Self-hosted identity provider for SSO Authentik is a self-hosted, open-source identity provider that adds single sign-on to web applications and services. Administrators connect apps over standard protocols, compose login and enrollment flows from visual stages, and keep credentials and policies on their own infrastructure instead of a third-party cloud.[1][2]
Quick verdict
Self-hosted SSO with visual flows Authentik is a self-hosted, MIT-licensed identity provider (25821 GitHub stars, version 2026.8.3) offering SSO over OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos, and proxy with a visual flow builder, TOTP and WebAuthn MFA, and air-gapped deployment. The core is free; Enterprise adds privileged access management and directory integrations at $5 per user per month billed annually.[1][2][3]
Capabilities
Broad protocol support Authentik speaks OAuth2 and OpenID Connect, SAML, LDAP, SCIM, RADIUS, Kerberos, and forward-auth proxy, so one deployment can front modern SaaS apps and legacy systems together.[1][2]
Visual flow builder Login, enrollment, and recovery flows are composed from visual stages with conditional policies based on user, group, time, or device signals, without forking the codebase for custom logic.[1]
MFA and passwordless login Multi-factor options include TOTP authenticator apps and WebAuthn passkeys with passwordless login, plus a self-service portal for password resets, profile management, and authenticator enrollment.[1]
Legacy-app outposts Proxy and LDAP outposts extend modern single sign-on to applications that cannot speak OIDC or SAML themselves, which is how teams cover older internal tools.[1]
Automation interfaces A documented REST API plus Terraform provider, Kubernetes, and Docker Compose support lets teams manage providers, flows, and policies as infrastructure as code.[1][2]
Air-gapped operation The server runs fully offline with locally validated Enterprise licenses and no internet dependency, which suits regulated or isolated networks.[1]
OpenID Certified Authentik is OpenID Certified for OpenID Connect, giving relying parties a conformance-tested implementation to integrate against.[1]
Account switching Multi-account switching lets people move between identities in the user portal without repeated full logins.[1]
Who will love it
Centralized workforce SSO Teams consolidating logins across many internal applications behind one directory with per-app policies will get the most value from authentik.[1][2]
Self-hosted customer identity SaaS products that need B2B or B2C login flows under their own control, including external-user pricing at $0.02 per external user per month, fit the Enterprise model.[1][2]
Regulated or offline environments Organizations that must keep authentication inside their own network, including air-gapped sites, benefit most since no vendor cloud ever sees the credentials.[1]
Who should avoid it
No-ops teams Teams without anyone comfortable running Postgres, Redis, and container updates should avoid authentik, since every upgrade, backup, and outage is theirs to handle.[1]
Single-app login needs A team protecting one application gains little from a full identity provider and should prefer that app's built-in authentication or a simpler proxy.[1]
Enterprise-only directory features Buyers whose decision depends on Google Workspace or Microsoft Entra ID integrations, privileged access management, or compliance reporting must budget for Enterprise licenses rather than the free core.[1]
Fit and alternatives
Okta and Auth0 replacement The catalogue positions authentik as an alternative to Okta and Auth0 for centralized SSO, customer identity, and replacing hosted identity providers with self-hosted auth.[1]
Keycloak trade-off Teams comparing self-hosted options typically weigh authentik's flow-builder administration against Keycloak's larger extension ecosystem; the decisive factor is usually which admin model the operating team prefers.[1]
Adoption signal The vendor reports over one million installations and names production users including Cloudflare, CoreWeave, Der Spiegel, and Gopuff, which indicates the server is exercised beyond homelab use.[1]
Questions worth asking
How much does authentik cost per month?
Is there a hosted cloud version of authentik?
Can non-technical teams run authentik without code or servers?
No. Authentik assumes you can run containers and configure providers, policies, and flows for each application. The catalogue rates deployment difficulty as moderate, and teams wanting zero-operational-overhead SSO should consider a hosted identity provider instead.[1]
Which proprietary products does authentik replace?
Authentik covers Okta and Auth0 style workforce and customer-identity workflows for teams that accept self-hosting. Organizations that need a managed SLA without running infrastructure, or that already standardize on Microsoft Entra ID or Google Workspace, will find the operational trade-off less attractive.[1][2]
Sources and editorial review
Source research. Reviewed on October 7, 2026. Written by Sanjib Sah. AI assisted; reviewed by a human editor.
We have not run or tested this product.
- authentik homepage
official · Observed October 7, 2026
Vendor homepage: self-hosted open-source identity provider positioning, over one million installations, named production users, protocol breadth, Kubernetes/Terraform/Docker Compose deployment, API-driven automation.
- authentik pricing
official · Observed October 7, 2026
Official pricing page: free open-source scope (OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos, proxy, OpenID Certified, RAC, token exchange, account switching), Enterprise at $5/user/month plus $0.02/external user/month billed annually, enterprise-only feature list.
- OpenAlternative public project detail for authentik
official · Observed October 7, 2026
Platform catalogue record: tagline, description paragraphs, highlights, repository goauthentik/authentik, 25821 stars, version 2026.8.3, MIT license, self-hosted deployment options including air-gapped, no hosted service, alternativeTo Okta and Auth0, moderate deployment difficulty.