Key Generation

Autentico requires four secrets to start:

Variable	Purpose
AUTENTICO_PRIVATE_KEY	RSA private key (base64-encoded PEM). Used to sign all JWTs (access tokens, ID tokens, refresh tokens) with RS256. Clients and resource servers verify tokens against the public key exposed at /oauth2/.well-known/jwks.json. If unset, an ephemeral key is generated on startup and all tokens are invalidated on restart.
AUTENTICO_CSRF_SECRET_KEY	HMAC secret for CSRF token signing. Protects browser-facing form submissions (login, MFA, onboarding) from cross-site request forgery.
AUTENTICO_ACCESS_TOKEN_SECRET	Secret used when generating opaque access token identifiers stored in the database. Not the JWT signing key — that is the RSA key above.
AUTENTICO_REFRESH_TOKEN_SECRET	Secret used when generating opaque refresh token identifiers stored in the database. Keeps refresh tokens unpredictable even if the database is compromised.

The easiest way to generate all of them at once is with the built-in init command.

Using autentico init

If you have the binary available:

./autentico init --url https://auth.example.com

This creates a .env file in the current directory with a freshly generated RSA private key, CSRF secret, and token signing secrets — everything needed to start the server. The --url flag sets AUTENTICO_APP_URL and is used as the OIDC issuer.

caution

autentico init will error if a .env file already exists, to avoid overwriting existing secrets.

Using Docker (no local binary)

If you're deploying via Docker and don't have the binary installed locally, run init through the image:

docker run --rm -v "$(pwd)":/output \
  ghcr.io/eugenioenko/autentico:latest \
  init --url https://auth.example.com --output /output

This writes the .env file into your current directory via the mounted volume.

If you do have the binary handy, the equivalent is:

./autentico init --url https://auth.example.com

Manual generation

If you need to generate the secrets without the binary — for example, in a CI/CD pipeline or secret manager provisioning script:

RSA private key

# Generate the key and encode it as a single-line base64 string
openssl genrsa 4096 | base64 -w 0

Paste the output as the value of AUTENTICO_PRIVATE_KEY.

Random secrets

# Generate a 32-byte random secret (repeat for each secret)
openssl rand -base64 32

Use one output value each for AUTENTICO_CSRF_SECRET_KEY, AUTENTICO_ACCESS_TOKEN_SECRET, and AUTENTICO_REFRESH_TOKEN_SECRET.

Storing secrets

Once generated:

• Local / binary deployment — keep secrets in a .env file, added to .gitignore
• Docker — pass via --env-file .env or env_file: in docker-compose.yml
• Production — store in a secrets manager (Vault, AWS Secrets Manager, etc.) and inject at deploy time

Back up AUTENTICO_PRIVATE_KEY securely. Losing it means all previously issued tokens become unverifiable.