As I just realise.
What you have configured was Guardians secret key. But the error message is asking for the :secret_key_base of your endpoint, those are different settings with different meanings.
Still, as secrets, they shouldn’t appear in your public source code repositories, except for maybe the secrets you use for dev only. I tend to keep those simple like "development_only_secret_please_do_not_use_me_in_production" or similar.
