# Passport keys and Excel login

Passport requires a persistent matching private/public key pair. By default it
reads `storage/oauth-private.key` and `storage/oauth-public.key` as the PHP-FPM
user. Alternatively, configure both `PASSPORT_PRIVATE_KEY` and
`PASSPORT_PUBLIC_KEY` through the deployment secret manager. Refresh the
Laravel configuration cache after changing environment secrets.

For an existing environment, first restore the original matching pair from its
secure backup or secret manager. Do not replace an existing key or use
`passport:keys --force` as a routine deployment step: changing the pair
invalidates previously issued access tokens. Persist and back up the pair
outside disposable release directories, and share the same pair across all
application instances.

For a new environment with no existing pair or tokens, generate it once from the
application directory:

```bash
php artisan passport:keys --no-interaction
sudo chown www-data:www-data storage/oauth-private.key storage/oauth-public.key
sudo chmod 640 storage/oauth-private.key storage/oauth-public.key
sudo -u www-data test -r storage/oauth-private.key
sudo -u www-data test -r storage/oauth-public.key
```

Replace `www-data` with the actual PHP-FPM user and group. If only one key is
present, restore its matching counterpart; do not generate over it. Ensure the
web user can traverse the parent directories. After restoring or configuring
keys, retry Excel login and the OAuth token exchange. Review protected Laravel
logs if it still fails. The normal post-deploy script preserves existing keys
and sets their file permissions to 640 when it fixes storage permissions.