the old host stays on another server