Binary Deployment

The binary is the simplest deployment option — a single executable with no runtime dependencies. Suitable for VMs, bare metal, or any environment where containers aren’t preferred.

Basic setup

1. Download the binary for your platform from the GitHub Releases page and install it. See Installation for platform-specific download commands.

2. Create a .env file with your Bootstrap Settings:

   AUTENTICO_APP_URL=https://auth.example.com
   AUTENTICO_DB_FILE_PATH=/var/lib/autentico/autentico.db
   AUTENTICO_COOKIE_SECRET=<random-32+-char-string>
   AUTENTICO_ADMIN_TOKEN=<secure-admin-token>

3. Start Autentico:

   autentico start

   The server reads its .env from the current directory, or from the path in AUTENTICO_ENV_FILE.

Running as a systemd service

Create /etc/systemd/system/autentico.service:

[Unit]
Description=Autentico OIDC Identity Provider
After=network.target

[Service]
Type=simple
User=autentico
WorkingDirectory=/opt/autentico
ExecStart=/usr/local/bin/autentico start
EnvironmentFile=/opt/autentico/.env
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

Then:

sudo systemctl daemon-reload
sudo systemctl enable --now autentico
sudo systemctl status autentico

Data directory

Autentico writes one persistent file:

File	Purpose
autentico.db (path from AUTENTICO_DB_FILE_PATH)	SQLite database — all users, clients, sessions, settings

The RSA private key is passed as the AUTENTICO_PRIVATE_KEY environment variable (a base64-encoded PEM string). It is not written to disk. Store it in your secrets manager or .env file alongside your other bootstrap secrets.

Back up the database file. Use sqlite3 .backup for a hot backup while the server is running.

Caution

Never expose the SQLite database file to the public internet. Keep it on a volume accessible only by the autentico user. Treat AUTENTICO_PRIVATE_KEY as a secret — back it up securely and never commit it to source control.

Reverse proxy

Autentico listens on HTTP — put it behind a TLS-terminating reverse proxy (nginx, Caddy, Traefik) before exposing it to the internet. See Reverse Proxy.