w7corp/easywechat · error · InvalidConfigException

token or aes_key cannot be empty.

Error message

token or aes_key cannot be empty.

What it means

MiniApp\Application::getEncryptor() builds the message-push Encryptor from the account's token and aes_key and throws this InvalidConfigException when either is empty. It is reached directly via $app->getEncryptor(), and indirectly from getServer() whenever an aes_key is configured but the token is missing (src/MiniApp/Application.php:108).

Source

Thrown at src/MiniApp/Application.php:82

    public function setAccount(AccountInterface $account): static
    {
        $this->account = $account;

        return $this;
    }

    /**
     * @throws InvalidConfigException
     */
    public function getEncryptor(): Encryptor
    {
        if (! $this->encryptor) {
            $token = $this->getAccount()->getToken();
            $aesKey = $this->getAccount()->getAesKey();

            if (empty($token) || empty($aesKey)) {
                throw new InvalidConfigException('token or aes_key cannot be empty.');
            }

            $this->encryptor = new Encryptor(
                appId: $this->getAccount()->getAppId(),
                token: $token,
                aesKey: $aesKey,
                receiveId: $this->getAccount()->getAppId()
            );
        }

        return $this->encryptor;
    }

    public function setEncryptor(Encryptor $encryptor): static
    {
        $this->encryptor = $encryptor;

        return $this;

View on GitHub (pinned to f0cf0a8b83)

Solutions

1. Set both 'token' and 'aes_key' (the 43-char EncodingAESKey) in the MiniApp config, matching 开发管理-消息推送 in the mini program console.
2. Check the exact snake_case key names: token, aes_key.
3. If you do not use message push, avoid getServer()/getEncryptor() code paths.
4. Verify env loading in the exact runtime that serves the callback (queue worker, fpm, octane).

Example fix

// before: login-only config
$app = new MiniApp\Application(['app_id' => $id, 'secret' => $secret]);
$app->getServer()->serve(); // throws
// after: add push credentials from the console
$app = new MiniApp\Application([
    'app_id' => $id, 'secret' => $secret,
    'token' => env('MINIAPP_TOKEN'),
    'aes_key' => env('MINIAPP_AES_KEY'),
]);

if (strlen((string) ($config['aes_key'] ?? '')) !== 43 || trim((string) ($config['token'] ?? '')) === '') { throw new RuntimeException('MiniApp push requires token and the 43-char aes_key (EncodingAESKey)'); }

try { $encryptor = $app->getEncryptor(); } catch (\EasyWeChat\Kernel\Exceptions\InvalidConfigException $e) { throw new RuntimeException('MiniApp push credentials missing: set token and aes_key from the console', 0, $e); }

When it happens

Trigger: Mini app config containing only app_id/secret (enough for API calls) while the code path touches message push — $app->getServer()->serve(), encrypted replies, or getEncryptor(); token set but aes_key empty or vice versa; keys present under wrong names ('aesKey' instead of 'aes_key').

Common situations: Starting with login/payment flows and later adding push notifications without updating config; copying config arrays between OfficialAccount and MiniApp apps with different key names; env vars not loaded in the worker/fpm runtime executing the callback.

Related errors

• "%s" cannot be empty.\r\n
• -40006
• -40005
• $blockSize may not be more than 32 bytes(256 bits)
• Read the $certificate failed, please check it whether or nor

AI-assisted analysis of w7corp/easywechat@f0cf0a8b83 (2026-08-21). Data as JSON: /api/errors/a91e442439c7035c. Report an issue: GitHub.