---
title: "Configure authentik email over SMTP"
description: "AUTHENTIK_EMAIL__* in .env, USE_TLS for 587 or USE_SSL for 465, then ak test_email in the worker."
url: https://www.unitpost.com/docs/smtp/authentik
section: SMTP
updated: 2026-11-02
---
# Configure authentik email over SMTP

## Connection settings

- **Host**: smtp.unitpost.com
- **Username**: unitpost (always this literal value)
- **Password**: Your Unitpost API key (must carry emails:send)
- **Port (STARTTLS)**: 587 (or 2587 if blocked, or 25)
- **Port (implicit TLS)**: 465 (or 2465 if blocked)
- **Security**: TLS 1.2 or 1.3 (required before AUTH)
- **From address**: Any address on a verified domain

## Configure authentik email over SMTP

> AUTHENTIK_EMAIL__* in .env, USE_TLS for 587 or USE_SSL for 465, then ak test_email in the worker.

The authentik Email stage sends enrollment verification and password recovery links using the global `AUTHENTIK_EMAIL__*` settings, unless a stage has SMTP settings of its own. `AUTHENTIK_EMAIL__USE_TLS` is STARTTLS (port 587) and `AUTHENTIK_EMAIL__USE_SSL` is implicit TLS (port 465); they're mutually exclusive, so set exactly one to `true`.

### 1. Create a send-only key

In Unitpost, open Settings → SMTP and create a send-only key. `AUTHENTIK_EMAIL__FROM` defaults to `authentik@localhost`; set it to an address on a verified domain (/docs/domains).

### 2. Add the email settings to .env

With Docker Compose, append these to the `.env` file next to `docker-compose.yml`. On Kubernetes, the same settings go in `values.yaml`.

```env
AUTHENTIK_EMAIL__HOST=smtp.unitpost.com
AUTHENTIK_EMAIL__PORT=587
AUTHENTIK_EMAIL__USERNAME=unitpost
AUTHENTIK_EMAIL__PASSWORD=pk_live_...
AUTHENTIK_EMAIL__USE_TLS=true
AUTHENTIK_EMAIL__USE_SSL=false
AUTHENTIK_EMAIL__FROM=authentik@yourdomain.com
```

> For port 465, set `AUTHENTIK_EMAIL__PORT=465`, `AUTHENTIK_EMAIL__USE_SSL=true` and `AUTHENTIK_EMAIL__USE_TLS=false`.

### 3. Redeploy

The containers read these settings at startup. With Docker Compose, recreate them; on Kubernetes, run `helm upgrade` with your values file.

```bash
docker compose up -d
```

### 4. Send a test with ak test_email

Run it in the worker container. Add `-S` and a stage name to test with that Email stage's settings. On Kubernetes: `kubectl exec -it deployment/authentik-worker -c worker -- ak test_email you@example.com`.

```bash
docker compose exec worker ak test_email you@example.com
```

### 5. Check your Email stages

Stages set to use the global settings pick up the values above. A stage with its own host, port and credentials needs the same Unitpost values entered on the stage.

## Related

- [Metabase SMTP settings for subscriptions and alerts](https://www.unitpost.com/docs/smtp/metabase): Admin → Settings → Email or MB_EMAIL_SMTP_* variables: STARTTLS on 587, SSL on 465.
- [Configure the Gitea mailer over SMTP](https://www.unitpost.com/docs/smtp/gitea): Mailer settings in app.ini with an explicit PROTOCOL and FROM, then Send Testing Email in Site Administration.
- [Send email with Nodemailer over SMTP](https://www.unitpost.com/docs/smtp/nodemailer): createTransport pointed at Unitpost — Node, Next.js, or NestJS.