Python identity provider for OIDC, SAML, LDAP and RADIUS
authentik is a self-hosted identity provider (IdP) written in Python. People sign in to it once, and every application that trusts it lets them through. It speaks OAuth2 and OpenID Connect, SAML, LDAP, RADIUS and SCIM. An app that supports none of those can sit behind its authentication proxy, and Windows, macOS or Linux machines open over RDP, VNC or SSH in the browser. Accounts live in authentik's own PostgreSQL database and can also be imported from LDAP, Active Directory or FreeIPA.
The comparison of self-hosted SSO tools sets authentik against the other identity providers and the lighter portals that sit in front of the reverse proxy.
Login flows assembled stage by stage
- Login flows built stage by stage: a flow chains stages (identification, password, second factor, consent...) and policies decide, by default right before each stage, whether it is shown. When the built-in policy types fall short, an expression policy is a snippet of Python.
- A proxy inside the server: the server container includes an embedded outpost that handles the Proxy provider with nothing else to deploy. LDAP, RADIUS and remote access each run in a separate outpost.
- Six kinds of second factor: WebAuthn and passkeys, TOTP, static recovery codes, email, SMS and Duo.
- Location-aware access: a GeoIP policy allows or denies a login by country or network operator (ASN), and flags impossible travel.
- Accounts from elsewhere: SAML, OAuth/OpenID Connect, Kerberos and LDAP sources, plus social logins such as Apple, GitHub, Google and Telegram.
Proprietary Enterprise code next to the MIT core
PostgreSQL has been the only external service since 2025.10. The official Compose file for 2026.8.3 starts three containers: PostgreSQL, a server and a worker, and the docs ask for at least 2 CPU cores and 2 GB of RAM. Redis went away in 2025.10, when caching, tasks and WebSockets moved into PostgreSQL. The release notes warn that this means roughly 50% more database connections.
The worker mounts the Docker socket by default. It uses it to deploy outposts on its own. The docs flag the security risk and offer two ways around it: a Docker socket proxy, or deploying outposts by hand.
The open source edition is aimed at homelabs and simple setups. That is the audience the pricing page gives it. The docs keep Docker Compose for test and small production setups and recommend Kubernetes with the Helm chart for anything larger, with PostgreSQL run outside the chart: the database the chart bundles is meant for demos and tests.
The Enterprise edition sits in the same repository under a proprietary license. The core is MIT, but code under authentik/enterprise/ may only run in production with a subscription: $5 per user per month, billed annually, plus $0.02 per external user per month. A license key unlocks it on the same container images. Among the features it reserves: privileged access management, sync to Google Workspace and Entra ID, client certificate authentication, RADIUS EAP-TLS and enhanced audit logging. The pricing page commits to never moving an open source feature into Enterprise.
No support for the free edition, and no hosted version. Open source users get Discord and GitHub; ticket support starts with Enterprise subscriptions above $1,000. The vendor does not run authentik as a hosted service in any edition.
A feature release every three months since February 2026. 2026.2 shipped on 24 February, 2026.5 on 22 May and 2026.8 on 18 August. The latest release is 2026.8.3, from 17 September 2026, and the security policy lists only the 2026.5 and 2026.8 branches as supported. On Compose, every upgrade starts with a fresh compose.yml, which pins the version.
The project compares itself to Okta, ADFS, Entra ID, Keycloak and Authelia. In the table on its home page, Keycloak and Authelia are the only other columns ticked as both open source and self-hostable. The same table ticks privileged access management and scheduled user offboarding for authentik, without saying that both belong to the Enterprise edition.