Deployments
These deployment guides show how to run Authorizer v2 using the CLI-only configuration model.
Key differences from v1:
- No
.envfile loading by the server - No dashboard-based
_update_envconfiguration - All config is supplied as CLI flags when starting the binary or container
Required Variables
--encryption-key (2.4.0+)Encrypts TOTP shared secrets and OTP digests at rest. Required when --jwt-type
is RS*/ES* — with no --jwt-secret to fall back to, the server refuses to
start without it. With HMAC types (HS*) it falls back to --jwt-secret, but a
distinct value is recommended: rotating the JWT secret otherwise re-keys at-rest
data and locks out every enrolled TOTP user. Omit the flag on releases before
2.4.0, which do not have it. See Server Configuration.
All deployments require these flags with sample values:
--database-type=sqlite \
--database-url=test.db \
--jwt-type=HS256 \
--jwt-secret=test \
--encryption-key="$(openssl rand -hex 32)" \
--admin-secret=admin \
--client-id=123456 \
--client-secret=secret
Deployment Options
| Method | Guide |
|---|---|
| Docker | Docker |
| Binary / Source | Binary |
| Kubernetes | Kubernetes |
| Helm Chart | Helm Chart |
| Heroku | Heroku |
| Railway | Railway |
| Render | Render |
| Fly.io | Fly.io |
| Koyeb | Koyeb |
| EasyPanel | EasyPanel |
| Alibaba Cloud | Alibaba Cloud |
Reference
- Getting Started -- quick start guide
- Server Configuration -- all CLI flags
- Migration v1 to v2 -- upgrade guide