Generated presets

The CLI offers three Express API presets and one connected fullstack application preset.

Preset	Runtime	Database	Interface
JWT only (base)	Express	Optional Prisma with SQLite or PostgreSQL	API
Email and password (auth)	Express	Prisma with SQLite or PostgreSQL	API
Password and OAuth (auth-oauth)	Express	Prisma with SQLite or PostgreSQL	API
Fullstack application (fullstack)	React/Vite and Express	Prisma with PostgreSQL	Web application and API

Every preset requires Node.js 20.19+, 22.12+, or 24+. Local development uses an in-process Redis-compatible store. Production requires an external Redis service.

The interactive fullstack path defaults to password-only. Google and GitHub are opt-in because each requires external provider credentials and exact callback configuration.

Fullstack uses npm workspaces and project-local PostgreSQL during development. Docker remains an optional workflow. Express presets support npm, pnpm, and Bun, with SQLite or PostgreSQL when Prisma is enabled.

JWT only

Best for APIs that manage identities elsewhere.

• Public, guest, protected, refresh, and administrator routes
• Optional Prisma with SQLite or PostgreSQL
• ES256 access and guest tokens
• Redis-backed refresh rotation and session revocation
• Public JWKS endpoint

Email and password

Best for first-party accounts.

• Registration, login, and refresh routes
• Password hashing
• Required Prisma with SQLite or PostgreSQL
• Protected and administrator routes

Password and OAuth

Best for multiple sign-in methods.

• Everything in the email and password preset
• Google, GitHub, or both
• Redis-backed OAuth state validation
• Explicit account linking when an email already belongs to another identity

Fullstack application

Best for starting a complete product with connected authentication, account management, administration, and an owned resource.

The generated application's authenticated dashboard, backed by the seeded local PostgreSQL workspace and live API health check.

• React, Vite, React Router, and TanStack Query
• Express API with CSRF-protected refresh-cookie flows
• Shared Zod contracts and typed API client
• Prisma, PostgreSQL, and Redis
• Registration, login, recovery, verification, and optional OAuth screens
• Profile, linked provider, password, and session management
• Administrator users, roles, status controls, session revocation, and audit events
• Owned Project CRUD module with server-side ownership policies
• OpenAPI 3.1, health checks, structured logs, tests, and production docs

The generated npm workspace has explicit boundaries:

apps/
  api/                 Express, Authenik8, Prisma, PostgreSQL, Redis
  web/                 React and Vite application
packages/
  contracts/           Shared request schemas and public response types
  api-client/          Typed browser client and refresh handling
  ui/                  Reusable application primitives

Access tokens remain in browser memory. Refresh tokens use a restricted HttpOnly cookie. API roles and ownership policies remain the authorization boundary.

Fullstack frontend modes

The fullstack preset generates the React reference application by default (--frontend react). With --frontend lovable the same template additionally keeps the Lovable integration pack, the generated agent skill, and the helper scripts; a normal React-mode project contains none of those Lovable-only artifacts.

.agents/skills/authenik8-lovable/   generated skill for terminal coding agents
integrations/lovable/
  START_HERE.md            handoff for the connected AI builder
  LOVABLE_PROMPT.md        staged prompt sequence
  FRONTEND_CONTRACT.md     frontend boundary contract
  SECURITY_RULES.md        never-allow rules
  TROUBLESHOOTING.md       diagnosis and remediation
  acceptance-checklist.md  release evidence
  openapi.json             committed OpenAPI 3.1 contract
  vendor/                  exported client archives after `npm run export:lovable-client`
scripts/
  doctor-lovable.mjs       `npm run doctor:lovable`
  export-lovable-client.mjs
AGENTS.md                  agent instructions, commands, and security invariants

Lovable-mode projects expose npm run dev:lovable, npm run doctor:lovable, and npm run export:lovable-client. The included React reference stays as the known-good fallback for the complete authentication lifecycle.

Express preset layout

Every Express preset generates the same minimal, production-oriented layout:

app.ts                application wiring
routes/               route groups (base, auth, admin, ...)
controllers/          request handlers
src/config/           environment and service configuration
src/server.ts         entry point
utils/                security helpers

Express presets support npm, pnpm, and Bun with SQLite or PostgreSQL when Prisma is enabled, and an optional PM2 production runtime with --production-ready.

Generated manifest

Every generated project writes authenik8.json at its root as the source-controlled project contract:

schemaVersion             manifest schema version (1)
projectName               generated project name
generatedBy.package       "create-authenik8-app"
generatedBy.version       CLI version that generated the project
engine.package            "authenik8-core"
engine.version            identity-engine version the project runs against
preset                    base | auth | auth-oauth | fullstack
packageManager            npm | pnpm | bun
runtime                   node | bun
database                  sqlite | postgresql | null
features.prisma           Prisma capability
features.oauthProviders   google, github, or []
features.pm2              PM2 production runtime
features.frontend         react | lovable (fullstack only)

Treat manifest changes as migrations, keep it free of secrets and deployment credentials, and review it before upgrading or running operations.