This guide is for Laravel developers who don't want to host their .env file in GitHub repositories and want to securely manage critical information like database passwords and API keys in a production environment.
Uploading sensitive information (database passwords, payment gateway API keys, etc.) in your Laravel project's .env files to GitHub is a major security risk. With Skyversal, you can isolate these variables from your code and manage them securely and encrypted through the Skyversal panel.
1. How Do Environment Variables Work?
With its "Zero-Config" philosophy, Skyversal automatically injects environment variables into your project.
Do I need to change my code?
No. Since Laravel reads variables using the env() function in the background, your project running on Skyversal will seamlessly read these variables entered in the panel as if there were an actual .env file in the root directory.
2. Setup Timeline (Step by Step)
.env file content.3. Must-Have Environment Variables
When deployed, every Laravel project needs at least the following basic environment variables:
| Key | Description | Example Value |
|---|---|---|
| APP_KEY | Laravel encryption key. Mandatory. Generate locally with php artisan key:generate. |
base64:... |
| APP_ENV | Indicates the live environment. Must be production to hide error details. | production |
| APP_DEBUG | Visibility of error details. Must strictly be false in production for security. | false |
| APP_URL | The live URL of your app. Important for generating assets and links. | https://domain.com |
| DB_* | Your database connection details (DB_HOST, DB_PORT, DB_DATABASE, DB_USERNAME, DB_PASSWORD). | ... |
When you run the php artisan config:cache command in Laravel, your application runs faster but the system no longer reads the .env file (or environment variables directly). It only uses the cached configuration file. Therefore, you must never use the env() function directly inside your code (such as in Controllers or routes). Use the config() helper function instead. If you do, all env() calls will return null after a config:cache.
❓ Common Problems
"No application encryption key has been specified"
The APP_KEY variable is not defined in the Skyversal panel. Copy the key from your local .env file, add it to the Skyversal panel, and redeploy the project.
I added the variable but it didn't update on my site
Environment variables are only read when building or starting the project. To reflect the changes after adding a variable, you must manually restart your project using the Deploy button on the panel.
🎉 Your Variables Are Now Secure
Your sensitive data is completely isolated from the GitHub repository and secured via encryption within the Skyversal infrastructure.
Now that we have handled the environment variables, we can move on to the Queue, Storage Link, and Cron (Scheduler) settings that will take your project to the next level.
➜ Laravel Advanced Features Guide