AuthKit-Litev2.0.0
AuthKit configuration
Understand AuthKit-Lite runnable defaults and add .env overrides for further development or deployment.
Updated
No configuration for the first run
Runnable defaults live in src/main/resources/application.properties, so cloning and running AuthKit-Lite does not require local values, a .env file, Docker, or an external database. Start the project and try the APIs before changing configuration.
Use .env for development overrides
When you begin adapting the project, copy .env.example to .env, uncomment only the settings you need, and restart the application. Spring imports the root file when present, and Git ignores it.
- Use .env to switch databases, provide a stable local secret, disable demo data, or enable passkeys.
- Use the deployment platform's environment or secret store outside local development.
- Never commit .env or production credentials.
Database
| Variable | Default | Purpose |
|---|---|---|
| DB_URL | In-memory H2 | External JDBC URL, typically MySQL |
| DB_USERNAME | sa | Database user |
| DB_PASSWORD | Empty for H2 | Database password |
JWT and refresh tokens
| Variable | Default | Purpose |
|---|---|---|
| JWT_SECRET | Ephemeral startup value | HS256 signing secret; use a stable high-entropy value in production |
| JWT_ACCESS_TOKEN_TTL | 15m | Access-token lifetime |
| JWT_REFRESH_TOKEN_TTL | 14d | Refresh-token lifetime |
| JWT_ISSUER | authkit | Expected iss claim |
| JWT_AUDIENCE | authkit-api | Expected aud claim |
Passkeys / WebAuthn
| Variable | Default | Purpose |
|---|---|---|
| PASSKEY_ENABLED | false | Enable WebAuthn support |
| PASSKEY_RP_NAME | BuildBaseKit AuthKit-Lite | Human-readable relying-party name |
| PASSKEY_RP_ID | localhost | Relying-party domain boundary |
| PASSKEY_ALLOWED_ORIGINS | localhost ports 8080 and 3000 | Comma-separated trusted browser origins |
Application options
| Variable | Default | Purpose |
|---|---|---|
| AUTHKIT_DEMO_DATA_ENABLED | true | Seed demo users only when the users table is empty |
| SHUTDOWN_TIMEOUT | 30s | Graceful shutdown phase timeout |
Run, try, and deploy
The project does not need separate named runtime profiles for this workflow. Tests use src/test/resources/application.properties with isolated H2 and demo data disabled.
| Stage | Configuration |
|---|---|
| Run and try | No .env; H2, generated JWT secret, and local demo users |
| Further development | Optional .env overrides for persistent services and stable local values |
| Deployment | Platform-managed external configuration and secrets; demo data disabled |
Production checklist
- Provide a stable JWT_SECRET of at least 32 characters.
- Use an external database and managed backups.
- Set AUTHKIT_DEMO_DATA_ENABLED=false.
- Serve passkeys over HTTPS with the deployed RP ID and exact trusted origins.
- Keep secrets in the deployment platform's secret store.
- Add rate limiting, monitoring, and application-specific authorization review.