PHP Notice: Key file "file:///.../public/../public.key" permissions are not correct, recommend changing to 600 or 660 instead of 644 in /.../vendor/league/oauth2-server/src/CryptKey.php on line 63

This warning makes no sense. It is a public key. Anybody can have it.