What is the Laravel APP_KEY?
The APP_KEY environment variable is a random 32-byte key that Laravel uses with AES-256-CBC to encrypt session data, cookies, and anything passed through the encrypt() helper or Crypt facade. It is stored in your .env file as APP_KEY=base64:... and must be unique per application and per environment.
Why you need a new key
A fresh .env.example ships with an empty APP_KEY. If you deploy without setting one, or reuse the same key across projects, Laravel throws a RuntimeException: No application encryption key has been specified, and any already-encrypted cookies or sessions become invalid the moment the key changes. Generate a new key for every new application, and rotate it if a key is ever leaked (existing encrypted data becomes unreadable once rotated, so plan a rotation window).
Using the Artisan CLI instead
If you have local access to the project and PHP installed, Laravel's own php artisan key:generate command does the same thing and writes it directly into your .env file. This tool is for cases where you just need a valid key fast — CI pipelines, Docker builds, onboarding docs, or environments without a local PHP install — generated the same way (a cryptographically secure random 32-byte value, base64-encoded) entirely client-side.