Project setup

1. Copy the source/ directory into your project root, or symlink source/packages/client-ts as a local package.

2. Add the local package to your package.json:

   {
     "dependencies": {
       "@goauthentik/client-ts": "file:./source/packages/client-ts"
     }
   }
   

3. Extend the root tsconfig.json from source/:

   {
     "extends": "./source/tsconfig.json",
     "compilerOptions": {
       "rootDir": "src",
       "outDir": "dist"
     },
     "include": ["src"]
   }
   

4. Set required environment variables in your .env:

   AUTHENTIK_BASE_URL=https://authentik.example.com
   AUTHENTIK_API_TOKEN=your-api-token-here
   

5. Run npm install from the project root to resolve the workspace symlink.

6. Build with tsc or your existing bundler — no additional compilation of the authentik source is needed for the TS client.

Public API

Configuration (runtime)

import { Configuration } from "@goauthentik/client-ts";

const config = new Configuration({
  basePath: process.env.AUTHENTIK_BASE_URL,
  headers: { Authorization: `Bearer ${process.env.AUTHENTIK_API_TOKEN}` },
});

Configuration is the root object passed to every API class. It holds the basePath, default headers (including the Authorization: Bearer token), and optional fetch overrides. Construct one instance and share it across all API clients in your service.

StagesApi

import { StagesApi, Configuration } from "@goauthentik/client-ts";

const stages = new StagesApi(config);
const list = await stages.stagesAllList({});

StagesApi exposes CRUD and list operations for every stage type (email, TOTP, password, identification, user write, etc.). Use it when you need to programmatically create enrollment flows or audit existing stage configurations.

CoreApi

import { CoreApi, Configuration } from "@goauthentik/client-ts";

const core = new CoreApi(config);
const user = await core.coreUsersRetrieve({ id: 42 });
const groups = await core.coreGroupsList({});

CoreApi covers users, groups, tokens, application entitlements, and authenticated sessions. It is the primary API for user lifecycle management — create, update, deactivate users, and manage group membership.

FlowsApi

import { FlowsApi, Configuration } from "@goauthentik/client-ts";

const flows = new FlowsApi(config);
const allFlows = await flows.flowsInstancesList({});
const diagram = await flows.flowsInstancesDiagramRetrieve({ slug: "default-enrollment" });

FlowsApi lets you list, create, and inspect flows and their bound stages. Use flowsInstancesDiagramRetrieve to visualize a flow's stage graph for debugging or documentation generation.

Working examples

Scenario - List all authentication stages

Retrieve every stage bound to any flow in the authentik instance and log their names and types.

import { Configuration, StagesApi } from "@goauthentik/client-ts";

const config = new Configuration({
  basePath: process.env.AUTHENTIK_BASE_URL ?? "https://authentik.example.com",
  headers: { Authorization: `Bearer ${process.env.AUTHENTIK_API_TOKEN}` },
});

async function listAllStages() {
  const api = new StagesApi(config);
  const result = await api.stagesAllList({});
  for (const stage of result.results) {
    console.log(`[${stage.verboseName}] ${stage.name} — pk: ${stage.pk}`);
  }
}

listAllStages().catch(console.error);

Scenario - Create a new user and add to a group

Provision a user account and assign it to an existing group by pk.

import { Configuration, CoreApi } from "@goauthentik/client-ts";

const config = new Configuration({
  basePath: process.env.AUTHENTIK_BASE_URL!,
  headers: { Authorization: `Bearer ${process.env.AUTHENTIK_API_TOKEN}` },
});

async function provisionUser(username: string, email: string, groupPk: string) {
  const core = new CoreApi(config);

  const user = await core.coreUsersCreate({
    userRequest: {
      username,
      email,
      name: username,
      isActive: true,
      groups: [groupPk],
      attributes: {},
    },
  });

  console.log(`Created user ${user.username} with pk ${user.pk}`);
  return user;
}

provisionUser("jdoe", "jdoe@example.com", "group-uuid-here").catch(console.error);

Scenario - Retrieve flow diagram for an enrollment flow

Fetch the Mermaid diagram of a named flow for documentation or audit purposes.

import { Configuration, FlowsApi } from "@goauthentik/client-ts";

const config = new Configuration({
  basePath: process.env.AUTHENTIK_BASE_URL!,
  headers: { Authorization: `Bearer ${process.env.AUTHENTIK_API_TOKEN}` },
});

async function printFlowDiagram(slug: string) {
  const flows = new FlowsApi(config);
  const diagram = await flows.flowsInstancesDiagramRetrieve({ slug });
  console.log("Flow diagram (Mermaid):");
  console.log(diagram.diagram);
}

printFlowDiagram("default-enrollment-flow").catch(console.error);

File walkthrough

• .cargo/ — Rust toolchain pins (rust-toolchain.toml) and deny.toml for supply-chain auditing; only relevant when building outpost binaries.
• .github/ — All CI/CD definitions: Docker build reusable workflows, npm publish, CodeQL, Semgrep, and release automation.
• .vscode/ — Workspace extension recommendations for VS Code; safe to ignore or keep.
• authentik/ — The Django application core: all Python models, signals, API views, flow engine, policy engine, and stage implementations.
• blueprints/ — Declarative YAML blueprints for bootstrapping authentik with default flows, stages, and scopes.
• cmd/ — Go main packages for the LDAP, proxy, RADIUS, and SCIM outpost binaries.
• internal/ — Shared Go/Rust libraries consumed by cmd/.
• lifecycle/ — Shell scripts executed by Docker entrypoint for migrations, worker startup, and readiness probes.
• locale/ — PO/MO translation catalogs for the Django backend; Lit frontend translations live under web/.
• packages/ — npm workspace containing client-ts (the generated TypeScript REST client), docusaurus-config, and esbuild-plugin-live-reload.
• schemas/ — OpenAPI 3 schema that is the source of truth for client-ts code generation.
• scripts/ — Utility scripts for code generation, linting, and release tooling.
• web/ — The Lit Element-based admin and user-facing frontend; built separately from the TS client.
• manage.py — Standard Django management command entry-point.
• package.json — npm workspaces root; defines top-level scripts that orchestrate all packages.
• pyproject.toml — Python dependencies and tooling (Poetry/pip).
• Cargo.toml — Rust workspace manifest for outpost binary crates.
• tsconfig.json — Shared TypeScript compiler settings inherited by all packages/.

Common pitfalls and fixes

• Missing Authorization header causes 401 on every call — Always pass headers: { Authorization: "Bearer <token>" } in Configuration; the client does not read env vars automatically.
• basePath trailing slash causes double-slash URLs — Do not include a trailing / in AUTHENTIK_BASE_URL; the generated client appends paths starting with /.
• ESM/CJS interop errors when importing client-ts — The generated client uses CommonJS; if your project is "type": "module", use a dynamic import() or set "esModuleInterop": true in tsconfig.json.
• Outdated generated client vs. running authentik version — The client-ts types are generated from schemas/; if your authentik server version differs from 2026.5.0-rc1, some model fields may be missing or extra — regenerate from the live /api/v3/schema/ endpoint.
• cross-fetch not found at runtime in Node < 18 — Node 18+ ships native fetch; for older Node versions add npm install cross-fetch and import it before the API client initializes.
• TypeScript path aliases not resolving — If you extend source/tsconfig.json, verify your bundler (Webpack/esbuild) also has corresponding alias entries; tsconfig paths alone do not affect runtime resolution.

Vibe-coding prompt template

I have a copy of the authentik Identity Provider source in `source/` and its
integration guide in `source/USAGE.md`. The upstream npm package is
`@goauthentik/authentik@2026.5.0-rc1`.

The TypeScript REST client lives at `source/packages/client-ts/src/index.ts`
and re-exports everything from `./apis/index` and `./models/index`.

Please integrate this into my existing Node.js/TypeScript project step-by-step:

1. Add `source/packages/client-ts` as a local npm dependency.
2. Create a shared `authentikClient.ts` module that reads AUTHENTIK_BASE_URL
   and AUTHENTIK_API_TOKEN from environment variables and exports a configured
   instance of Configuration, CoreApi, StagesApi, and FlowsApi.
3. Write a function that lists all users (CoreApi.coreUsersList) and returns
   typed results.
4. Write a function that retrieves all flows (FlowsApi.flowsInstancesList).
5. Ensure all imports reference real exports from
   `source/packages/client-ts/src/apis/index.ts` and
   `source/packages/client-ts/src/models/index.ts` as listed in USAGE.md.
6. Add error handling with typed authentik API error responses.
7. Show me the final tsconfig.json changes needed.

License and credit

authentik is released under the MIT License for the community edition (see source/LICENSE); enterprise components under authentik/enterprise/ carry a separate commercial license. Refer to source/SECURITY.md for vulnerability disclosure.

Upstream project: goauthentik/authentik — npm package @goauthentik/authentik@2026.5.0-rc1.

This product’s unique contribution is clean room implementation of valuable code block into AVCP compatible standard.

The full install guide and integration prompts unlock after purchase.

AI-First Identity and Access Management Server

Automation, Utilities & Developer Tools

Free