···

       
23
       
 
       
## Deploying

     

       
24
       
 
       


     

       
25
       
 
       
In production, you will need a private key to sign OAuth tokens request. Use the

     

       
26
       
-
       
following command to generate a new JWK (JSON Web Key):

     

       
27
       
 
       


     

       
28
       
 
       
```sh

     

       
29
       
 
       
./bin/gen-jwk

     

       
30
       
 
       
```

     

       
31
       
 
       


     

       
32
       
-
       
The generated key must be added to the environment variables (`.env` file) as `PRIVATE_KEY`.

     

       
33
       
 
       


     

       
34
       
 
       
```env

     

       
35
       
 
       
PRIVATE_KEYS='[{"kty":"EC","kid":"12",...}]'

     

       
36
       
 
       
```

     

       
37
       
 
       


     

       
38
       
-
       
Note that you can have multiple keys. Always add new keys at the beginning of

     

       
39
       
-
       
the array, so that the first key is always the most recent one. When a key is

     

       
40
       
-
       
removed, all associated sessions will be invalidated.

     

       
0
       
 
       

     

       
0
       
 
       

     

       
41
       
 
       


     

       
42
       
-
       
Make sure to also set the `COOKIE_SECRET` in your environment variables (`.env` file), which is used to sign session cookies. You can generate a random string for this:

     

       
0
       
 
       

     

       
0
       
 
       

     

       
43
       
 
       


     

       
44
       
 
       
```sh

     

       
45
       
 
       
openssl rand -base64 33

     

       
46
       
 
       
```

     

       
47
       
 
       


     

       
48
       
-
       
Finally, set the `PUBLIC_URL` to the URL where your app will be accessible. This is used for OAuth client ID and other configurations.

     

       
0
       
 
       

     

       
49
       
 
       


     

       
50
       
 
       
```env

     

       
51
       
 
       
PUBLIC_URL="https://your-app-url.com"

     

···

       
23
       
 
       
## Deploying

     

       
24
       
 
       


     

       
25
       
 
       
In production, you will need a private key to sign OAuth tokens request. Use the

     

       
26
       
+
       
following command to generate a new private key:

     

       
27
       
 
       


     

       
28
       
 
       
```sh

     

       
29
       
 
       
./bin/gen-jwk

     

       
30
       
 
       
```

     

       
31
       
 
       


     

       
32
       
+
       
The generated key must be added to the environment variables (`.env` file) in `PRIVATE_KEYS`.

     

       
33
       
 
       


     

       
34
       
 
       
```env

     

       
35
       
 
       
PRIVATE_KEYS='[{"kty":"EC","kid":"12",...}]'

     

       
36
       
 
       
```

     

       
37
       
 
       


     

       
38
       
+
       
> [!NOTE] The `PRIVATE_KEYS` is an array of keys. Make sure to use single

     

       
39
       
+
       
> quotes, and square brackets around the keys `PRIVATE_KEYS='[<key here>]'`. If

     

       
40
       
+
       
> you generate multiple keys, add new keys at the beginning of the array, so

     

       
41
       
+
       
> that the first key is always the most recent one. When a key is removed, all

     

       
42
       
+
       
> associated sessions will be invalidated.

     

       
43
       
 
       


     

       
44
       
+
       
Make sure to also set the `COOKIE_SECRET`, which is used to sign session

     

       
45
       
+
       
cookies, in your environment variables (`.env` file). You can generate a random

     

       
46
       
+
       
string for this:

     

       
47
       
 
       


     

       
48
       
 
       
```sh

     

       
49
       
 
       
openssl rand -base64 33

     

       
50
       
 
       
```

     

       
51
       
 
       


     

       
52
       
+
       
Finally, set the `PUBLIC_URL` to the URL where your app will be accessible. This

     

       
53
       
+
       
will allow the authorization servers to download the app's public keys.

     

       
54
       
 
       


     

       
55
       
 
       
```env

     

       
56
       
 
       
PUBLIC_URL="https://your-app-url.com"