Tools · SPBoucher
Menu

authentik

by Authentik Security Inc. · Application · also known as goauthentik

Self-hosted identity provider with OIDC, SAML, LDAP, RADIUS and SCIM support and a built-in application proxy, with an MIT core and an enterprise edition

MIT licenseOpen sourceFreeEnterpriseSelf-hostedSelf-hostable
Visit official site Compare

Link verified Nov 2, 2026

Overview

authentik is an identity provider from Authentik Security Inc. designed for self-hosting. It offers single sign-on through OAuth 2.0 and OpenID Connect, SAML 2.0 and token exchange, exposes directories through LDAP and RADIUS outposts, provisions users with SCIM, and includes an application proxy that adds authentication in front of services that have none. Flows and stages let administrators compose login, enrollment and recovery journeys in the web interface without code, and integrations with Traefik, Caddy and NGINX forward-auth are documented.

The server is written in Python (Django) with Go outposts, deployed with Docker Compose, Kubernetes or Terraform, and backed by PostgreSQL. The repository is MIT licensed except for the enterprise directory, which carries a separate license; the enterprise edition adds support and features for larger organizations.

authentik is lighter to run than Keycloak and popular in homelabs and small companies, but it is a younger project with a smaller ecosystem of third-party adapters, and some capabilities sit behind the enterprise license.

Capabilities

  • OAuth 2.0, OpenID Connect and SAML 2.0 identity provider
  • LDAP and RADIUS outposts and SCIM provisioning
  • Application proxy and forward-auth for legacy services
  • Visual flows and stages for login, enrollment, MFA and recovery
  • Social and enterprise identity source federation
  • Docker Compose, Kubernetes and Terraform deployment

Typical workflows

  1. Put SSO in front of self-hosted dashboards through forward-auth on Traefik or Caddy
  2. Provide LDAP to applications that lack OIDC
  3. Federate Google or Microsoft logins into one tenant

Strengths

  • MIT-licensed core and easy Compose deployment
  • Built-in proxy covers apps without native auth
  • Flexible visual flow editor

Limitations

  • Some features require the enterprise license
  • Smaller ecosystem than Keycloak
  • Requires PostgreSQL and (optionally) Redis to run

Prerequisites

  • Docker Compose or Kubernetes host
  • PostgreSQL database

Who it is for

  • Self-hosters and homelab operators
  • Small and medium organizations owning their identity

Alternatives & comparison

Keycloak is the longer-established, Apache-2.0, CNCF-governed Java server with broader enterprise adoption; authentik trades some depth for a lighter footprint, a built-in proxy and a visual flow editor, with an enterprise tier for advanced needs.

  • Keycloak

    Open-source identity and access management server providing single sign-on with OpenID Connect, OAuth 2.0 and SAML, user federation and fine-grained authorization

    Open sourceOpen source
  • Web Authentication (WebAuthn)

    W3C standard defining the browser API for creating and using public-key credentials, the basis of passkeys and FIDO2 hardware-key authentication

    Open sourceFree
Compare authentik with its alternatives →

Sources & verification

Primary sources consulted for this record. Claims are tied to the fields each source supports; the automated link checker re-verifies every URL on a schedule.

  • License
    authentik LICENSE

    https://github.com/goauthentik/authentik/blob/main/LICENSE

    Supports: license_spdx, source_model

    MIT except authentik/enterprise (separate license) and website content (CC BY-SA 4.0).

    checked Nov 1, 2026
  • Official documentation
    authentik Documentation

    https://docs.goauthentik.io/

    Supports: capabilities, integrations, prerequisites

    checked Nov 1, 2026
  • Official site
    authentik

    https://goauthentik.io/

    Supports: name, summary, vendor, capabilities

    checked Nov 1, 2026
  • Pricing page
    authentik Pricing

    https://goauthentik.io/pricing

    Supports: pricing_model

    checked Nov 1, 2026
Confidence
High
Reviewed
Nov 1, 2026
Links
Verified · Nov 2, 2026

Spotted an error?

Broken link, outdated license, wrong category, or a tool that no longer exists? Tell us; reports are reviewed by the editor.

1Password

AgileBits Inc. (1Password) · Secrets management

In-depth entry

Password and secrets manager for individuals, families and businesses with end-to-end encrypted vaults, passkeys, an SSH agent and a developer CLI

ProprietaryPaidEnterpriseLocalNov 2, 2026

Web Authentication (WebAuthn)

W3C Web Authentication Working Group (with the FIDO Alliance) · Identity & access

W3C standard defining the browser API for creating and using public-key credentials, the basis of passkeys and FIDO2 hardware-key authentication

Open sourceFreeLocalBroken

Bitwarden

Bitwarden Inc. · Secrets management

Open-source password manager with hosted and self-hosted server options, passkey support, organization sharing and a separate Secrets Manager for developers

AGPL-3.0-onlyFreemiumPaidLocalSelf-hostedNov 2, 2026