Installation

Autentico ships as a single self-contained binary with no runtime dependencies.

Binary

Download the latest stable release for your platform from GitHub Releases.

Beta and release-candidate builds are marked as prereleases on the full releases page. Download their assets from the specific release; the /releases/latest links below continue to select a stable release.

Linux (amd64)

curl -L https://github.com/eugenioenko/autentico/releases/latest/download/autentico-linux-amd64 -o autentico
chmod +x autentico

Linux (arm64)

curl -L https://github.com/eugenioenko/autentico/releases/latest/download/autentico-linux-arm64 -o autentico
chmod +x autentico

macOS (amd64)

curl -L https://github.com/eugenioenko/autentico/releases/latest/download/autentico-darwin-amd64 -o autentico
chmod +x autentico

macOS (arm64)

curl -L https://github.com/eugenioenko/autentico/releases/latest/download/autentico-darwin-arm64 -o autentico
chmod +x autentico

Windows

Invoke-WebRequest -Uri https://github.com/eugenioenko/autentico/releases/latest/download/autentico-windows-amd64.exe -OutFile autentico.exe

Optionally move it to your $PATH:

sudo mv autentico /usr/local/bin/

Generate configuration

Before starting for the first time, generate a .env file with fresh cryptographic secrets:

autentico init --url http://localhost:9999

This creates RSA signing keys, CSRF secrets, and token signing secrets. For production use --url https://auth.example.com. For local HTTP development add --dev to disable secure cookie flags.

Start

autentico start

Docker

docker run -p 9999:9999 -v autentico-data:/app/data \
  ghcr.io/eugenioenko/autentico:latest start --auto-setup

The --auto-setup flag generates a .env with fresh secrets on first run and reuses it on restarts. The volume at /app/data persists both the database and the generated configuration.

For a custom URL, pass it via environment variable:

docker run -p 9999:9999 -v autentico-data:/app/data \
  -e AUTENTICO_APP_URL=https://auth.example.com \
  ghcr.io/eugenioenko/autentico:latest start --auto-setup

See Docker Compose for production setups with reverse proxy and SMTP.

URL mismatch after restart

Changing AUTENTICO_APP_URL after first run leaves the admin client registered with the old callback URL. To fix, delete the volume and start fresh: docker stop autentico && docker rm autentico && docker volume rm autentico-data.

Build from source

Requires Go 1.22+ and Node.js 22+.

git clone https://github.com/eugenioenko/autentico.git
cd autentico
make build

The compiled binary is at ./autentico.

Local development data

Run make fresh to reset the local database and configuration, rebuild, and start a development server. It enables HTTP development cookies and disables rate limiting. In a second terminal, run:

make seed

This dependency-free Node.js script uses the normal APIs to create an admin plus 100 named users, 12 groups with memberships and claims, 24 OAuth clients, 6 disabled sample federation providers, 12 protected apps, 15 CORS origins, pending deletion requests, and real sign-ins, sessions, tokens, consent grants, MFA enrollments, and audit history. Protected apps also create their associated OAuth clients automatically. Placeholder URLs and emails use .test domains.

Sign in at http://localhost:9999/admin/ with admin / Password123!. Generated users share that password; alex.anderson is a sample password-only account. Eight other accounts have TOTP enabled for UI testing.

Repeat runs reuse named records and sample sessions; the script’s own admin sign-in and API updates append normal audit history. It accepts only loopback origins. Use make seed BASE_URL=http://localhost:19999 for a local server on another port, configured with the same application URL. Run make test-seed to verify seeding against a temporary database.

CLI reference

Command	Description
autentico init	Create .env with fresh secrets, or add only a missing TOTP encryption key to existing config. --url and --dev apply to new files.
autentico start	Start the server. Applies routine migrations automatically; pending major migrations require explicit migrate approval.
autentico start --env-file /path/to/.env	Load the selected file instead of .env in the current directory. Environment variables take precedence. Missing or unreadable files cause an error.
autentico start --auto-setup	Generate .env if missing, then start. Supports --env-file to choose the path (parent directory must exist). Safe to pass on every run.
autentico start --no-auto-migrate	Skip automatic migrations. Server refuses to start if the schema is behind.
autentico migrate	Interactively apply pending database migrations. Supports --env-file /path/to/.env to select the configuration and database.
autentico onboard	Create the first admin account headlessly (for CI/CD). Supports --env-file /path/to/.env to select the configuration and database.
autentico onboard --enable-admin-password-grant	Also seed the autentico-admin client with the password (ROPC) grant so admin-API tokens can be fetched headlessly. Also settable via AUTENTICO_ENABLE_ADMIN_PASSWORD_GRANT=true. For browser-onboarded deployments, enable the same grant afterwards from the Admin UI (Clients → autentico-admin).
autentico version	Print version and exit.

Use the same --env-file path for start, migrate, and onboard. An explicitly selected file must load successfully; environment variables take precedence. Without the flag, each command uses the working-directory .env if present. Relative database paths resolve from the current working directory.

Next steps

Head to the Quickstart to complete onboarding and start using Autentico.