CLI reference
Generation
create-authenik8-app <project-name> [options]
create-authenik8-app create <project-name> [options]
| Option | Purpose |
|---|---|
--package-manager npm|pnpm|bun | Select the installer for an Express preset |
--yes, --non-interactive | Generate without prompts |
--preset base|auth|auth-oauth|fullstack | Select a deterministic preset |
--prisma, --no-prisma | Choose Prisma for the base preset |
--database sqlite|postgresql | Choose the database for a Prisma-backed Express preset |
--oauth google,github, --no-oauth | Select OAuth providers or explicitly disable them for fullstack |
--git, --no-git | Choose Git initialization |
--runtime node|bun | Choose the PM2 runtime for production-ready Express output |
--production-ready | Add PM2 configuration to an Express preset |
--no-install | Generate without installing dependencies |
--resume | Continue an interrupted interactive generation |
--version | Print the installed CLI version |
Project commands
Diagnostics, currently in beta:
create-authenik8-app doctor [directory] [options]
| Option | Purpose |
|---|---|
--deep | Run isolated Redis and authenik8-core runtime checks |
--production | Run deep checks plus production policy checks |
--fix | Show a fix plan, apply eligible fixes, and verify them |
--dry-run | Preview fixes without changing the project; requires --fix |
--check A8-... | Run one stable diagnostic and its prerequisites |
--explain A8-... | Explain one diagnostic without running the project |
--json | Print schema-versioned JSON |
--ci | Print deterministic output without colour or prompts |
--strict | Return exit code 1 when warnings are present |
--report | Write a sanitized support report under .authenik8/reports |
--offline | Skip checks that require live services |
Plain Doctor runs fast read-only checks. Production mode includes deep runtime checks. Fixes are classified as safe, confirmation-required, or manual. Doctor shows its plan before mutation, captures original file state in memory, reruns affected checks, and restores captured state when verification fails.
Post-generation recipes:
create-authenik8-app add <recipe> [directory] [--dry-run]
create-authenik8-app add --list
Upgrade policy:
create-authenik8-app upgrade [directory] [--check] [--json]
create-authenik8-app upgrade [directory] --acknowledge [--json]
Upgrade planning is read-only. --acknowledge is the explicit final write after the exact installed engine and deep auth diagnostics have been verified; it reruns the focused deep boundary and then updates only release metadata in authenik8.json.
Run any command with --help for its usage text.
Generated Express README commands use the package manager selected during generation. The terminal handoff also prints a preset-specific first-success path for the JWT boundary, password API, or fullstack seeded administrator.