This guide is for Laravel developers who don't want to host their .env file in GitHub repositories and want to securely manage critical information like database passwords and API keys in a production environment.
Uploading sensitive information (database passwords, payment gateway API keys, etc.) in your Laravel project's .env files to GitHub is a major security risk. With Skyversal, you can isolate these variables from your code and manage them securely and encrypted through the Skyversal panel.
1. How Do Environment Variables Work?
With its "Zero-Config" philosophy, Skyversal automatically injects environment variables into your project.
Do I need to change my code?
No. Laravel reads environment variables through configuration files (config/*.php). Skyversal automatically injects these variables into the application during deployment, so your application will work seamlessly even without a physical .env file in the project root.
2. Setup Timeline (Step by Step)
.env file content.3. Must-Have Environment Variables
When deployed, every Laravel project needs at least the following basic environment variables:
| Key | Description | Example Value |
|---|---|---|
| APP_KEY | Laravel encryption key. Mandatory. Generate locally with php artisan key:generate. |
base64:... |
| APP_ENV | Indicates the live environment. Must be production to hide error details. | production |
| APP_DEBUG | Visibility of error details. Must strictly be false in production for security. | false |
| APP_URL | The live URL of your app. Important for generating assets and links. If misconfigured, URL generation, email links, and asset URLs may behave unexpectedly. | https://domain.com |
| DB_* | Your database connection details (DB_HOST, DB_PORT, DB_DATABASE, DB_USERNAME, DB_PASSWORD). | ... |
When you run the php artisan config:cache command in Laravel, your application runs faster but the system no longer reads the .env file (or environment variables directly). It only uses the cached configuration file. Therefore, you must never use the env() function directly inside your code (such as in Controllers or routes). Use the config() helper function instead. If you do, all env() calls will return null after a config:cache.
🏗️ Build Time vs Runtime Variables
When environment variables are read is one of the most confusing topics, especially when compiling frontend assets with Vite.
Build Time
This is the npm run build phase executed when the application is being deployed. Tools like Vite or Next.js statically embed variables into the code.
VITE_.Runtime
This runs when users access your site after it's live. These variables are only read on the server side.
APP_KEY, DB_PASSWORD, etc.❓ Common Problems
Assets fail to load or links point to "localhost"
Symptom: Images are broken or generated email links point to https://localhost.
Cause: The APP_URL environment variable is misconfigured or missing.
Solution: Go to the panel, update APP_URL with your production domain (e.g., https://domain.com), and redeploy.
"No application encryption key has been specified"
The APP_KEY variable is not defined in the Skyversal panel. Copy the key from your local .env file, add it to the Skyversal panel, and redeploy the project.
I added the variable but it didn't update on my site
Environment variables are only read when building or starting the project. To reflect the changes after adding a variable, you must manually redeploy your project using the Deploy button on the panel. Also, if you accidentally committed cached config files (bootstrap/cache) to git after running php artisan config:cache locally, your project will ignore new variables. Use php artisan optimize:clear locally and push the changes to fix this.
🎉 Your Variables Are Now Secure
Your sensitive data is completely isolated from the GitHub repository and secured via encryption within the Skyversal infrastructure.
Now that we have handled the environment variables, we can move on to the Queue Worker, Storage Link, and Scheduler settings that will take your project to the next level.
➜ Laravel Advanced Features Guide