Skip to main content

Production Checklist

Authenik8 generates infrastructure and secure defaults, but deployment and application authorization remain your responsibility.

Before deploying​

  • ✓ Replace generated development secrets with long, unique production values
  • ✓ Keep Redis private and use managed Redis/PostgreSQL endpoints where appropriate
  • ✓ Use HTTPS and review CORS and proxy-header settings
  • ✓ Run npx prisma migrate deploy instead of development migrations
  • ✓ Configure exact OAuth callback URLs for the deployed host
  • ✓ Read the generated THREAT_MODEL.md and add business-level authorization
  • ✓ For the fullstack preset, set an exact HTTPS WEB_ORIGIN, COOKIE_SECURE=true, and a trusted-proxy policy
  • ✓ Configure transactional email before enabling real recovery and verification flows

Deploy commands​

npm run build
npx prisma migrate deploy

The fullstack preset builds every workspace and starts Express, which serves the API and compiled SPA:

npm run build
NODE_ENV=production npm start

:::warning Secrets Never commit .env to version control. Use environment variables or a secrets manager in production. :::