AuthKit-Prov1.0.0
AuthKit-Pro configuration
Configure AuthKit-Pro database, JWT, development utilities, passkeys, mail, magic links, OAuth2/OIDC, and maintenance.
Updated
Configuration model
AuthKit-Pro runs from safe local defaults in application.properties and optionally imports an ignored root .env file. Use standard Spring Boot properties for mail and OAuth2 clients; use the documented AuthKit variables for product policy.
Database
| Variable | Local default | Purpose |
|---|---|---|
| DB_URL | jdbc:h2:mem:authkit_pro;MODE=MySQL;DB_CLOSE_DELAY=-1 | JDBC connection URL |
| DB_USERNAME | sa | Database user |
| DB_PASSWORD | Empty | Database password |
JWT
| Variable | Default | Purpose |
|---|---|---|
| JWT_SECRET | Generated locally | HS256 signing secret; production requires a stable high-entropy value of at least 32 characters |
| JWT_ACCESS_TOKEN_TTL | 15m | Access-token lifetime |
| JWT_REFRESH_TOKEN_TTL | 14d | Absolute refresh-session lifetime |
| JWT_ISSUER | authkit | Required issuer |
| JWT_AUDIENCE | authkit-api | Required audience |
Development utilities
| Variable | Default | Purpose |
|---|---|---|
| AUTHKIT_DEMO_DATA_ENABLED | false | Seed local demo users on an empty database |
| AUTHKIT_API_TEST_ENABLED | true | Serve /api-test and its assets |
Passkeys
| Variable | Default |
|---|---|
| PASSKEY_ENABLED | false |
| PASSKEY_RP_NAME | BuildBaseKit AuthKit-Pro |
| PASSKEY_RP_ID | localhost |
| PASSKEY_ALLOWED_ORIGINS | http://localhost:8080,http://localhost:3000 |
Account lifecycle and mail
Verification, reset, email-change, and magic-link messages append a credential fragment to the trusted action page. Configure an absolute HTTPS URL without credentials, query, or fragment for production.
| Variable | Default / purpose |
|---|---|
| AUTHKIT_ACCOUNT_ACTION_URL | http://localhost:8080/api-test/; complete trusted action page |
| AUTHKIT_FROM_EMAIL | no-reply@example.com |
| AUTHKIT_MAIL_REQUIRED | false locally; true is required by the production policy |
| AUTHKIT_VERIFICATION_TTL | 24h |
| AUTHKIT_RESET_TTL | 30m |
| spring.mail.* | Standard Spring Boot SMTP configuration |
Magic links
Magic links use Spring One-Time Token authentication and require an enabled local account with a verified email address and working mail delivery.
| Variable | Default |
|---|---|
| AUTHKIT_MAGIC_LINK_ENABLED | false |
| AUTHKIT_MAGIC_LINK_TTL | 5m |
OAuth2 and OIDC
OAuth providers use standard spring.security.oauth2.client.* properties. Google and GitHub can use Spring Boot's common-provider defaults. A generic OIDC registration supplies its registration fields plus spring.security.oauth2.client.provider.<id>.issuer-uri for discovery.
spring.security.oauth2.client.registration.google.client-id=<client-id>
spring.security.oauth2.client.registration.google.client-secret=<client-secret>
spring.security.oauth2.client.registration.company.provider=company
spring.security.oauth2.client.registration.company.client-id=<client-id>
spring.security.oauth2.client.registration.company.client-secret=<client-secret>
spring.security.oauth2.client.registration.company.authorization-grant-type=authorization_code
spring.security.oauth2.client.registration.company.redirect-uri={baseUrl}/login/oauth2/code/{registrationId}
spring.security.oauth2.client.registration.company.scope=openid,profile,email
spring.security.oauth2.client.provider.company.issuer-uri=https://id.example.comMaintenance
- Expired account credentials are deleted.
- Sessions are deleted seven days after absolute expiry, cascading stored refresh digests.
- Security activity older than 90 days is deleted.
- Spring One-Time Token performs its own hourly expiry cleanup.
| Property | Default | Behavior |
|---|---|---|
| authkit.maintenance.cron | 0 0 3 * * * | Daily at 03:00 UTC; '-' disables the schedule |
Production checklist
- Use persistent MySQL-compatible storage, backups, and restricted credentials.
- Provide a stable high-entropy JWT_SECRET.
- Use HTTPS, exact CORS/WebAuthn origins, a correct RP ID, and secure session cookies.
- Configure a trusted AUTHKIT_ACCOUNT_ACTION_URL and working Spring Mail transport.
- Disable demo data and the browser API tester.
- Apply gateway or reverse-proxy rate limits to authentication and recovery endpoints.
- Restrict sensitive request, header, callback, and ORM bind logging.
- Monitor database health and mail-delivery failures.