`APP_KEY` not set when not in `.env` despite "Application key set" message

[WilliamDEdwards]

• Laravel Version: 9.36.2
• PHP Version: 8.1.12
• Database Driver & Version: MariaDB 10.6.10

Description:

When APP_KEY is not set in .env, php artisan key:generate returns:

INFO  Application key set successfully.

However, APP_KEY is not set.

Instead, I would expect Laravel to either:

• Return an error message, instructing the user to set an empty APP_KEY
• Add APP_KEY

Steps To Reproduce:

• Create .env without APP_KEY
• Run php artisan key:generate

Demonstration of the issue:

acme@acme-test:/var/www/acme$ cat .env
APP_ENV=local
acme@acme-test:/var/www/acme$ php artisan config:cache

   INFO  Configuration cached successfully.

acme@acme-test:/var/www/acme$ php artisan key:generate

   INFO  Application key set successfully.

acme@acme-test:/var/www/acme$ cat .env
APP_ENV=local

As you can see, APP_KEY is missing from .env.

When APP_KEY is set, the command works as expected:

acme@acme-test:/var/www/acme$ cat .env
APP_ENV=local
APP_KEY=
acme@acme-test:/var/www/acme$ php artisan config:cache

   INFO  Configuration cached successfully.

acme@acme-test:/var/www/acme$ php artisan key:generate

   INFO  Application key set successfully.

acme@acme-test:/var/www/acme$ cat .env
APP_ENV=local
APP_KEY=base64:oqrt7GTMMWcQ9RgL4asXYdHKeF+rWlc4/mqTPXsMJXk=

As you can see, the empty APP_KEY value has been replaced with an app key in .env.

[driesvints]

Heya. I really doubt this is an issue with Laravel or we’d seen a massive influx of issues because new installs wouldn’t work. This is probably specifically happening for your use case. Please try a support channel:

• Laracasts Forums
• Laravel.io Forums
• StackOverflow
• Discord
• Larachat
• IRC

[WilliamDEdwards]

@driesvints

I really doubt this is an issue with Laravel

I just tested this on a new installation with the following differences:

• Laravel 9.39.0 (instead of 9.36.2)
• PHP 8.1.11 (instead of 8.1.12)

... and the same problem occurs:

williamedwards:~/domains/williamedwards.nl/example-app$ cat .env
APP_ENV=local
williamedwards:~/domains/williamedwards.nl/example-app$ php artisan config:cache

   INFO  Configuration cached successfully.

williamedwards:~/domains/williamedwards.nl/example-app$ php artisan key:generate

   INFO  Application key set successfully.

williamedwards:~/domains/williamedwards.nl/example-app$ cat .env
APP_ENV=local
williamedwards:~/domains/williamedwards.nl/example-app$ php artisan config:cache

   INFO  Configuration cached successfully.

williamedwards:~/domains/williamedwards.nl/example-app$ cat .env
APP_ENV=local

or we’d seen a massive influx of issues because new installs wouldn’t work.

I do not think that is the case. On composer create-project laravel/laravel, a default .env file is created, so this issue would not occur.

[driesvints]

Ah I see. You removed APP_KEY from your env file. That’s not supported. You always need it.

[WilliamDEdwards]

Ah I see. You removed APP_KEY from your env file. That’s not supported. You always need it.

I am aware of that. This bug report is about the message. "Application key set successfully." should not be printed when the application key is not actually set.

[williwlwilliwll]

@driesvints I would ideally like to move APP_KEY out of my .env and into a secret to avoid committing it into source code.

When I moved APP_KEY out into a Kubernetes secret I ran into a problem.

Similarly, when running my project locally I tried moving APP_KEY into a Docker Compose file but encountered the same problem:

services:
   app_service: 
      environment: 
         APP_KEY: base64:blahblah

Is it possible to move APP_KEY out of .env?

[driesvints]

No that's not possible. It's required.

[williwlwilliwll]

@driesvints Thanks for getting back to me so quickly! Can you think of any way that I could move APP_KEY out of the .env file? I suppose I could do something with by appending stdout but that's getting a bit into nasty territory ha.

Am I overthinking this? Is there a value to moving APP_KEY out of your source code (I appreciate this is a subjective question). Cheers!

[driesvints]

I just don't think that's possible. If you can figure out a way to make that work we'd welcome a PR 👍