Know where each deployment secret goes before the first build
Your organisation owns the Laravel Cloud account, infrastructure choices, and provider charges. Capell prepares the target environment, but the delivery team still decides who may read or change its variables and how bootstrap access is retired.
Configure the right environment
Understand which values connect your deployment without exposing secrets or mixing environments.
Deployment variables tell the application which services and credentials to use. They are not ordinary page content, and an incorrect value can connect an otherwise healthy application to the wrong environment. Use the reference below alongside a clear inventory of development, staging and production responsibilities.
Before launch, agree who owns the Laravel Cloud environment, who may rotate its secrets, and who confirms registration completed. Laravel Cloud remains the infrastructure source of truth and bills the account your organisation controls; Capell does not replace those operational responsibilities.
Keep these values with the environment
Capell sends the following values to the target environment before its first deployment. Build and deploy commands read them from Laravel Cloud, so secret values do not appear in command text.
CAPELL_ACCOUNT_API_URL- The Capell account API base URL used by the deployed CMS.CAPELL_CLOUD_INSTANCE_ID- The Capell cloud instance identifier used for registration.CAPELL_CLOUD_REGISTRATION_URL- The registration endpoint called by the deployed CMS after install.CAPELL_REGISTRATION_TOKEN- A short-lived credential for the first registration; remove or rotate it after the bootstrap is confirmed.CAPELL_SETUP_ADMIN_NAME- The first administrator name supplied by the deployer.CAPELL_SETUP_ADMIN_EMAIL- The first administrator email supplied by the deployer.CAPELL_SITE_URL- The provided public URL, or the Laravel Cloud domain resolved after the first deployment.CAPELL_INSTALL_MODE- The selected cloud installation mode.CAPELL_INSTALL_PACKAGES- The Capell package list selected for bootstrap.CAPELL_INSTALL_THEME- The first theme choice, normally Foundation.
Return the first-admin password once
The normal bootstrap flow does not write the first administrator password to cloud-instance metadata, deployment events, command text, or Laravel Cloud environment variables. Capell encrypts it in a short-lived cache entry keyed by the registration token, returns it once to the deployed CMS during registration, and then removes it.
Retain evidence, not secrets
Capell keeps non-secret deployment evidence such as the acknowledgement time, source-repository access check, install theme, and selected package list. Confirm the deployed CMS has registered back before declaring the instance ready, then follow the team's credential-rotation and access-review runbook.
Separate settings from secrets
Give each value a purpose and a safe place to live.
Identify which values are public configuration, which identify a resource and which grant access. Credentials belong in the deployment environment or approved secret store, not in source control, screenshots or a CMS field. Use placeholders when sharing configuration examples.
Check the variable names against the current deployment reference. Do not copy a whole production environment into a trial: select the values required for that environment and give it its own service access.
Verify after a change
Check the behaviour that depends on the value you changed.
Updating a variable may require a configuration rebuild or application restart through the deployment process. A saved dashboard value does not prove the running application is using it. Follow the platform's current procedure and verify the relevant workflow afterwards.
For database, mail or queue changes, use a controlled test and inspect the result without exposing credentials. Record the previous configuration through an approved recovery mechanism before changing production.