Skip to main content

Production checklist

Authenik8 generates infrastructure and security defaults, but deployment and application authorization remain your responsibility.

Identity and secrets​

  • Store AUTHENIK8_SIGNING_JWKS and REFRESH_SECRET in a deployment secret manager.
  • Persist signing keys across restarts. Never generate a new key during application startup.
  • Keep the active private JWK out of source control and logs.
  • Configure exact issuer and audience values for the deployed API.
  • Plan key rotation by keeping previous public keys until their tokens expire.

Services and network​

  • Keep Redis private and use authentication and transport security where supported.
  • Use managed Redis and PostgreSQL endpoints where appropriate.
  • Use HTTPS and configure exact CORS origins.
  • Trust proxy headers only behind a proxy that overwrites untrusted forwarding headers.
  • Set COOKIE_SECURE=true for fullstack production deployments.

Application policy​

  • Add object-level authorization for application resources.
  • Review the generated THREAT_MODEL.md and AGENT_IDENTITY.md.
  • Do not expose agent token issuance without trusted workload authentication.
  • Configure exact OAuth callback URLs and require explicit account linking.
  • Configure transactional email before enabling real recovery and verification flows.

Database and build​

Use deployment migrations instead of development migrations:

npm run build
npx prisma migrate deploy

The fullstack preset builds every workspace and serves the compiled SPA from Express:

npm run build
NODE_ENV=production npm start

Automated boundary checks​

Run Doctor and the upgrade policy during delivery:

npx create-authenik8-app@latest doctor --ci --production --strict
npx create-authenik8-app@latest ops readiness --json
npx create-authenik8-app@latest upgrade --check --json

Use add ci-github to create a pinned managed workflow after committing the package-manager lockfile.

Before a production change or incident response, use the plan-first operational maintenance runbooks for a sanitized production audit, signing-key rotation, OAuth redirect verification, or targeted session revocation.

Secrets

Never commit .env or a private JWK. Doctor checks Git secret-file safety but does not replace repository secret scanning or deployment controls.

Report suspected security vulnerabilities through the private vulnerability-reporting process. Do not publish exploit details in a public issue.