Local security dashboard

Authenik8 Studio is a local, read-only dashboard for applications generated by create-authenik8-app. It combines the source-controlled project manifest, an offline Doctor report, and the version-aware upgrade plan in one actionable view.

npx create-authenik8-app@latest studio

Point it at another project when needed:

npx create-authenik8-app@latest studio ./my-app

Like invoking Prisma Studio, Authenik8 Studio runs only when you request the studio command. It is not imported by generated code and is never started by the generated dev, start, or production commands.

Studio's interface is built with the Astryx component system and a small Authenik8-owned theme layer that shares this documentation site's deep green, mint, and warm-white visual language. The UI is bundled with the CLI package; generated applications do not install React, Astryx, or Studio dependencies.

What Studio shows

A real point-in-time snapshot from the full-stack preset. Findings are presented as actions, while live production readiness remains explicitly unassessed.

• Local security posture and actionable Doctor findings
• Capabilities declared in authenik8.json
• Generated structure, script, manifest, and engine drift
• Current and target generator and authenik8-core versions
• Outstanding upgrade actions
• Production readiness as an explicit, separate assessment
• The highest-priority next command

Studio does not hide findings behind a security score. A passing offline snapshot is useful evidence, not certification.

Preset compatibility

Studio follows the same local snapshot and security path for every generated preset. The content adapts to the manifest:

Preset	Additional capability information
base	Optional Prisma/database configuration
auth	Prisma-backed password identity boundary
auth-oauth	Prisma plus selected Google and/or GitHub providers
fullstack	Workspace API persistence plus selected OAuth providers

Authenik8's compatibility suite generates and renders all four presets through the same Studio contract.

Local security boundary

Studio builds one immutable snapshot when it starts. Doctor uses .env.example in offline mode, holds synthetic validation values only in memory, and does not contact Redis, PostgreSQL, OAuth providers, or the generated application.

Studio reads:

• authenik8.json
• Security-significant generated structure and package declarations
• .env.example variable names and non-secret example semantics
• Installed package metadata when present

Studio does not read, store, or upload:

• .env values
• Passwords or user records
• Access or refresh tokens
• Private signing keys
• Database or Redis contents
• OAuth client secrets
• Analytics or telemetry

The server binds only to 127.0.0.1, validates the request Host, accepts only GET and HEAD, and sends a restrictive Content Security Policy. The snapshot API stays in memory and writes nothing to the generated project.

Production readiness

Studio displays production readiness as Not assessed because a meaningful assessment can contact configured services and exercise the installed identity engine. Run that work explicitly:

npx create-authenik8-app@latest doctor --production

Restart Studio after changes to create a new offline snapshot. It does not watch files, poll the project, or rerun diagnostics for each browser request.

Options and shutdown

Select another loopback port:

npx create-authenik8-app@latest studio --port 5559

Start without opening a browser:

npx create-authenik8-app@latest studio --no-open

Stop Studio with Ctrl+C. There is nothing else to disconnect or remove: Studio creates no project files, generated-app scripts, credentials, hosted connection, or background service.

Failure behavior and troubleshooting

• Missing or invalid authenik8.json stops startup with an actionable error.
• A port conflict stops startup instead of exposing Studio on another interface.
• Missing evidence is failed, skipped, or not assessed—never healthy.
• If the browser does not open, use the loopback URL printed in the terminal.
• If the snapshot is stale, stop Studio and run the command again.

Local Studio is available without an account. A future hosted team dashboard can add shared history and notifications without changing this local boundary.

Availability and support

Studio is a Community feature and supports the generator's Node.js versions: ^20.19, ^22.12, and >=24. CI exercises Linux, Windows, and macOS. Generated applications do not install React, Astryx, or Studio dependencies.

Additional troubleshooting:

• If authenik8.json is missing, run Studio from a current generated project or pass its directory explicitly.
• If the identity engine is missing, install the generated application's dependencies and restart Studio.
• Studio is a point-in-time snapshot, not real-time. Stop and rerun it after project changes.
• If the port is occupied, choose another with --port.
• If the browser does not open, use the printed loopback URL.
• Production stays Not assessed until you explicitly run doctor --production.