Operational auth maintenance

create-authenik8-app ops provides repeatable, plan-first runbooks for production readiness, OAuth configuration, signing-key rotation, and targeted session revocation.

Run commands from a generated project so the CLI uses that project's installed authenik8-core version and environment:

npx create-authenik8-app@latest ops --help

All operations support schema-versioned --json output. JSON and human output exclude signing keys, refresh secrets, OAuth secrets, Redis credentials, bearer values, and tokens.

Readiness and production audit

Run strict production Doctor checks, including isolated Redis and installed engine lifecycle checks:

npx create-authenik8-app@latest ops readiness

Warnings make readiness fail. The command is read-only and does not write a report.

Use the same diagnostic boundary and write a sanitized local report under .authenik8/reports:

npx create-authenik8-app@latest ops audit production

This is a configuration and runtime-readiness audit. It is not a penetration test, compliance certification, or replacement for deployment monitoring.

OAuth redirect verification

Verify every enabled provider or select one:

npx create-authenik8-app@latest ops verify oauth
npx create-authenik8-app@latest ops verify oauth google

The command requires the provider's Doctor configuration diagnostic to pass, then loads the installed engine and proves that redirect initialization creates a canonical authorization URL with 256-bit, one-use state. State remains in an isolated in-memory store. Callback handling stops immediately after state consumption, before any provider request.

The assurance level is redirect-initialization. It does not contact Google or GitHub, validate client credentials, or complete a sign-in. A real browser sign-in remains the end-to-end provider test.

Two-phase signing-key rotation

Rotation uses the installed engine's generateSigningJwk(), createAuthenik8(), getJwks(), and verifyAccessTokenWithJwks() contracts. It prints a plan by default.

Preview and stage a new private key while the current key remains active:

npx create-authenik8-app@latest ops rotate signing-key
npx create-authenik8-app@latest ops rotate signing-key \
  --apply \
  --confirm-active-kid <current-kid>

Deploy the staged ring to every instance. Then preview and activate the staged key:

npx create-authenik8-app@latest ops rotate signing-key \
  --activate-kid <staged-kid>

npx create-authenik8-app@latest ops rotate signing-key \
  --activate-kid <staged-kid> \
  --apply \
  --confirm-active-kid <current-kid>

The CLI updates .env with an atomic private-file replacement, refuses concurrent file drift, validates signing and public verification with the installed engine, and restores the original file when post-write verification fails. Activation removes private material from older keys but retains their public verification components.

Keep old public keys until every token they signed has expired. Key pruning is intentionally manual.

Revoke every session for one user

Preview the target and active-session counts:

npx create-authenik8-app@latest ops revoke user <user-id> --all-sessions

Apply only with the exact user ID repeated and an operator reason:

npx create-authenik8-app@latest ops revoke user <user-id> \
  --all-sessions \
  --apply \
  --confirm-user <user-id> \
  --reason "credential compromise"

The core-session boundary uses the installed engine's listSessions() and revokeAllSessions() methods. Express presets write a private operation receipt before mutation. Fullstack projects also revoke PostgreSQL Session rows and write an ops.sessions.revoked audit event in one database transaction before cleaning up core sessions in Redis.

If database revocation succeeds but Redis cleanup fails, the command reports a partial result and exits with code 4. Retry the Redis cleanup after restoring connectivity.

memory:// is rejected because a separate CLI process cannot inspect or mutate an application's in-process session store.

Exit codes

Exit code	Meaning
0	A read-only operation passed, a plan was produced, or a mutation applied and verified
1	Readiness, audit, or OAuth verification failed
2	Invalid usage or no generated Authenik8 project was detected
3	A runtime or operation prerequisite failed
4	A mutation failed verification, was restored, or completed partially
5	A sanitized audit report could not be written