---
title: Automated install
---

To install authentik automatically (skipping the Out-of-box experience), you can use the following environment variables on the worker container:

:::info
These can't be defined using the file-based syntax (`file://`), so you can't pass them in as secrets in a Docker Compose installation.
:::

### `AUTHENTIK_BOOTSTRAP_PASSWORD_HASH`

Configure the default password for the `akadmin` user using a pre-hashed Django password value. Only read on the first startup.

This stores the hash directly as authentik's local password verifier. Because authentik never sees the raw password, hashed-password imports do not propagate the password to LDAP or Kerberos integrations, even when password writeback is enabled.

To generate a hash, run this command before your initial deployment:

```bash
docker compose run --rm server hash_password 'your-password'
```

The generated hash includes a random salt, so running the command multiple times for the same password produces different output. Use the complete output as the value of `AUTHENTIK_BOOTSTRAP_PASSWORD_HASH`.

:::warning Escaping `$` in Docker Compose
Password hashes contain `$` characters which Docker Compose interprets as variable references.

**In `.env` files**, use single quotes to prevent interpolation:

```bash
AUTHENTIK_BOOTSTRAP_PASSWORD_HASH='pbkdf2_sha256$1000000$xKKFuYtJEE27km09BD49x2$4+Z6j3utmouPF5mik0Z21L2P0og5IlmMmIJ46Tj3zCM='
```

**In `docker-compose.yml`** (inline environment), escape each `$` with `$$`:

```yaml
services:
    worker:
        environment:
            AUTHENTIK_BOOTSTRAP_PASSWORD_HASH: "pbkdf2_sha256$$1000000$$xKKFuYtJEE27km09BD49x2$$4+Z6j3utmouPF5mik0Z21L2P0og5IlmMmIJ46Tj3zCM="
```

See the Docker Compose documentation on [`.env` file interpolation](https://docs.docker.com/compose/how-tos/environment-variables/variable-interpolation/) and [Compose file interpolation](https://docs.docker.com/reference/compose-file/interpolation/) for details.
:::

### `AUTHENTIK_BOOTSTRAP_PASSWORD`

:::warning
This option stores plaintext passwords in environment variables. Use [`AUTHENTIK_BOOTSTRAP_PASSWORD_HASH`](#authentik_bootstrap_password_hash) instead.
:::

Configure the default password for the `akadmin` user. Only read on the first startup.

Setting both `AUTHENTIK_BOOTSTRAP_PASSWORD` and `AUTHENTIK_BOOTSTRAP_PASSWORD_HASH` will result in an error.

### Other hashed-password import paths

For post-install automation, hashed passwords can also be set via blueprints with the `password_hash` user attribute, or via the `/api/v3/core/users/<id>/set_password_hash/` API endpoint with the hash provided in the `password` field. The API endpoint requires the `authentik_core.reset_user_password` permission and can target regular users or service accounts.

These paths share the same local-verifier-only behavior as `AUTHENTIK_BOOTSTRAP_PASSWORD_HASH`.

### `AUTHENTIK_BOOTSTRAP_TOKEN`

Create a token for the default `akadmin` user. Only read on the first startup. The string you specify for this variable is the token key you can use to authenticate yourself to the API.

### `AUTHENTIK_BOOTSTRAP_EMAIL`

Set the email address for the default `akadmin` user.

## Kubernetes

In the Helm values, set the `akadmin` user password hash and token:

```yaml
authentik:
    bootstrap_password_hash: "pbkdf2_sha256$1000000$xKKFuYtJEE27km09BD49x2$4+Z6j3utmouPF5mik0Z21L2P0og5IlmMmIJ46Tj3zCM="
    bootstrap_token: "your-token-here"
    bootstrap_email: "admin@authentik.company"
```

:::note Helm escaping
When using password hashes in quoted YAML strings as shown above, no escaping of `$` characters is required. The `$` character only needs escaping when:

- Using Helm templating syntax (e.g., `{{ .Values.something }}`) where `$` has special meaning
- Referencing values from environment variable substitution in your values file

:::

Or store the password hash in a secret and reference it via `envFrom`:

```yaml
global:
    envFrom:
        - secretRef:
              name: _some-secret_
```

where _some-secret_ contains the environment variables as documented above.
