Environment Variables

The CLI creates a development .env. Replace its placeholder secrets and service addresses before deployment.

Express API variables

Variable	Description
DATABASE_URL	Prisma connection string. Use SQLite locally or PostgreSQL for production.
JWT_SECRET	Long secret used to sign short-lived access tokens.
REFRESH_SECRET	A different long secret used to sign refresh tokens.
REDIS_HOST / REDIS_PORT	Redis connection used for token state, locks, OAuth state, and limits.

OAuth variables

Variable	Description
AUTHENIK8_OAUTH_PROVIDERS	Comma-separated google, github, or google,github for the OAuth template.
GOOGLE_* / GITHUB_*	Provider client ID, secret, and exact callback URI for enabled providers.

OAuth callbacks

Configure http://localhost:3000/auth/google/callback and/or http://localhost:3000/auth/github/callback.

The provider dashboard and environment value must match exactly.

Full-stack variables

The fullstack preset uses a PostgreSQL URL, a single Redis URL, an exact web origin, and API-prefixed OAuth callbacks.

Variable	Description
WEB_ORIGIN	Exact frontend origin allowed by CORS and cookie-origin checks.
DATABASE_URL	PostgreSQL connection string used by the API workspace.
REDIS_URL	Redis connection used for sessions, refresh rotation, OAuth exchanges, and rate limits.
JWT_SECRET / REFRESH_SECRET	Independent secrets with at least 32 characters each.
COOKIE_SECURE	Set to true when the deployed application uses HTTPS.
TRUST_PROXY	Enable only behind a trusted proxy that overwrites forwarding headers.
RESEND_API_KEY / EMAIL_FROM	Production delivery for verification and recovery messages.
SEED_ADMIN_EMAIL / SEED_ADMIN_PASSWORD	Credentials used by npm run db:seed.

Configure enabled providers with these local callbacks:

http://localhost:3000/api/auth/oauth/google/callback
http://localhost:3000/api/auth/oauth/github/callback

OAuth variables are required only for providers selected during generation.