authentik

https://docs.goauthentik.io/
Admin
authentik is a secure and flexible Identity Provider (IdP) and Single Sign-On (SSO) solution. It...
Tokens:1,029,618
Snippets:8,178
Trust Score:9.8
Update:2 weeks ago
Show doc for...
Tokens:
Raw
### Install and watch frontend

Source: https://docs.goauthentik.io/developer-docs/setup/frontend-dev-environment

Install frontend packages and start the frontend in watch mode from the repository root.

```bash
make node-install  

make web-watch  

```

--------------------------------

### Install dependencies for key binding client

Source: https://docs.goauthentik.io/add-secure-apps/providers/oauth2/key-binding

Creates a virtual environment and installs the required dependencies (PyJWT with crypto extras and requests) for the key binding client example.

```bash
python3 -m venv .venv  

.venv/bin/python -m pip install 'PyJWT[crypto]==2.10.1' 'requests==2.32.5'  

```

--------------------------------

### Run authentik with make run

Source: https://docs.goauthentik.io/developer-docs/setup/full-dev-environment

Starts the authentik server from the root of the installation directory. The first run may take time to clear the initial task queue; adjust AUTHENTIK_WORKER__THREADS as needed.

```bash
make run
```

--------------------------------

### Install dependencies with make install

Source: https://docs.goauthentik.io/developer-docs/setup/full-dev-environment

Run from the root directory of the local authentik Git repository. Installs all required JavaScript and Python dependencies and creates an isolated Python environment.

```bash
make install  
```

--------------------------------

### Install docs build tools with make docs-install

Source: https://docs.goauthentik.io/developer-docs/docs/writing-documentation

Install or update the build tools for both the technical docs and integration guides. This installs or updates dependencies such as Docusaurus, Prettier, and ESLint. Run this when first setting up your writing environment and if you encounter build check failures locally or when pushing a PR.

```bash
make docs-install  

```

--------------------------------

### Install authentik Agent on RedHat-based Linux

Source: https://docs.goauthentik.io/endpoint-devices/authentik-agent/agent-deployment/linux

Install the authentik Agent on RedHat-based Linux systems. Steps: add the repository and GPG key, install the core packages, and optionally install SSH and PAM packages. After installation, verify with the `ak` command.

```bash
# This overwrites any existing configuration in /etc/yum.repos.d/authentik.repo
cat <<EOF | sudo tee /etc/yum.repos.d/authentik.repo
[authentik]
name=authentik
baseurl=https://pkg.goauthentik.io
enabled=1
gpgcheck=1
gpgkey=https://pkg.goauthentik.io/keys/gpg-key.asc
EOF
```

```bash
sudo yum install -y authentik-cli authentik-agent authentik-sysd
```

```bash
sudo yum install -y libnss-authentik libpam-authentik
```

--------------------------------

### GET /enterprise/license/get_install_id/

Source: https://docs.goauthentik.io/releases/2024.4

Retrieves the installation ID.

```APIDOC
## GET /enterprise/license/get_install_id/

### Description
Retrieves the installation ID.

### Method
GET

### Endpoint
/enterprise/license/get_install_id/
```

--------------------------------

### Download Example - Enrollment (2 Stage) blueprint

Source: https://docs.goauthentik.io/users-sources/user/invitations

Downloads the simpler 'Example - Enrollment (2 Stage)' blueprint, which does not include separate flows for internal/external users, automatic group assignment, or user paths.

```bash
wget https://goauthentik.io/blueprints/example/flows-enrollment-2-stage.yaml
```

--------------------------------

### Download Example - Invitation-based Enrollment blueprint

Source: https://docs.goauthentik.io/users-sources/user/invitations

Downloads the pre-built 'Example - Invitation-based Enrollment' blueprint, which includes separate flows for external and internal users, automatic group assignment, user path organization, and five example invitations.

```bash
wget https://goauthentik.io/blueprints/example/flows-invitation-enrollment.yaml
```

--------------------------------

### Verify authentik Agent installation with ak --version

Source: https://docs.goauthentik.io/endpoint-devices/authentik-agent/agent-deployment/macos

Run this command in a Terminal window to confirm the authentik Agent is installed. Expected output starts with 'authentik Agent CLI: <version_number>'.

```bash
ak --version
```

--------------------------------

### Run key binding client with AK_DISCOVERY_URL and AK_CLIENT_ID

Source: https://docs.goauthentik.io/add-secure-apps/providers/oauth2/key-binding

Runs the key binding client example with the discovery URL and client ID as environment variables. Leave port 8765 unused while running, and do not share the URL you copy from the browser.

```bash
export AK_DISCOVERY_URL='https://authentik.company/application/o/<application_slug>/.well-known/openid-configuration'  
export AK_CLIENT_ID='<client_id>'  
.venv/bin/python key_binding_client.py  
```

--------------------------------

### Build integration documentation locally

Source: https://docs.goauthentik.io/developer-docs/docs/writing-documentation

Formats, lints, and builds the integration documentation. Run before pushing changes, then inspect the deploy preview after opening the pull request.

```bash
make integrations  
```

--------------------------------

### GET /outposts/ldap/

Source: https://docs.goauthentik.io/releases/2023.6

Lists LDAP providers with additional properties for MFA support and UID/GID start numbers.

```APIDOC
## GET /outposts/ldap/

### Description
Lists LDAP providers with additional properties for MFA support and UID/GID start numbers.

### Method
GET

### Endpoint
/outposts/ldap/

### Response
#### Success Response (200)
- **results** (array) - Array of LDAPProvider objects.
  - **mfa_support** (boolean) - When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.
  - **uid_start_number** (integer) - The start for uidNumbers, this number is added to the user.pk to make sure that the numbers aren't too low for POSIX users. Default is 2000 to ensure that we don't collide with local users uidNumber.
  - **gid_start_number** (integer) - The start for gidNumbers, this number is added to a number generated from the group.pk to make sure that the numbers aren't too low for POSIX groups. Default is 4000 to ensure that we don't collide with local groups or users primary groups gidNumber.

#### Response Example
{
  "results": [
    {
      "mfa_support": true,
      "uid_start_number": 2000,
      "gid_start_number": 4000
    }
  ]
}
```

--------------------------------

### Start required services with Docker Compose

Source: https://docs.goauthentik.io/developer-docs/setup/full-dev-environment

Use this command to start PostgreSQL, Zenko CloudServer (S3), and Sentry Spotlight using the provided Docker Compose configuration. Run from the project root of your local authentik repository.

```bash
docker compose -f scripts/compose.yml up -d  
```

--------------------------------

### Docker Compose upgrade commands

Source: https://docs.goauthentik.io/install-config/upgrade

Run these commands in your installation directory to pull the latest images and start the updated containers.

```bash
docker compose pull  

docker compose up -d  

```

--------------------------------

### Start frontend watcher with make web-watch

Source: https://docs.goauthentik.io/developer-docs/translation

Starts the frontend watcher, which compiles the catalogs at startup. Run from the repository root.

```bash
make web-watch  
```

--------------------------------

### GET /providers/oauth2/{id}/setup_urls/

Source: https://docs.goauthentik.io/releases/2026.8

Retrieves setup URLs for an OAuth2 provider. The response now includes a required `dcr_registration` property.

```APIDOC
## GET /providers/oauth2/{id}/setup_urls/

### Description
Retrieves setup URLs for an OAuth2 provider. The response now includes a required `dcr_registration` property.

### Method
GET

### Endpoint
/providers/oauth2/{id}/setup_urls/

### Parameters
#### Path Parameters
- **id** (string) - Required - The ID of the OAuth2 provider.

### Response
#### Success Response (200 OK)
- **dcr_registration** (string) - Required - The dynamic client registration URL.
```

--------------------------------

### Live edit integration documentation

Source: https://docs.goauthentik.io/developer-docs/docs/writing-documentation

Starts a local development server for the integrations site and opens a preview in your browser. Automatically rebuilds the local integrations site in real time as you write or modify MDX files in the website/integrations directory.

```bash
make integrations-watch  
```

--------------------------------

### AKQL event example: app startswith "authentik"

Source: https://docs.goauthentik.io/sys-mgmt/akql

Matches events where the app field starts with "authentik".

```akql
app startswith "authentik"
```

--------------------------------

### Kubernetes values.yaml settings for air-gapped authentik

Source: https://docs.goauthentik.io/install-config/air-gapped

Merge these settings into your values.yaml file for Kubernetes installations, keeping the secrets, database, and ingress settings from the installation guide. Configure mirrored images for any enabled chart dependencies separately and ensure all cluster nodes can pull from your internal registry.

```yaml
global:  

    image:  

        repository: registry.company/authentik/server  

        tag: "<authentik-version>"  

  

authentik:  

    outposts:  

        container_image_base: registry.company/authentik/%(type)s:%(version)s  

    disable_startup_analytics: true  

    disable_update_check: true  

    error_reporting:  

        enabled: false  

```

--------------------------------

### Install authentik Helm chart

Source: https://docs.goauthentik.io/install-config/install/kubernetes

Install the authentik Helm chart. Add the repository, update it, then upgrade/install with your values.yaml. Database migrations are applied automatically on startup.

```bash
helm repo add authentik https://charts.goauthentik.io
```

```bash
helm repo update
```

```bash
helm upgrade --install authentik authentik/authentik -f values.yaml
```

--------------------------------

### Initialize the database with make migrate

Source: https://docs.goauthentik.io/developer-docs/setup/full-dev-environment

Runs all migrations. To start over, use `make dev-reset`, which drops and restores the authentik PostgreSQL database to the state after running `make migrate`.

```bash
make migrate  
```

--------------------------------

### Add annotations to the ingress you want to protect

Source: https://docs.goauthentik.io/add-secure-apps/providers/proxy/server_nginx

Add these annotations to the ingress you want to protect. This configuration requires that you enable `allow-snippet-annotations`, for example by setting `controller.allowSnippetAnnotations` to `true` in your helm values for the ingress-nginx installation.

```yaml
metadata:  

    annotations:  

        # This should be the in-cluster DNS name for the authentik outpost service  

        # as when the external URL is specified here, nginx will overwrite some crucial headers  

        nginx.ingress.kubernetes.io/auth-url: |-  

            http://ak-outpost-example.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/nginx  

        # If you're using domain-level auth, use the authentication URL instead of the application URL  

        # Write the host as a literal rather than using $http_host. Clients are not required to send a Host  

        # header over HTTP/3, which leaves $http_host empty, and $host strips any non-standard port.  

        # The literal must match the proxy provider's External host, including a non-standard port.  

        # For domain-level auth, set this per Ingress so each application redirects back to its own host.  

        nginx.ingress.kubernetes.io/auth-signin: |-  

            https://app.company/outpost.goauthentik.io/start?rd=$scheme://app.company$escaped_request_uri  

        nginx.ingress.kubernetes.io/auth-response-headers: |-  

            Set-Cookie,X-authentik-username,X-authentik-groups,X-authentik-entitlements,X-authentik-email,X-authentik-name,X-authentik-uid  

            # Add the 'authorization' header to auth-response-headers if you need proxy providers which  

            # send a custom HTTP-Basic Authentication header based on values from authentik  

        nginx.ingress.kubernetes.io/auth-snippet: |  

            # Must match the proxy provider's External host, including any non-standard port. The outpost  

            # reads X-Forwarded-Host in preference to Host when matching a request to an application.  

            # Do not set X-Original-URL here: ingress-nginx already sets it earlier in this same location,  

            # and its value takes precedence over anything the snippet appends.  

            proxy_set_header X-Forwarded-Host app.company;  

```

--------------------------------

### Default NESTED CAS user info response

Source: https://docs.goauthentik.io/users-sources/sources/social-logins/cas

Example user info response with the default NESTED profile view type, which wraps claims in an `attributes` object. authentik reads claims from the top level, so with this format it only finds `sub` and users get empty email and name.

```json
{ "sub": "casuser", "attributes": { "email": "casuser@company", "name": "CAS User" } }  
```

--------------------------------

### POST /sources/plex/

Source: https://docs.goauthentik.io/releases/2025.12

Creates a new Plex source with updated properties for promotion and icon.

```APIDOC
## POST /sources/plex/

### Description
Creates a new Plex source. This endpoint has been updated to include new properties for promotion and icon.

### Method
POST

### Endpoint
/sources/plex/

### Parameters
#### Request Body
- **promoted** (boolean) - Optional - When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.
- **icon** (string) - Optional
- **slug** (string) - Optional - Internal source name, used in URLs.

### Response
#### Success Response (201 Created)
- **icon_url** (string) - Required
- **icon** (string) - Optional
- **promoted** (boolean) - Optional - When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.
- **icon_url** (string) - Optional
- **slug** (string) - Optional - Internal source name, used in URLs.
- **icon** (string) - Optional
```

--------------------------------

### Start backend containers with Docker Compose

Source: https://docs.goauthentik.io/developer-docs/setup/frontend-dev-environment

Start the backend containers with Docker Compose using the override file.

```bash
docker compose -f lifecycle/container/compose.yml -f compose.override.yml up -d  

```

--------------------------------

### Install authentik Agent on Debian-based Linux

Source: https://docs.goauthentik.io/endpoint-devices/authentik-agent/agent-deployment/linux

Install the authentik Agent on Debian-based Linux systems. Steps: add the GPG key, add the repository, update and install the core packages, and optionally install SSH and PAM packages. After installation, verify with the `ak` command.

```bash
curl -fsSL https://pkg.goauthentik.io/keys/gpg-key.asc | sudo gpg --dearmor -o /usr/share/keyrings/authentik-keyring.gpg
```

```bash
echo "deb [signed-by=/usr/share/keyrings/authentik-keyring.gpg] https://pkg.goauthentik.io stable main" | sudo tee /etc/apt/sources.list.d/authentik.list
```

```bash
sudo apt update
sudo apt install authentik-cli authentik-agent authentik-sysd
```

```bash
sudo apt install libnss-authentik libpam-authentik
```

--------------------------------

### Build technical documentation locally

Source: https://docs.goauthentik.io/developer-docs/docs/writing-documentation

Formats, lints, and builds the technical documentation. Run before pushing changes, then inspect the deploy preview after opening the pull request.

```bash
make docs  
```

--------------------------------

### GET /stages/consent/{stage_uuid}/

Source: https://docs.goauthentik.io/releases/2023.5

GET operation for consent stage.

```APIDOC
## GET /stages/consent/{stage_uuid}/

### Description
Retrieves a consent stage. The response has changed, specifically the `flow_set` array property and its nested `policy_engine_mode` property.

### Method
GET

### Endpoint
/stages/consent/{stage_uuid}/

### Parameters
#### Path Parameters
- **stage_uuid** (string) - Required - The UUID of the stage.

### Response
#### Success Response (200 OK)
- **flow_set** (array) - Stripped down flow serializer. Each item is an object with property `policy_engine_mode` (string) which can be `all` or `any`.

```

--------------------------------

### GET /stages/captcha/{stage_uuid}/

Source: https://docs.goauthentik.io/releases/2023.5

GET operation for captcha stage.

```APIDOC
## GET /stages/captcha/{stage_uuid}/

### Description
Retrieves a captcha stage. The response has changed, specifically the `flow_set` array property and its nested `policy_engine_mode` property.

### Method
GET

### Endpoint
/stages/captcha/{stage_uuid}/

### Parameters
#### Path Parameters
- **stage_uuid** (string) - Required - The UUID of the stage.

### Response
#### Success Response (200 OK)
- **flow_set** (array) - Stripped down flow serializer. Each item is an object with property `policy_engine_mode` (string) which can be `all` or `any`.

```

--------------------------------

### Join device to authentik domain with ak-sysd domains join

Source: https://docs.goauthentik.io/endpoint-devices/authentik-agent/agent-deployment/linux

Joins the device to an authentik domain, enrolling it with the deployment and issuing a device token. Replace <deployment_name> with the deployment identifier and the URL with the fully qualified domain name of the authentik deployment. You will be prompted to enter your enrollment token.

```bash
sudo ak-sysd domains join <deployment_name> --authentik-url https://authentik.company  
```

--------------------------------

### Verify configuration with Kubernetes

Source: https://docs.goauthentik.io/docs/install-config/configuration

Run this command to output the full config and verify that your settings have been applied correctly.

```bash
kubectl exec -it deployment/authentik-worker -c worker -- ak dump_config  
```

--------------------------------

### Remove quarantine from installer package

Source: https://docs.goauthentik.io/endpoint-devices/authentik-agent/agent-deployment/macos

Use this command to remove the macOS quarantine attribute from the downloaded installer package, allowing installation without the Option+Right Click workaround.

```bash
xattr -r -d com.apple.quarantine "$HOME/Downloads/authentik agent installer.pkg"
```
Tokens:
Raw