Skip to main content

Quickstart

Requirements​

  • Node.js 20.19+, 22.12+, or 24+
  • npm for the fullstack workspace
  • npm, pnpm, or Bun for Express presets
  • Docker with Compose only when you choose the optional container workflow

Every preset provides an in-process Redis-compatible store for local development. Production deployments require an external Redis service.

Generate a project​

npx create-authenik8-app my-app

The CLI uses the invoking package manager when it can identify one. Otherwise, it defaults to npm. You can select one explicitly for an Express preset:

npx create-authenik8-app my-api --package-manager pnpm

Choose the fullstack application for the complete App Kit, or select one of the three focused Express API presets.

Interactive fullstack generation includes password authentication and leaves OAuth providers unselected by default. This provides a working local sign-in path without requiring a Google or GitHub provider dashboard.

Run the fullstack application​

cd my-app
npm run dev

That command starts project-local PostgreSQL, applies the shipped migration, seeds the administrator idempotently, and starts the development watchers. Local auth state uses an in-process Redis-compatible store. Open http://localhost:5173 by default.

WEB_ORIGIN, PORT, and DATABASE_URL define the local web, API, and embedded-database ports. Vite proxies /api to the configured API port and fails clearly if its configured web port is occupied. When changing the API origin, keep AUTHENIK8_ISSUER and enabled OAuth callback URLs aligned with it.

The generated .env contains SEED_ADMIN_EMAIL and a unique random SEED_ADMIN_PASSWORD. Use those local values for the first sign-in, then change the password before sharing the environment. Repeated seeding reuses only an active password administrator and never elevates, reactivates, or replaces credentials on an existing account.

Run an Express API​

cd my-app
npm run db:migrate # Skip only for JWT-only without Prisma
npm run dev

The API runs at http://localhost:3000. Docker is not required for Redis. If PostgreSQL was selected, start it with npm run docker:up or point DATABASE_URL to an existing database before migrating.

Validate the result​

After configuring the generated .env, run Doctor whenever you need to diagnose or verify the project.

Beta

Doctor's findings are focused diagnostic evidence, not a guarantee that the entire application is secure.

npx create-authenik8-app@latest doctor

Use npx create-authenik8-app@latest doctor --deep before relying on refresh and session behavior. Use npx create-authenik8-app@latest doctor --production against production configuration before deployment.

Generation runs a separate internal auth-boundary validation before reporting success. When installation is skipped, the missing engine is an expected onboarding warning while the remaining generated boundary is still validated.

Open the opt-in local dashboard when you want one view of posture, capabilities, drift, and outstanding upgrades:

npx create-authenik8-app@latest studio

Studio stays offline and does not start with the generated application. See Local security dashboard for its security boundary.

Resume an interrupted interactive run​

npx create-authenik8-app my-app --resume

Use non-interactive generation for deterministic scripts. Non-interactive generation cannot be combined with --resume.