Identity and access, checked 2026-09-07
Authelia: Docker configuration reference
Self-hosted forward-auth server adding single sign-on and two-factor authentication in front of a reverse proxy.
At a glance
Ports
Ports| Port | What listens | Source |
|---|
9091 | HTTP listener serving the login portal and the /api/authz endpoints the proxy calls for forward auth. | source for port 9091 |
Environment variables
Environment variables| Variable | Required | What it does | Example | Source |
|---|
AUTHELIA_JWT_SECRET | Yes | Signs identity verification JWTs (password reset, email confirmation links). Set via the _FILE variant with a Docker secret rather than inline. | openssl rand -hex 64 | source for AUTHELIA_JWT_SECRET |
AUTHELIA_SESSION_SECRET | Yes | Encrypts session data in Redis when a Redis session store is configured. | openssl rand -hex 64 | source for AUTHELIA_SESSION_SECRET |
AUTHELIA_STORAGE_ENCRYPTION_KEY | Yes | Encrypts sensitive values at rest in the configured storage backend (SQLite, PostgreSQL or MySQL). | openssl rand -hex 64 | source for AUTHELIA_STORAGE_ENCRYPTION_KEY |
TZ | No | Container timezone. The bundled compose example sets it explicitly rather than relying on the image default. | Australia/Melbourne | source for TZ |
Volumes that must persist
Volumes| Path | What is in it | Source |
|---|
/config | configuration.yml plus the SQLite database when no external database is configured. This is the state to back up. | source for /config |
Behind a reverse proxy
- The proxy calls Authelia's forward-auth endpoint on every request, e.g. http://authelia:9091/api/authz/forward-auth for the ForwardAuth implementation named in server.endpoints.authz. source for this reverse-proxy note
- Authelia ships four authz endpoint implementations: ForwardAuth, ExtAuthz, AuthRequest and Legacy. Traefik uses ForwardAuth, Envoy uses ExtAuthz, nginx typically uses AuthRequest. source for this reverse-proxy note
- The proxy must forward the authentication response headers back to the upstream app, commonly Remote-User, Remote-Groups, Remote-Name and Remote-Email. source for this reverse-proxy note
- trustForwardHeader must be enabled on the proxy's forward-auth middleware so client IPs are read correctly rather than the proxy's own address. source for this reverse-proxy note
What it needs alongside it
Release timeline
Releases| Version | Date | Breaking | What changed | Source |
|---|
v4.39.22 | 2026-09-03 | No | Bug fix: storage access token JWT upgrade. | source for release v4.39.22 |
v4.39.20 | 2026-05-26 | Yes | Security release fixing an access control rule domain match bypass from missing canonicalization; upgrade is not optional. | source for release v4.39.20 |
v4.39.19 | 2026-04-12 | No | Fixes inconsistent OAuth2 error messages and an issuer domain suffix check. | source for release v4.39.19 |
v4.39.18 | 2026-04-10 | No | Removes an incorrect response code check that broke successful Duo API calls. | source for release v4.39.18 |
v4.39.16 | 2026-03-14 | Yes | Security release, see advisory GHSA-gmfg-3v4q-9qr4, plus a fix for an overly strict discovery check. | source for release v4.39.16 |
If it is not coming up
Read from the upstream documentation, repository and container registry by Keita Emsden on 2026-09-07. Every row links the page it came from. Upstream changes without telling anyone, so check the source link before you rely on a value.
Other app references
All app references