### Support guidelines
- [x] I'm smart and I read the [support guidelines](https://github.com/firefly-iii/firefly-iii/blob/main/.github/support.md)
### Use of AI
- [ ] I'm a real person and wrote this bug without assistance from AI.
### I've found a bug and checked that ...
- [x] ... [the documentation](https://docs.firefly-iii.org/) does not mention anything about my problem
- [x] ... there are no open or closed issues that are related to my problem
- [x] ... it's [definitely a Firefly III issue, not me](https://github.com/firefly-iii/firefly-iii/blob/main/.github/its_you_not_me.md)
### Description
In Firefly III Data Importer v2.3.4, opening the Enable Banking authentication page returns HTTP 500 when ENABLE_BANKING_PRIVATE_KEY is unset or empty. The page only loads when I set ENABLE_BANKING_PRIVATE_KEY=/dev/null as a workaround.
### Debug information
Debug information generated at 2026-09-17 18:51:48 Europe/Amsterdam for Firefly III Data Importer version **2.3.4**.
| System information |
|---|
| Item | Value |
|---|
| Version | 2.3.4 |
| Build | #1238, base #405 |
| System | PHP 8.5.8, Linux, fpm-fcgi |
| App information |
|---|
| Item | Value |
|---|
| Timezone | Europe/Amsterdam, Europe/Vienna |
| Environment | production |
| Debug mode | false, cache 'file' |
| Log level | debug, stack |
| Display errors | Off, ALL errors |
| BCscale | 12 |
| Trusted proxies | ** |
| User information |
|---|
| Item | Value |
|---|
| User agent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0 |
### Steps to reproduce
1. Run Firefly III Data Importer v2.3.4 using Docker.
2. Do not configure ENABLE_BANKING_APP_ID.
3. Do not configure ENABLE_BANKING_PRIVATE_KEY, or leave it empty.
4. Open the Data Importer start page.
5. Click "Authenticate" next to Enable Banking.
6. The browser opens /authenticate-flow/eb.
7. The page returns HTTP 500 instead of displaying the form where the Enable Banking Application ID and private key can be entered.
### Additional info
The relevant log output is:
[2026-09-17 10:54:20] production.DEBUG: Now in AuthenticateController::index (/authenticate) with flow "eb"
[2026-09-17 10:54:20] production.DEBUG: No Enable Banking App ID in session, will return config variable.
[2026-09-17 10:54:20] production.ERROR: The Enable Banking App ID in the configuration is empty! Did you set ENABLE_BANKING_APP_ID?
[2026-09-17 10:54:20] production.DEBUG: No Enable Banking private key in session, will return config variable!
[2026-09-17 10:54:20] production.DEBUG: Enable Banking private key is a file, will try to read it.
[2026-09-17 10:54:20] production.ERROR: file_get_contents(): Read of 12288 bytes failed with errno=21 Is a directory
The exception occurs at:
/var/www/html/app/Services/EnableBanking/Authentication/SecretManager.php:99
The relevant code obtains the empty configuration value and passes it to realpath():
$privateKey = (string) config('eb.private_key');
if (false !== realpath($privateKey) && file_exists(realpath($privateKey)) && is_readable(realpath($privateKey))) {
$privateKey = file_get_contents(realpath($privateKey));
}
When $privateKey is an empty string, realpath('') resolves to the current working directory. Because that directory exists and is readable, the condition succeeds and file_get_contents() attempts to read the directory.
Setting the following environment variable prevents the HTTP 500 error and allows the authentication form to load:
ENABLE_BANKING_PRIVATE_KEY=/dev/null
This is only a workaround. A possible fix would be to reject an empty value and verify that the resolved path is a regular file before calling file_get_contents(), for example by checking:
$privateKey !== ''
is_file($path)
is_readable($path)
Expected behavior:
When no Enable Banking Application ID or private key is configured, /authenticate-flow/eb should display the authentication form and allow the credentials to be entered.
Actual behavior:
The route returns HTTP 500 before the authentication form is displayed.