Have you inspected the logs in storage/logs/laravel.log for any errors?
[2026-08-09 04:24:01] production.ERROR: The MAC is invalid. {"userId":1,"exception":"[object] (Illuminate\\Contracts\\Encryption\\DecryptException(code: 0): The MAC is invalid. at /app/vendor/laravel/framework/src/Illuminate/Encryption/Encrypter.php:189)
Describe the bug
Error 500 on attempting to log in. laravel.log shows above error, no other logs I could find show errors.
Steps To Reproduce
Migrated from docker to truenas scale apps, which involved changing the db name. Used phpmyadmin to export the db from the old install (renaming in the process) and import to the new install. The data is there in the db, I just can’t log in.
Expected Behavior
To be able to log in, ideally.
Additional context
Still have the old docker db and it still runs, so starting the migration from scratch is an option if it comes to that.
Ah, that makes sense. Only one problem: the setup page for the truenas app only lets me input 32 characters for the app key, and the one from my env file is longer than that (base64 encoded).
Alas, only to input a different 32-character value.
I also tried decoding the base64 from the env file, but that only yielded 27 characters (I suspect the remaining characters were non-printable in UTF-8).
Is there a way to change the app key in the old docker db? Then I could redo the transfer.
Update edit: Converting the base64 to hex, then the hex to ASCII yields 31 characters (yay improvement!), but I know that the missing character is a null. Just my luck lol.
It’s a known issue with the TrueNAS App catalog’s UI schema—it enforces a strict 32-character limit on that field and completely chokes on standard 44-character base64:... strings.
How you resolve this depends on whether you’re migrating an existing setup or starting fresh.
If you are migrating existing data
You absolutely must keep your existing base64 key, or the app won’t be able to decrypt your database. To bypass the TrueNAS UI restriction, you can trick the form and override the value at the container level:
1.Satisfy the UI constraint:
Enter a dummy 32-character string (e.g., exactly 32 as) into the primary “App Key” field so the form lets you proceed.
**2.Override the variable:**Container runtime prioritizes explicit variables over the template.
Scroll down to the Additional Environment Variables section. Add a new variable with the name APP_KEYand paste your actual, full base64:... string as the value.
Fallback: If your specific TrueNAS version blocks duplicate variables during deployment, skip the UI catalog entirely and use the Install via YAML option to deploy using standard Docker Compose where you control the env vars freely.
If this is a brand new setup
If the .env file is just from a fresh initialization and you haven’t created any data yet, you can skip the base64 format entirely.
Generate a standard 32-character alphanumeric string (e.g., using Str::random(32)) and paste it directly into the TrueNAS App Key field. The AES-256-CBC encrypter requires exactly 32 bytes and will accept a plain 32-character string perfectly fine without the base64: prefix.
I migrated from a cloud vm installed bare metal to a docker install on-prem. I rebuilt the core system until it was working enough to login and then I downloaded a backup from the cloud install and then imported that into the new installation. Worked great. Data, customers, invoices, gateways etc all moved over. I had to do a little tweaking to some odds and ends (notification emails didn’t transfer) but otherwise it worked swimmingly. Both installs had different app keys.