Skip to main content

Environment variables

The CLI creates a git-ignored .env with a unique ES256 P-256 signing key and refresh secret. Move production values into a deployment secret manager. Never commit the private JWK.

Express API variables​

DATABASE_URL=file:./dev.db
AUTHENIK8_SIGNING_JWKS='[{"kty":"EC","crv":"P-256","kid":"<key-id>","x":"...","y":"...","d":"...","alg":"ES256"}]'
AUTHENIK8_ACTIVE_KID=<key-id>
AUTHENIK8_ISSUER=http://localhost:3000
AUTHENIK8_AUDIENCE=my-app-api
REFRESH_SECRET=<generated-random-secret>
AUTHENIK8_AGENTS={}
REDIS_URL=memory://

AUTHENIK8_SIGNING_JWKS is a persisted key ring, not a value to regenerate on process startup. AUTHENIK8_ACTIVE_KID selects the private key used for new tokens. Old public keys can remain in the ring while tokens signed by them expire.

REDIS_URL=memory:// selects the local in-process store. Use a redis:// or rediss:// URL for an external service. When REDIS_URL is omitted, REDIS_HOST, REDIS_PORT, and optional REDIS_PASSWORD remain supported. Production rejects memory://.

OAuth variables​

Generated OAuth projects include variables only for the selected providers:

GOOGLE_CLIENT_ID=your-google-client-id
GOOGLE_CLIENT_SECRET=your-google-client-secret
GOOGLE_REDIRECT_URI=http://localhost:3000/auth/google/callback
GITHUB_CLIENT_ID=your-github-client-id
GITHUB_CLIENT_SECRET=your-github-client-secret
GITHUB_REDIRECT_URI=http://localhost:3000/auth/github/callback

The provider dashboard and environment callback URI must match exactly.

Fullstack variables​

WEB_ORIGIN=http://localhost:5173
PORT=3000
DATABASE_URL=postgresql://postgres:postgres@localhost:55432/authenik8?schema=public
REDIS_URL=memory://
AUTHENIK8_LOCAL_DATABASE=embedded
AUTHENIK8_SIGNING_JWKS='[{"kty":"EC","crv":"P-256","kid":"<key-id>","x":"...","y":"...","d":"...","alg":"ES256"}]'
AUTHENIK8_ACTIVE_KID=<key-id>
AUTHENIK8_ISSUER=http://localhost:3000
AUTHENIK8_AUDIENCE=my-app-api
REFRESH_SECRET=<generated-random-secret>
AUTHENIK8_AGENTS={}
SEED_ADMIN_EMAIL=admin@example.com
SEED_ADMIN_PASSWORD=<generated-unique-password>
GOOGLE_REDIRECT_URI=http://localhost:3000/api/auth/oauth/google/callback
GITHUB_REDIRECT_URI=http://localhost:3000/api/auth/oauth/github/callback

The generated .env receives a unique seed-administrator password. .env.example deliberately leaves that password blank. Repeated seeding never elevates, reactivates, or replaces credentials on an existing account.

The fullstack .env.example also documents cookie security, trusted proxy behavior, logging, mail delivery, and seed administrator settings.

Fullstack starts project-local PostgreSQL automatically and stores its data under .authenik8/. Set AUTHENIK8_LOCAL_DATABASE=external when DATABASE_URL points to a database you manage. Production must use external PostgreSQL and a redis:// or rediss:// URL.

For local development, Vite binds to WEB_ORIGIN, proxies /api to the loopback port in PORT, and the embedded PostgreSQL server binds to the loopback port in DATABASE_URL. Port conflicts fail instead of silently moving a service. When changing the API origin, update AUTHENIK8_ISSUER and every enabled OAuth callback URL to match.

Agent identity​

AUTHENIK8_AGENTS={} keeps agent identity disabled. A generated project accepts a JSON agent-to-scope registry only when every identifier and scope passes validation. Enabling token issuance also requires a trusted workload-authentication boundary such as mTLS, cloud workload identity, or a signed client assertion.

The CLI intentionally does not generate a public agent token-minting route.