All keys live in config/visits.php. Keys without an env variable can only be changed in the published file. Class names are stored as strings, never closures, so the config survives php artisan config:cache.
Turns tracking off: TrackVisit and Visits::track() do nothing, POST /visits/collect returns {"visitor_id": null}, the Login/Logout listeners and Visits::identify() do nothing, and TrackVisit is not added to the web group. The dashboard and /visits/whoami routes are not registered and Visits::whoami() returns [] (before 0.13.6 they kept working)
models.visitor
—
Fomvasss\Visits\Models\Visitor
Visitor model class. Overrides must extend the package model (Custom models)
models.session
—
Fomvasss\Visits\Models\Session
Session model class
models.event
—
Fomvasss\Visits\Models\Event
Event model class
models.stat_daily
—
Fomvasss\Visits\Models\StatDaily
Daily rollup model class
token_resolver
—
Fomvasss\Visits\Support\TokenResolver
Class that resolves and generates visitor ids, bound in the container in place of TokenResolver. Must extend it (Visitor identity)
Format a visitor id must match to be accepted — from the X-Visitor-Id header, the visitor_id input, the cookie, inheritFrom and the authenticated-user fallback. Anything else is silently ignored. The token column holds at most 64 characters
reset_identity_on_logout
—
false
On Logout, clear user_type/user_id on the current visitor (shared or kiosk devices)
session_timeout_minutes
—
30
Inactivity after which a new event opens a new session instead of joining the current one; also the cutoff for visits:close-stale-sessions
Path patterns (Request::is() syntax) TrackVisit never tracks. Checked whenever TrackVisit runs, including routes it was attached to by alias. 'storage' without /* matches only /storage itself
page_views
—
'every'
'first_only': TrackVisit writes an Event only for a request that carries no visitor id yet; later requests still refresh the visitor and session (Page views)
exclude_ips
—
[]
IPs and CIDR ranges (IPv4/IPv6) never recorded, from any entry point: ['203.0.113.42', '198.51.100.0/24', '2001:db8::/32']
Middleware for POST /visits/collect; the throttle from rate_limit.endpoint is appended automatically. Use ['api'] (or exclude the route from CSRF) for API-only backends, other origins and mobile apps (Client integration)
collect.allowed_origins
—
null
Array of origins ('https://example.com'). When set, a request whose Origin (or the scheme and host of Referer) is not listed gets 403. A filter against casual misuse, not authentication
Reserved; the package does not read it (Multi-tenancy)
user_display_resolver
—
DefaultUserDisplayNameResolver
Class implementing UserDisplayNameResolverInterface that turns the linked user into a display name on the dashboard. The default returns name, then email, then null