What it does
The CLI scaffolds and maintains the application boundary. authenik8-core supplies the token, identity, OAuth, session, and optional agent engine used by generated code.
Generated capabilities
| Capability | Description |
|---|---|
| Express and TypeScript | Generates a structured Express API with development and production scripts |
| Fullstack App Kit | Connects React/Vite, Express, shared contracts, a typed client, PostgreSQL, and Redis |
| ES256 access tokens | Uses persisted P-256 signing keys, kid, issuer, audience, expiry, and token purpose |
| Stateful refresh rotation | Rejects reused and concurrently refreshed tokens through Redis |
| Session control | Lists and revokes human sessions, including complete user-wide revocation |
| Identity resolution | Unifies password, Google, and GitHub identities with explicit account linking |
| Agent identity | Supports optional exact-scope machine and delegated identities behind application policy |
| Project diagnostics | Checks structure, manifest drift, secrets, engine versions, and Redis readiness |
| Guarded recipes | Previews and applies narrow post-generation changes with rollback |
| Upgrade policy | Produces read-only version plans and a pinned GitHub Actions gate |
Every generated project includes THREAT_MODEL.md, AGENT_IDENTITY.md, .env.example, and a schema-versioned authenik8.json architecture manifest.