CLI reference
Generation
create-authenik8-app <project-name> [options]
create-authenik8-app create <project-name> [options]
| Option | Purpose |
|---|---|
--package-manager npm|pnpm|bun | Select the installer for an Express preset |
--yes, --non-interactive | Generate without prompts |
--preset base|auth|auth-oauth|fullstack | Select a deterministic preset |
--prisma, --no-prisma | Choose Prisma for the base preset |
--database sqlite|postgresql | Choose the database for a Prisma-backed Express preset |
--oauth google,github, --no-oauth | Select OAuth providers or explicitly disable them for fullstack |
--frontend react|lovable | Choose the frontend for the fullstack preset: the included React reference (react, default) or Lovable-driven frontend with generated integration pack (lovable) |
--git, --no-git | Choose Git initialization |
--runtime node|bun | Choose the PM2 runtime for production-ready Express output |
--production-ready | Add PM2 configuration to an Express preset |
--no-install | Generate without installing dependencies |
--resume | Continue an interrupted interactive generation |
--version | Print the installed CLI version |
Project commands
Diagnostics, currently in beta:
create-authenik8-app doctor [directory] [options]
| Option | Purpose |
|---|---|
--deep | Run isolated Redis and authenik8-core runtime checks |
--production | Run deep checks plus production policy checks |
--fix | Show a fix plan, apply eligible fixes, and verify them |
--dry-run | Preview fixes without changing the project; requires --fix |
--check A8-... | Run one stable diagnostic and its prerequisites |
--explain A8-... | Explain one diagnostic without running the project |
--json | Print schema-versioned JSON |
--ci | Print deterministic output without colour or prompts |
--strict | Return exit code 1 when warnings are present |
--report | Write a sanitized support report under .authenik8/reports |
--offline | Skip checks that require live services |
Plain Doctor runs fast read-only checks. Production mode includes deep runtime checks. Fixes are classified as safe, confirmation-required, or manual. Doctor shows its plan before mutation, captures original file state in memory, reruns affected checks, and restores captured state when verification fails.
Frontend validation for AI-buildered interfaces:
create-authenik8-app doctor frontend --target lovable [directory] [options]
| Option | Purpose |
|---|---|
--target lovable | Validate a Lovable-generated frontend against the Authenik8 boundary |
--json | Print schema-versioned JSON, for CI |
--runtime --api-url <url> --origin <url> | Add safe live checks against a deployed API and exact frontend origin |
The frontend validator detects browser token storage, duplicate authentication calls, Supabase or Lovable Cloud auth, exposed secrets or private JWKs, unsafe CORS, trusted editable roles, direct admin access, and missing client configuration. A failure exits non-zero.
Local security dashboard:
create-authenik8-app studio [directory] [--port <number>] [--no-open]
Studio is opt-in and read-only. It combines safe authenik8.json metadata, one
offline Doctor snapshot, and the version-aware upgrade plan on a loopback-only
server. It is never started by generated application commands. Review the
local security dashboard guide for its complete data and failure
boundaries.
Operational maintenance:
create-authenik8-app ops readiness [directory] [--json]
create-authenik8-app ops audit production [directory] [--json]
create-authenik8-app ops verify oauth [google|github] [directory] [--json]
create-authenik8-app ops rotate signing-key [directory] [options]
create-authenik8-app ops revoke user <user-id> [directory] --all-sessions [options]
Rotation and revocation are plan-only without --apply. Applying rotation
requires --confirm-active-kid. Applying revocation requires the exact target
in --confirm-user plus an operator --reason. See
Operational auth maintenance for the
two-phase rotation and partial-revocation contracts.
Post-generation recipes:
create-authenik8-app add <recipe> [directory] [--dry-run]
create-authenik8-app add --list
Upgrade policy:
create-authenik8-app upgrade [directory] [--check] [--json]
create-authenik8-app upgrade [directory] --acknowledge [--json]
Upgrade planning is read-only. --acknowledge is the explicit final write after the exact installed engine and deep auth diagnostics have been verified; it reruns the focused deep boundary and then updates only release metadata in authenik8.json.
Run any command with --help for its usage text.
Generated Express README commands use the package manager selected during generation. The terminal handoff also prints a preset-specific first-success path for the JWT boundary, password API, or fullstack seeded administrator.