Installation

Autentico ships as a single self-contained binary with no runtime dependencies.

Binary

Download the latest release for your platform from GitHub Releases.

Linux (amd64)

curl -L https://github.com/eugenioenko/autentico/releases/latest/download/autentico-linux-amd64 -o autentico
chmod +x autentico

Linux (arm64)

curl -L https://github.com/eugenioenko/autentico/releases/latest/download/autentico-linux-arm64 -o autentico
chmod +x autentico

macOS (amd64)

curl -L https://github.com/eugenioenko/autentico/releases/latest/download/autentico-darwin-amd64 -o autentico
chmod +x autentico

macOS (arm64)

curl -L https://github.com/eugenioenko/autentico/releases/latest/download/autentico-darwin-arm64 -o autentico
chmod +x autentico

Windows

Invoke-WebRequest -Uri https://github.com/eugenioenko/autentico/releases/latest/download/autentico-windows-amd64.exe -OutFile autentico.exe

Optionally move it to your $PATH:

sudo mv autentico /usr/local/bin/

Generate configuration

Before starting for the first time, generate a .env file with fresh cryptographic secrets:

autentico init --url http://localhost:9999

This creates RSA signing keys, CSRF secrets, and token signing secrets. For production use --url https://auth.example.com. For local HTTP development add --dev to disable secure cookie flags.

Start

autentico start

Docker

docker run -p 9999:9999 -v autentico-data:/app/data \
  ghcr.io/eugenioenko/autentico:latest start --auto-setup

The --auto-setup flag generates a .env with fresh secrets on first run and reuses it on restarts. The volume at /app/data persists both the database and the generated configuration.

For a custom URL, pass it via environment variable:

docker run -p 9999:9999 -v autentico-data:/app/data \
  -e AUTENTICO_APP_URL=https://auth.example.com \
  ghcr.io/eugenioenko/autentico:latest start --auto-setup

See Docker Compose for production setups with reverse proxy and SMTP.

URL mismatch after restart

Changing AUTENTICO_APP_URL after first run leaves the admin client registered with the old callback URL. To fix, delete the volume and start fresh: docker stop autentico && docker rm autentico && docker volume rm autentico-data.

Build from source

Requires Go 1.22+ and Node.js 22+.

git clone https://github.com/eugenioenko/autentico.git
cd autentico
make build

The compiled binary is at ./autentico.

CLI reference

Command	Description
autentico init	Generate a .env with fresh secrets. Use --url to set the app URL, --dev for local HTTP.
autentico start	Start the server. Applies pending migrations automatically.
autentico start --auto-setup	Generate .env if missing, then start. Safe to pass on every run.
autentico start --no-auto-migrate	Skip automatic migrations. Server refuses to start if the schema is behind.
autentico migrate	Interactively apply pending database migrations.
autentico onboard	Create the first admin account headlessly (for CI/CD).
autentico onboard --enable-admin-password-grant	Also seed the autentico-admin client with the password (ROPC) grant so admin-API tokens can be fetched headlessly. Also settable via AUTENTICO_ENABLE_ADMIN_PASSWORD_GRANT=true. For browser-onboarded deployments, enable the same grant afterwards from the Admin UI (Clients → autentico-admin).
autentico version	Print version and exit.

Next steps

Head to the Quickstart to complete onboarding and start using Autentico.