The application key

Five minutes now, on the day you install. Doing it later is much harder.

What it is

Your .env file contains a line called APP_KEY. It is the master lock for your installation. The system uses it to:

• Encrypt saved passwords and keys — your payment gateway details, SMS provider details and email password are all stored scrambled with it
• Keep everyone's login sessions secure
• Sign QR codes on student and staff ID cards, so a card cannot be faked
• Sign the private links to student documents and certificates
• Sign the delivery-report addresses your SMS provider calls back on

Anyone who knows your application key can, in principle, unlock all of that.

We supply one so you can start immediately

The .env we ship already contains a working key, so the system runs the moment you install it. Nothing is broken as it stands.

Generate your own key before you go live

The supplied key is the same for every customer. Everyone who owns a copy of this system has it.

That means, until you replace it, someone else with a copy could in principle forge a QR attendance card for your school, or produce a valid link to your private student documents.

For a school that is testing, this does not matter. For a school with real students on it, replace the key. It takes five minutes.

When to do it

On installation day, before you configure anything else. Specifically, before you:

• Enter payment gateway details
• Enter SMS or WhatsApp provider details
• Enter your email password
• Print any ID cards

Why the timing matters so much

The key does not only protect data — it unlocks it. Change the key later, and anything already locked with the old key can no longer be opened:

If you change the key after…	What breaks
Saving payment gateway details	They become unreadable — re-enter them
Saving SMS or email details	Same — re-enter them
Printing ID cards with QR codes	Every printed card stops scanning. They were signed with the old key
Setting up SMS delivery reports	The callback address changes — update it with your provider

The ID card row is the one that hurts. Printed cards cannot be re-signed; the school has to print them again. This is why the key is changed on day one, not later.

How to change it

If your hosting gives you terminal or SSH access (any VPS, and hPanel's Business plans), open it in your site folder and run:

php artisan key:generate --force

That writes a fresh, unique key into your .env. You should now see a new APP_KEY=base64:... value in the file. Nothing else needs doing.

If you have no terminal access, contact us and we will supply a key generated for your installation alone.

Never use an online "Laravel key generator"

Search results are full of websites offering to generate a key for you. Using one means a stranger's website has produced — and can keep — the master lock to your students' data. Generate it on your own server, or ask us.

Checking it worked

Open .env and look at the APP_KEY line. It should start with base64: and be a long jumble of characters. If it is empty, the site will show "No application encryption key has been specified" — put the supplied key back and try again.