Skip to main content

Setup

  1. Add a DNS record pointing auth.<domain> to the server:

    • A record: auth → <ipv4>
    • AAAA record: auth → <ipv6>

  2. In Coolify, go to New Resource → Service, search for Authentik, set the domain, then deploy.

  3. Open https://auth.<domain>/if/flow/initial-setup/ and set the password for the default admin user akadmin.

SMTP​

Set the following environment variables on the Authentik server container in Coolify:

VariableValue
AUTHENTIK_EMAIL__HOST{{team.DEFAULT_SMTP_HOST}}
AUTHENTIK_EMAIL__PORT{{team.DEFAULT_SMTP_PORT}}
AUTHENTIK_EMAIL__USERNAME{{team.DEFAULT_SMTP_USERNAME}}
AUTHENTIK_EMAIL__PASSWORD{{team.DEFAULT_SMTP_PASSWORD}}
AUTHENTIK_EMAIL__FROM{{team.DEFAULT_SMTP_FROM}}
AUTHENTIK_EMAIL__USE_TLStrue

Restart the container after saving.

Branding​

Authentik's user portal shows an icon per application. For a custom brand icon, go to Applications → Applications → [app] → Edit and paste a base64 data URI into the Icon field. A simple SVG with initials works well:

data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NCIgaGVpZ2h0PSI2NCIgdmlld0JveD0iMCAwIDY0IDY0Ij48cmVjdCB3aWR0aD0iNjQiIGhlaWdodD0iNjQiIGZpbGw9IiMxYTFhMmUiIHJ4PSI4Ii8+PHRleHQgeD0iNTAlIiB5PSI1MCUiIGZvbnQtZmFtaWx5PSJBcmlhbCwgc2Fucy1zZXJpZiIgZm9udC13ZWlnaHQ9ImJvbGQiIGZvbnQtc2l6ZT0iMjgiIGZpbGw9IndoaXRlIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBkb21pbmFudC1iYXNlbGluZT0iY2VudHJhbCI+Uko8L3RleHQ+PC9zdmc+

This renders "RJ" in bold white on a dark navy background with rounded corners.

Permission error on redeploy​

Hit a PermissionError on /templates/if/error.html after a redeploy following a migration, even though that directory (restored from the old server) was already correctly owned by authentik, UID 1000. The real cause was one level up: Coolify creates a fresh scaffold directory per service on redeploy (/data/coolify/services/<uuid>/), owned by its own internal UID (9999), mode 700 — Authentik's UID 1000 couldn't even traverse into it to reach the correctly-owned subdirectories underneath. Fixed by opening traversal on the scaffold directory itself, without touching its ownership:

chmod o+x /data/coolify/services/<uuid>/

Then restarted (not full redeploy) the container, and it came up clean.