Configuration

The site runs with no third-party keys. Each feature below stays off until its keys are set in .env.

Feature	.env keys
Booking rules	BOOKMYMOVIE_MAX_SEATS (default 4), BOOKMYMOVIE_CART_HOLD_MINUTES (10), BOOKMYMOVIE_CANCELLATION_CUTOFF (120 minutes)
reCAPTCHA	RECAPTCHA_V3_SITE_KEY, RECAPTCHA_V3_SECRET_KEY, RECAPTCHA_V2_SITE_KEY, RECAPTCHA_V2_SECRET_KEY
Apple Wallet	APPLE_WALLET_PASS_TYPE_ID, APPLE_WALLET_TEAM_ID, APPLE_WALLET_CERTIFICATE, APPLE_WALLET_CERTIFICATE_PASSWORD, APPLE_WALLET_WWDR
Google Wallet	GOOGLE_WALLET_ISSUER_ID, GOOGLE_WALLET_KEY_FILE
Online payments	JazzCash, Easypaisa and card keys (see config/payments.php)
Social sign-in	GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, FACEBOOK_CLIENT_ID, FACEBOOK_CLIENT_SECRET
Web push	VAPID_PUBLIC_KEY, VAPID_PRIVATE_KEY, VAPID_SUBJECT
Mail	Resend or any Laravel mailer (MAIL_MAILER, ...); mail is always queued

Notes

• Web push keys: generate them with php artisan push:keys. On XAMPP for Windows, OpenSSL needs OPENSSL_CONF pointing at C:\xampp\php\extras\ssl\openssl.cnf.
• reCAPTCHA: v3 runs invisibly; the v2 checkbox only appears as a step-up when v3 is unsure. Users never see two captchas at once.
• Production stores: use CACHE_STORE=redis, SESSION_DRIVER=redis and QUEUE_CONNECTION=redis. The database store is fine locally and supports the same atomic locks through the cache_locks table.