Laravel: No application encryption key has been specified.
APP_KEY is empty in the environment Laravel actually loaded, so it cannot encrypt cookies or sessions. On a fresh clone that just means .env was never created. In production it is usually a cached config from before the key was set, or a container whose environment does not include the variable even though the .env file on disk does.
Quick fix
Read the commands before running them. Anything that restarts a service, deletes data or changes permissions should be tried on a non-production system first.
# Is the key set where Laravel looks?
grep '^APP_KEY=' .env
php artisan about | grep -i -A2 environment
# Fresh install: create .env and a key
cp .env.example .env
php artisan key:generate
# Production: a stale config cache ignores .env entirely
php artisan config:clear
php artisan config:cache
# Containers: pass the key as a real environment variable
# docker run -e APP_KEY=base64:... app
# Never regenerate the key on a live site: existing sessions and
# encrypted data become unreadableHow to diagnose PHP errors
PHP errors are dominated by per-request resource limits (memory_limit, max_execution_time) and by autoloading. Class-not-found errors are almost never missing code. They are a namespace that does not match the PSR-4 mapping, or a stale Composer autoload map. Laravel adds a caching layer that produces genuinely confusing errors when configuration is cached with the wrong environment.
If the quick fix above does not resolve it, work through these steps. They apply to this whole class of error, not just to this one message, which is usually what saves the time.
- Read the real limits from the running process, not from a config file:
php -i | grep -E 'memory_limit|max_execution_time'. CLI and FPM have separate configurations. - Regenerate the autoload map with
composer dump-autoload -obefore investigating a class-not-found error any further. - For Laravel, clear cached config and routes with
php artisan optimize:clear. A config cache built in the wrong environment causes errors that survive every code change. - Enable full error display in development (
display_errors=On,error_reporting=E_ALL). The default production settings hide the cause. - For PDO connection refusals, test the same credentials with the database's own CLI client to separate PHP configuration from database access.
Tools worth reaching for
php -icomposer dump-autoload -ophp artisan optimize:clearXdebugtail -f storage/logs/laravel.log
Authoritative references
Primary documentation for this error, worth reading before applying any fix in production.
Related PHP errors
- Allowed memory size exhaustedThe PHP script exceeded the configured memory_limit. Usually caused by loading large…
- Class 'X' not foundPHP cannot find the specified class. Usually caused by a missing use statement, incorrect…
- Composer detected issues in your platform: Your Composer dependencies requireSince Composer 2, vendor/composer/platform_check.php runs on every request and stops the app…
- Composer: Your lock file does not contain a compatible set of packagescomposer install found that the versions pinned in composer.lock cannot run here, almost…
- Laravel: 419 Page ExpiredThe CSRF token sent with the form did not match the session, and Laravel answers with 419…
- Laravel: Target class [X] does not existLaravel container cannot resolve the class. Usually due to missing 'use' statement, typo, or…
- Laravel: Vite manifest not found at: /var/www/public/build/manifest.jsonThe @vite directive reads public/build/manifest.json to find the hashed asset filenames, and…
- Maximum execution time exceededThe PHP script ran longer than the max_execution_time setting allows. Default is usually 30…
Browse other categories
- HTTP 494xx client errors, 5xx server errors, redirects, headers and protocol problems.
- JavaScript 42npm resolution, async pitfalls, hydration, memory limits and runtime type…
- Database 41Connections, deadlocks, constraints, replication and memory limits.
- AI 35Rate limits, context windows, GPU memory and model-serving failures.
- Network 35Refused connections, timeouts, resets, MTU problems and port exhaustion.
- Python 35Imports, virtual environments, encoding, concurrency and dependency conflicts.
- Kubernetes 34CrashLoopBackOff, ImagePullBackOff, OOMKilled, RBAC, scheduling and storage.
- Docker 27Daemon connectivity, disk space, image pulls, ports and architecture mismatches.
- System 26Disk space, systemd units, file descriptors, OOM killer and scheduled jobs.
- Cloud 25IAM permissions, quotas, service limits and credential failures.
- Security 25JWT validation, CSRF, OAuth grants, SELinux, SSH host keys and CSP.
- TLS 24Untrusted authorities, expiry, hostname mismatch, chains and cipher negotiation.
Something missing or wrong?
This entry is maintained by hand. If the fix is out of date, incomplete, or you have a better one, email a correction and it will be reviewed.