Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

jthorpe's avatar

Best Practices - App Key between Dev and Production?

I'm working on developing an application that requires encrypting a few fields containing personal data. It isn't live yet, so I'm doing some tests on both the production and dev server (Homestead) to make sure everything is working properly in both places.

At one point I need to decrypt the data to see if they've registered before. If I have existing orders from my dev server, they can't be decrypted since the App Key is different.

For a fairly small project, would you make the App Key the same on both dev and production? Or would you setup a test database and modify your git settings so that nothing database related is pushed to the production server?

Thanks for your input!

0 likes
5 replies
ejdelmonico's avatar

@jthorpe I would have to say it is a matter of choice. Personally, I keep them the same because I do not ever commit my .env to a repository. I add the .env after I have deployed to production but before the site is live. Why complicate things when it isn't necessary. I'm sure some others will chime in as well.

Snapey's avatar

.env starts with a period for a reason...

Never commit it to your repository and try not to put anything private in the config files. As for your question, I would keep the key the same locally if its just yourself.

If you are part of a team then you have to question who should be allowed access to production data.

sitmgreg's avatar

I'm looking at this same issue right now with my first laravel project. My usual process from going to dev to production (or moving servers in general: stage, dev, etc) is:

  1. deploy versioned code to production server
  2. sync local configuration files to production
  3. modify files to match environment
  4. seed database

In the case where it was appropriate to have a different APP_KEY, how would you regenerate it? Am I missing any fundamental difference in how laravel works compared with other PHP projects?

martinbean's avatar

@jthorpe You should have different databases for dev and production which should make this a non-issue. If you want to “make sure everything is working properly in both places” then write tests.

Snapey's avatar

@sitmgreg

In the case where it was appropriate to have a different APP_KEY, how would you regenerate it?

php artisan key:generate

2 likes

Please or to participate in this conversation.