# Troubleshooting

| Symptom | Likely cause / fix |
|---|---|
| "This application is not configured yet" (503) | `APP_KEY` not 64 hex chars, `DB_*` missing, or a PHP extension (`pdo_mysql`, `bcmath`, `sodium`, `curl`, `mbstring`) not loaded. Set `APP_DEBUG=true` locally to see which. |
| Blank page / 500 | check `storage/logs/app-YYYY-MM-DD.log` and the PHP error log; quote the `request_reference` shown in the JSON/headers. |
| `/assets/...` 404 or app routes 404 | document root is not `public/`, or rewrite is missing (nginx `try_files`, Apache `mod_rewrite` + `AllowOverride All`). |
| CSRF errors after login/idle | session expired: reload. Behind a proxy make sure `Host`/`Origin` match and `TRUSTED_PROXIES` is set. |
| Cookies not stored | `COOKIE_SECURE=true` but site served over HTTP; use HTTPS or `COOKIE_SECURE=auto` locally. |
| "Buy" buttons disabled / "payments unavailable" | no network in `ENABLED_NETWORKS`, no active receiving address for it, provider not configured (ETH needs `ETH_API_KEY`), or purchases switched off in System Settings. |
| "Prices are temporarily unavailable" | rate provider unreachable or the price failed the sanity check (USDT outside 0.90 to 1.10, BTC outside range). Check `RATE_PROVIDER_*`; optional `USDT_PEG_FALLBACK_RATE`. |
| Payment sent but order stays "pending" | cron not running (`reconcile-payments.php`), wrong coin/network/contract, or the amount is ambiguous with another open order: see Admin > Payments > Unmatched transfers; approve with the tx hash. |
| Order "expired" but customer paid | late payment: Admin > Payments > Needs review > Inspect > approve with the transaction hash (re-verified on-chain). |
| Funding "unavailable" | `CROWDSOURC_BASE_URL`/`API_KEY` blank or funding switched off in System Settings. |
| Funding stuck "Still processing" / "Checking status" | provider has not confirmed. Cron `reconcile-funding.php` checks every minute; Admin > Funding > Inspect > "Check status". Only if the provider has no record and you have evidence, use "Manual resolution". Never re-submit. |
| Admin locked out | wait 15 min (lockout) or `php bin/create-admin.php --reset-password=EMAIL`. |
| `bin/create-admin.php` refuses to run | setup is locked after the first admin; use `--additional`. |
| `bin/migrate.php` fails creating triggers | migration user lacks `TRIGGER`; grant it or rerun with `--skip-hardening` (then enforce append-only another way). |
| Recovery key lost | not recoverable by design. Create a new one in Settings while still signed in. |
| QR not drawn | payload too long for the built-in encoder (versions 1-10); the address and amount are still shown to copy. |