authentik

What is authentik?

authentik is an open source identity provider (IdP) that gives your team one sign-in for every app. You run it on your own infrastructure, connect your applications over standard protocols — SAML, OAuth2/OIDC, LDAP, SCIM, and RADIUS — and manage single sign-on, multi-factor auth, and access policies from one console.

What is authentik best for?

Teams that want a full, self-hosted identity provider — not just a login gate — and are comfortable running a small stack to get it. It fits organizations replacing Okta or Auth0, homelabs consolidating logins, and anyone who needs customizable enrollment and authentication flows over standard protocols without per-user cloud pricing.

What can authentik do?

• Provide SSO across apps with SAML2, OAuth2/OIDC, LDAP, SCIM, RADIUS, and Kerberos
• Enforce multi-factor auth including WebAuthn/passkeys, TOTP, SMS, and email
• Build custom login, enrollment, and recovery flows with a visual flow/stage engine
• Gate apps that don’t speak SSO with a built-in application proxy (forward auth)
• Apply conditional access with policies like GeoIP and impossible-travel detection
• Automate everything through a full REST API, plus a Terraform provider and Blueprints

Where does authentik fall short?

• It needs PostgreSQL and Redis alongside the server, so it’s heavier to stand up than a minimal forward-auth gate like Authelia for a couple of services.
• The flow-and-stage model is powerful but has a real learning curve — mapping out custom authentication flows takes more upfront thought than a fixed login page.
• Several enterprise features are paid, not in the MIT core: Google Workspace / Microsoft Entra directory sync, remote desktop (RDP/SSH/VNC) access, device compliance, mTLS, audit report exports, and vendor support all require an Enterprise license.

Is authentik free?

Yes — the core is open source under the MIT license and free to self-host with no user cap. A paid Enterprise tier ($5 per internal user/month, billed annually, plus $0.02 per external user/month) adds directory sync, remote access, compliance features, and support; Enterprise Plus starts at $20,000/year. The project commits to not moving existing open source features behind the paywall.

What does authentik replace?

authentik is a self-hosted alternative to Okta and Auth0, and it competes with Microsoft Entra ID and Ping Identity. It does the same identity-provider job — SSO, MFA, user directory, and access policies — but runs on your own servers, so you aren’t billed per active user or routing logins through someone else’s cloud.

FAQ

Is authentik open source? Yes. The core is MIT licensed and the source is public on GitHub. A separate Enterprise Edition is proprietary, but the free open source version is a complete identity provider on its own.

Can I self-host authentik for free? Yes — self-hosting the open source core is free with no user limit; you only pay for the server it runs on. Deploy it with Docker Compose, Kubernetes (Helm), or Terraform.

Is authentik a good Okta alternative? For teams willing to self-host, yes — it covers the same SSO, MFA, and policy ground without per-user pricing. If you need a fully managed service with a vendor SLA and zero infrastructure, hosted Okta or Auth0 may still fit better.

What do I need to run authentik? A server (Docker or Kubernetes) plus PostgreSQL for data and Redis for caching and the task queue. Both are part of the standard Docker Compose setup.