Secrets and keys

Every production deploy of Qcentic Edge runs on Magic Containers, where storage/ is ephemeral. Secrets live in the provider's env-var mechanism, never on disk. This page lists each secret, how to generate it, and where it goes.

APP_KEY

Stable forever — cookies and sessions depend on it, and rotating it invalidates every existing session. Generate once, store in env, never rotate casually.

php -r "echo 'base64:'.base64_encode(random_bytes(32)).PHP_EOL;"

Passport keys

PEM used to sign OAuth2 access tokens (PASSPORT_PRIVATE_KEY / PASSPORT_PUBLIC_KEY). Same class of secret as APP_KEY — losing the private key invalidates every minted token.

# 1. Generate key files (run from app/, or via docker compose … exec app)
php artisan passport:keys

# 2. Dump as one line (\n escapes) for Magic Containers / single-line env UIs
php -r 'echo str_replace(["\r\n","\n","\r"], "\\n", file_get_contents("storage/oauth-private.key"));'
php -r 'echo str_replace(["\r\n","\n","\r"], "\\n", file_get_contents("storage/oauth-public.key"));'

# 3. Paste into PASSPORT_PRIVATE_KEY / PASSPORT_PUBLIC_KEY (keep BEGIN/END lines)

# 4. Remove disk copies — storage/ is ephemeral on Magic Containers
rm storage/oauth-private.key storage/oauth-public.key

See Passport and OAuth for the full grant matrix and PAT minting.

libSQL auth token

DB_AUTH_TOKEN authorizes the remote libSQL connection (Bunny Database, Turso, or your own sqld). Mint it in the database provider's dashboard and paste it into env alongside DB_URL (libsql://[id].lite.bunnydb.net). Do not rely on Bunny-injected name fallbacks — set both explicitly.

Bunny S3 credentials

Object storage uses the S3-compatible API against a Bunny Storage zone. The env map:

Env var	Source
`AWS_ACCESS_KEY_ID`	zone name
`AWS_SECRET_ACCESS_KEY`	zone password
`AWS_BUCKET`	zone name
`AWS_DEFAULT_REGION`	region code (`de`, `ny`, …) — never a URL
`AWS_ENDPOINT`	`https://{region}-s3.storage.bunnycdn.com`
`AWS_URL`	pull zone hostname (CDN base for `Storage::url()`)

See Environment variables for the full map and the retain_visibility=false flag Bunny requires.

Content API key (optional)

If the Content API plugin is enabled, the API accepts either the API_KEY env var or hashed agk_… Bearer keys minted from the panel API settings page. The hash is stored; the plaintext is shown once. Abilities ({prefix}:create|read|update|delete) are derived from discovered Filament resources.

Storage rules

Never put secrets in storage/ on Magic Containers — the disk is ephemeral and recycled on redeploy.
Use the provider's env-var mechanism (Magic Containers env UI, or .env.docker.prod for self-hosted compose).
Do not commit .env* files — they are gitignored by the template.