Configuration

The SDK is configured entirely through environment variables, merged into the monitor config namespace. Publishing config/monitor.php is optional (see Installation).

Minimum setup

Add the following to your application's .env:

dotenv

MONITOR_ENABLED=true
MONITOR_URL=https://monitor.example.com
MONITOR_KEY=your-project-api-key

MONITOR_URL is the base URL of your Quiet Guard server (no trailing path: the SDK appends /api/v1/... itself).
MONITOR_KEY is the per-project API key generated in the Quiet Guard dashboard. It is shown only once at project creation. See the server documentation for how projects and keys are created.

When MONITOR_URL or MONITOR_KEY is empty, the SDK stays completely silent, it never sends anything and never errors.

All options

Env variable	Config key	Default	Description
`MONITOR_ENABLED`	`monitor.enabled`	`true`	Master switch. When `false`, no data leaves the app.
`MONITOR_URL`	`monitor.url`	`null`	Base URL of the Quiet Guard server.
`MONITOR_KEY`	`monitor.key`	`null`	Per-project API key (sent as a `Bearer` token).
`MONITOR_ENVIRONMENTS`	`monitor.environments`	`production,staging`	Comma-separated allowlist of app environments to report from. Empty = report from every environment.
—	`monitor.ignore_paths`	`[]`	Request paths whose exceptions are never reported, in `Illuminate\Http\Request::is()` syntax.
`MONITOR_RELEASE`	`monitor.release`	`null`	Deployed version identifier (git SHA or tag) attached to events.
`MONITOR_TIMEOUT`	`monitor.timeout`	`3`	HTTP timeout in seconds for ingestion calls.
`MONITOR_QUEUE`	`monitor.queue`	`false`	`false` sends synchronously, `true` pushes reports onto the application's default queue connection, a connection name pushes onto that connection.
`MONITOR_TRACE_LIMIT`	`monitor.trace_limit`	`0`	Maximum number of stack-trace frames sent per exception. `0` (default) sends the full trace; set a frame count only if you need to trim payloads.
`MONITOR_LOGS_ENABLED`	`monitor.logs.enabled`	`false`	Opt-in forwarding of application logs. See Logging.
`MONITOR_LOG_LEVEL`	`monitor.logs.level`	`warning`	Minimum PSR-3 level to forward.
`MONITOR_LOGS_MAX_BATCH`	`monitor.logs.max_batch`	`200`	Maximum log entries buffered before an early flush.
—	`monitor.scrub`	see below	Request/context keys whose values are masked before leaving the app.
—	`monitor.redact`	`email, iban, nir, card, phone`	Value shapes masked wherever they sit, message text included. See Exception reporting.
—	`monitor.redact_custom`	`[]`	Your own shapes, as `label => PCRE pattern`.

Environments

By default the SDK only reports from production and staging. This means that in your local environment nothing is sent unless you change the list:

dotenv

# Report from every environment
MONITOR_ENVIRONMENTS=

# Or add local while testing the integration
MONITOR_ENVIRONMENTS=production,staging,local

The check uses Laravel's app()->environment(), i.e. your APP_ENV value.

Release

Set MONITOR_RELEASE at deploy time so the server can attribute issues to a specific deploy and correlate them with commits:

dotenv

MONITOR_RELEASE=${GIT_SHA}

A hexadecimal SHA lets the server map an issue's release to the matching synced commit.

Asynchronous reporting

By default reports are sent synchronously during the request, bounded by MONITOR_TIMEOUT. To remove that work from the request lifecycle, push it onto a queue:

dotenv

# Use a specific queue connection
MONITOR_QUEUE=redis

# Or the default connection
MONITOR_QUEUE=true

Reports are then dispatched as queued jobs (SendExceptionToMonitor, SendLogsToMonitor), so you need a running queue worker.

Ignored request paths

By default every exception is reported, wherever it happened. Set ignore_paths to a list of request paths whose exceptions are never reported, written in the syntax Laravel's Illuminate\Http\Request::is() accepts:

php

'ignore_paths' => ['api/v1/*'],

Empty by default. A console command carries a dummy request whose path is /, which matches none of these patterns, so ignore_paths never silences a queued job or a scheduled task, only HTTP requests. It gates exceptions only, logs are not affected.

This exists for an application that hosts a monitoring endpoint of its own: the exceptions raised while serving that endpoint should not be reported back to it.

Scrubbed keys

The default monitor.scrub list masks any request/context key whose name contains one of these terms (case-insensitive, recursive):

password, password_confirmation, passphrase, token, secret,
authorization, cookie, php_auth_pw, api_key, access_token,
referer, referrer,
x-forwarded-for, x-real-ip, cf-connecting-ip,
true-client-ip, x-client-ip, forwarded

referer and referrer are the address of the page the visitor came from, and a URL is where applications put their one-off secrets: an unsubscribe link, a signed download, a password reset, a share link. It is masked by name because it has no shape a value redactor could recognise.

The last six are the headers that carry a visitor's IP address. Behind a reverse proxy, which is the ordinary production topology, one of them holds the address of the person who triggered the error. That is personal data, and it is not about you but about your visitors, who chose nothing. It is masked by default. If you have a lawful basis for keeping it, remove the matching line: the decision is yours, as the controller.

To extend it, publish the config and edit the scrub array. Masked values are replaced with [scrubbed]. See Exception reporting for details.

← Previous Installation

Next → Exception reporting

You are reading the Laravel SDK v1.0 documentation.