How to pass secret to AUTHENTIK SECRET_KEY environment

[mustafakibar]

version: '3.8'

services:
  authentik-server:
    image: ghcr.io/goauthentik/server:${AUTHENTIK_VERSION:-2025.2.3}
    command: server
    secrets:
      [postgres_extd_password, authentik_secret_key, authentik_email_password]
    volumes: [authentik_media:/media, authentik_static:/static]
    environment:
      AUTHENTIK_REDIS__HOST: 'redis'
      AUTHENTIK_POSTGRESQL__HOST: 'postgres-extd'
      AUTHENTIK_POSTGRESQL__USER: ${POSTGRES_USER}
      AUTHENTIK_POSTGRESQL__PASSWORD: /run/secrets/postgres_extd_password  # < here
      AUTHENTIK_POSTGRESQL__NAME: ${POSTGRES_DB}
      AUTHENTIK_SECRET_KEY: /run/secrets/authentik_secret_key  # < here
      AUTHENTIK_ERROR_REPORTING__ENABLED: 'true'
      AUTHENTIK_EMAIL__HOST: ${AUTHENTIK_EMAIL__HOST}
      AUTHENTIK_EMAIL__PORT: ${AUTHENTIK_EMAIL__PORT}
      AUTHENTIK_EMAIL__USERNAME: ${AUTHENTIK_EMAIL__USERNAME}
      AUTHENTIK_EMAIL__PASSWORD: /run/secrets/authentik_email_password # < here
      AUTHENTIK_EMAIL__USE_TLS: ${AUTHENTIK_EMAIL__USE_TLS:-true}
      AUTHENTIK_EMAIL__USE_SSL: ${AUTHENTIK_EMAIL__USE_SSL:-false}
      AUTHENTIK_EMAIL__TIMEOUT: ${AUTHENTIK_EMAIL__TIMEOUT:-10}
      AUTHENTIK_EMAIL__FROM: ${AUTHENTIK_EMAIL__FROM}
    deploy:
      replicas: ${AUTHENTIK_SERVER_REPLICAS:-1}
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
        window: 120s
        
  ... # worker # ...
      
volumes:
  authentik_media:
    name: "kibar_authentik_media"
    external: true
  authentik_static:
    name: "kibar_authentik_static"
    external: true
    
      ...

I can view the secret names mentioned above with the docker secret ls command. However, when I run it, I get the secret key is missing error. Even though I add _FILE to the end of each one (AUTHENTIK_SECRET_KEY_FILE etc.), I get the same error.

[rissson]

AUTHENTIK_SECRET_KEY: file:///run/secrets/authentik_secret_key

[Snocember]

This solution broke some versions ago for me, did something change?

[rissson]

no, and it still works on basically all the versions released in the past 6 months