A Login 500 Traced to Environment Variables

A healthy API with a broken login

The admin page loaded and the health endpoint responded, but login returned 500. API logs pointed to bcrypt.checkpw and ValueError: Invalid salt, indicating a malformed configured hash rather than an ordinary password mismatch.

Preserve the literal value

Bcrypt hashes contain dollar signs. In this deployment, retaining single quotes around the complete value in .env resolved the issue. The password-hash command already prints a quoted assignment; replacing the entire configuration line avoids copying only part of it.

Reload the environment

After changing the file, the API container was recreated with docker compose -f deploy/docker-compose.yml up -d --force-recreate api.

What to keep from the incident

Inspect hash format without printing credentials. A healthy endpoint does not validate every business route; the exception from the failing request was the useful clue.