Auth and tokens
authenik8-core 2.x uses JOSE with ES256 P-256 JWKs for new applications. Generate a private signing key once, persist it in a secret manager, and load the same key ring on every process start.
Refresh flow
Access tokens expire quickly. Refresh tokens rotate and are tracked per session in Redis to reject replay and concurrent reuse.
Middleware
Apply the generated security boundary before application routes:
Guest access
Guest tokens are signed, short-lived, and purpose-bound. Signing is asynchronous in core 2.x.
OAuth and identity
Authenik8 normalizes Google and GitHub callbacks into one identity model. OAuth state is stored in Redis and consumed once.
Redis
Redis is part of the authentication security boundary. It backs refresh rotation, human sessions, revocation, OAuth state, identity indexes, agent sessions, locks, rate limiting, and IP controls.
Agent identity
Agent and service identity is optional and disabled in generated projects by default. It uses a distinct token class, exact scopes, actor chains, Redis-backed sessions, and fail-closed registry checks.