Skip to content
Autentico

Key Generation

Autentico requires four secrets to start:

Variable Purpose
AUTENTICO_PRIVATE_KEY RSA private key (base64-encoded PEM). Used to sign all JWTs (access tokens, ID tokens, refresh tokens) with RS256. Clients and resource servers verify tokens against the public key exposed at /oauth2/.well-known/jwks.json. If unset, an ephemeral key is generated on startup and all tokens are invalidated on restart.
AUTENTICO_CSRF_SECRET_KEY HMAC secret for CSRF token signing. Protects browser-facing form submissions (login, MFA, onboarding) from cross-site request forgery.
AUTENTICO_ACCESS_TOKEN_SECRET Secret used when generating opaque access token identifiers stored in the database. Not the JWT signing key — that is the RSA key above.
AUTENTICO_REFRESH_TOKEN_SECRET Secret used when generating opaque refresh token identifiers stored in the database. Keeps refresh tokens unpredictable even if the database is compromised.

The easiest way to generate all of them at once is with the built-in init command.

Using autentico init

Section titled “Using autentico init”

If you have the binary available:

Terminal window
./autentico init --url https://auth.example.com

This creates a .env file in the current directory with a freshly generated RSA private key, CSRF secret, and token signing secrets — everything needed to start the server. The --url flag sets AUTENTICO_APP_URL and is used as the OIDC issuer.

Using Docker (no local binary)

Section titled “Using Docker (no local binary)”

If you’re deploying via Docker and don’t have the binary installed locally, run init through the image:

Terminal window
docker run --rm -v "$(pwd)":/output \
  ghcr.io/eugenioenko/autentico:latest \
  init --url https://auth.example.com --output /output

This writes the .env file into your current directory via the mounted volume.

If you do have the binary handy, the equivalent is:

Terminal window
./autentico init --url https://auth.example.com

Manual generation

Section titled “Manual generation”

If you need to generate the secrets without the binary — for example, in a CI/CD pipeline or secret manager provisioning script:

RSA private key

Section titled “RSA private key”
Terminal window
# Generate the key and encode it as a single-line base64 string
openssl genrsa 4096 | base64 -w 0

Paste the output as the value of AUTENTICO_PRIVATE_KEY.

Random secrets

Section titled “Random secrets”
Terminal window
# Generate a 32-byte random secret (repeat for each secret)
openssl rand -base64 32

Use one output value each for AUTENTICO_CSRF_SECRET_KEY, AUTENTICO_ACCESS_TOKEN_SECRET, and AUTENTICO_REFRESH_TOKEN_SECRET.

Storing secrets

Section titled “Storing secrets”

Once generated:

  • Local / binary deployment — keep secrets in a .env file, added to .gitignore
  • Docker — pass via --env-file .env or env_file: in docker-compose.yml
  • Production — store in a secrets manager (Vault, AWS Secrets Manager, etc.) and inject at deploy time