Identity and access, checked 2026-09-07
authentik: Docker configuration reference
Self-hosted identity provider with SSO, SAML, OAuth2/OIDC, LDAP and proxy-based forward auth.
At a glance
Ports
Ports| Port | What listens | Source |
|---|
9000 | HTTP listener for the web UI, API and outpost communication. Default when COMPOSE_PORT_HTTP is unset. | source for port 9000 |
9443 | HTTPS listener, self-signed by default. Point a reverse proxy here if it expects TLS from authentik. | source for port 9443 |
Environment variables
Environment variables| Variable | Required | What it does | Example | Source |
|---|
AUTHENTIK_SECRET_KEY | Yes | Signing key for sessions and tokens. Losing it invalidates every session. | openssl rand -base64 60 | source for AUTHENTIK_SECRET_KEY |
PG_PASS | Yes | Password for the bundled PostgreSQL user, shared with the server and worker containers. | openssl rand -base64 36 | source for PG_PASS |
AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS | No | Replaces the default trusted proxy CIDR list. Set this if the reverse proxy connects from outside 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16. | 10.0.0.0/8 | source for AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS |
COMPOSE_PORT_HTTP | No | Host port mapped to the internal HTTP listener. Requires a container recreate to take effect. | 80 | source for COMPOSE_PORT_HTTP |
AUTHENTIK_ERROR_REPORTING__ENABLED | No | Sends anonymised error reports upstream. Off by default. | true | source for AUTHENTIK_ERROR_REPORTING__ENABLED |
Volumes that must persist
Volumes| Path | What is in it | Source |
|---|
/var/lib/postgresql/data (postgresql) | The whole dataset: users, flows, applications, outpost configuration. | source for /var/lib/postgresql/data |
/data (server) | Media, blueprints and other server-side state shared with the worker. | source for /data |
/certs (worker) | Certificates the worker manages, including outpost TLS material. | source for /certs |
Behind a reverse proxy
- authentik uses WebSockets for outpost communication. The reverse proxy must support HTTP/1.1 or newer and forward Connection: Upgrade and Upgrade: WebSocket. source for this reverse-proxy note
- Set X-Forwarded-Host (or Host), X-Forwarded-Proto and X-Forwarded-For and have the proxy overwrite any client-supplied copies of these headers. source for this reverse-proxy note
- Forwarded headers are trusted only from a trusted proxy network. A proxy outside the default CIDR list needs AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS set, or headers are ignored. source for this reverse-proxy note
- Outpost containers (used for Proxy, LDAP, RADIUS and RAC providers) are separate deployments that talk to the authentik API over websockets; they are not covered by proxying the main server alone. source for this reverse-proxy note
What it needs alongside it
Dependencies| Dependency | Why | Source |
|---|
| PostgreSQL 14 to 18 | Required for application data, configuration, sessions and background task coordination. | source for PostgreSQL 14 to 18 |
Release timeline
If it is not coming up
Read from the upstream documentation, repository and container registry by Keita Emsden on 2026-09-07. Every row links the page it came from. Upstream changes without telling anyone, so check the source link before you rely on a value.
Other app references
All app references