AuthKit
AuthKit configuration
Configure AuthKit-Lite databases, JWTs, passkeys, demo data, and application lifecycle settings.
Updated
Configuration sources
Runnable defaults live in src/main/resources/application.properties. A root .env file is imported when present; copy .env.example and uncomment only the overrides you need. Environment-specific values must stay outside version control.
Database
| Variable | Default | Purpose |
|---|---|---|
| DB_URL | In-memory H2 | External JDBC URL, typically MySQL |
| DB_USERNAME | sa | Database user |
| DB_PASSWORD | Empty for H2 | Database password |
JWT and refresh tokens
| Variable | Default | Purpose |
|---|---|---|
| JWT_SECRET | Ephemeral startup value | HS256 signing secret; use a stable high-entropy value in production |
| JWT_ACCESS_TOKEN_TTL | 15m | Access-token lifetime |
| JWT_REFRESH_TOKEN_TTL | 14d | Refresh-token lifetime |
| JWT_ISSUER | authkit | Expected iss claim |
| JWT_AUDIENCE | authkit-api | Expected aud claim |
Passkeys / WebAuthn
| Variable | Default | Purpose |
|---|---|---|
| PASSKEY_ENABLED | false | Enable WebAuthn support |
| PASSKEY_RP_NAME | BuildBaseKit AuthKit-Lite | Human-readable relying-party name |
| PASSKEY_RP_ID | localhost | Relying-party domain boundary |
| PASSKEY_ALLOWED_ORIGINS | localhost ports 8080 and 3000 | Comma-separated trusted browser origins |
Application options
| Variable | Default | Purpose |
|---|---|---|
| AUTHKIT_DEMO_DATA_ENABLED | true | Seed demo users only when the users table is empty |
| SHUTDOWN_TIMEOUT | 30s | Graceful shutdown phase timeout |
Application profiles
The released project does not ship separate named runtime profiles. Local defaults are directly runnable, production values are supplied as external configuration, and tests use src/test/resources/application.properties with isolated H2 and demo data disabled.
Production checklist
- Provide a stable JWT_SECRET of at least 32 characters.
- Use an external database and managed backups.
- Set AUTHKIT_DEMO_DATA_ENABLED=false.
- Serve passkeys over HTTPS with the deployed RP ID and exact trusted origins.
- Keep secrets in the deployment platform's secret store.
- Add rate limiting, monitoring, and application-specific authorization review.