# RuntimeError: The session is unavailable because no secret key was set. Set the secret_key on the application to something unique and secret.

- **ID:** `python/flask-secret-key-must-be-set`
- **Domain:** python
- **Category:** config_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

app.secret_key is None/empty, but session, flash, or CSRF (Flask-WTF) requires signing.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| 2.x | active | — | — |
| 3.x | active | — | — |

## Workarounds

1. **** (95% success)
   ```
   app.config['SECRET_KEY'] = os.environ['FLASK_SECRET_KEY']  # set a 32+ byte random value in env
   ```
2. **** (90% success)
   ```
   Generate once: `python -c 'import secrets; print(secrets.token_hex(32))'` and store in .env / secrets manager.
   ```

## Dead Ends

- **** — Committed secret leaks; session forgery risk. (95% fail)
- **** — Rotates key each request; sessions invalidate immediately. (90% fail)