Binary Deployment

The binary is the simplest deployment option. Autentico has no runtime dependencies beyond the binary itself — no database server to start, no cache to configure, no sidecar processes. The entire system is one executable and one SQLite file. Suitable for VMs, bare metal, or any environment where containers aren’t preferred.

Basic setup

See the Quickstart for download, configuration, and first-run instructions.

Running as a systemd service

Create /etc/systemd/system/autentico.service:

[Unit]
Description=Autentico OIDC Identity Provider
After=network.target

[Service]
Type=simple
User=autentico
WorkingDirectory=/opt/autentico
ExecStart=/usr/local/bin/autentico start
EnvironmentFile=/opt/autentico/.env
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

Then:

sudo systemctl daemon-reload
sudo systemctl enable --now autentico
sudo systemctl status autentico

Data directory

Autentico writes one persistent file:

File	Purpose
autentico.db (path from AUTENTICO_DB_FILE_PATH)	SQLite database — all users, clients, sessions, settings

The RSA private key is passed as the AUTENTICO_PRIVATE_KEY environment variable (a base64-encoded PEM string). It is not written to disk. Store it in your secrets manager or .env file alongside your other bootstrap secrets.

Back up the database file. Use sqlite3 .backup for a hot backup while the server is running.

Caution

Never expose the SQLite database file to the public internet. Keep it on a volume accessible only by the autentico user. Treat AUTENTICO_PRIVATE_KEY as a secret — back it up securely and never commit it to source control.

Reverse proxy

Autentico listens on HTTP — put it behind a TLS-terminating reverse proxy (nginx, Caddy, Traefik) before exposing it to the internet. See Reverse Proxy.