authentik
Pennsylvania, United States
What it is
authentik is an open-source, self-hostable identity and access management product for workforce sign-on, customer identity, zero-trust security, legacy applications, and API protection. It supports OAuth2/OpenID Connect, SAML2, LDAP, RADIUS, SCIM, Kerberos, and WS-Federation, along with directory synchronization, lifecycle provisioning, and adaptive access policies. Multi-factor options include TOTP, WebAuthn or passkeys, static tokens, email, SMS, and Duo. Policies can consider user attributes, time, and location. Example integrations include Google Workspace, GitHub, Slack, and AWS, while applications supporting SAML or OAuth/OpenID Connect can generally be configured. The authentik Agent supports local login on Windows, macOS, and Linux and authentication for command-line tools such as kubectl and AWS. Deployment can use customer infrastructure including Docker and Kubernetes; the pricing FAQ says there is no hosted version. Security listings include audit logs, session binding, GeoIP or impossible-travel detection, and mTLS client certificates. The open-source plan is free; Enterprise costs $5 a month billed annually.
For and against
For
- Broad identity and authentication protocols
- Multiple MFA methods, including passkeys
- Adaptive policies using time and location
- Runs on Docker and Kubernetes
- Free open-source plan
Against
- No hosted version is currently listed
- Open-source plan includes no support
- Enterprise costs $5 a month billed annually
The verdict
authentik offers extensive protocol, MFA, policy, and deployment coverage for self-hosted identity management. Buyers should weigh infrastructure responsibility and the support limits of the free plan.
Who it suits
authentik suits homelab users and organizations needing self-hosted identity controls across applications, devices, and APIs.
Plans and prices
Free
Open-source edition · OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos, and proxy support · Community Discord support
Read 19 Sep 2026 · goauthentik.io
Enterprise
$5 / user / month · $0.02 / external user* / month · No cost for service accounts · Ticket-based support for subscriptions over $1k
Read 11 Oct 2026 · goauthentik.io
Open Source
OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos, and proxy · Community Discord · No support
Read 11 Oct 2026 · goauthentik.io
Enterprise Plus
Custom contracts · Dedicated, customized support and SLAs · Volume discounts at thousands of users · Support for multi-instance deployments
Read 11 Oct 2026 · goauthentik.io
On the record
- Access policies
- Conditional access policies can use user attributes, time, and location, among other factors.goauthentik.io · read 11 Oct 2026
- Application integrations
- The integrations overview names Google Workspace, GitHub, Slack, and AWS as example applications, and says most applications supporting SAML or OAuth/OpenID Connect can be configured to work with authentik.integrations.goauthentik.io · read 11 Oct 2026
- Authentication
- It supports multi-factor authentication with TOTP and WebAuthn/passkeys, including hardware or software authenticators.goauthentik.io · read 11 Oct 2026
- Deployment
- authentik can run on customers’ own infrastructure, including Docker and Kubernetes, and the pricing FAQ says there is currently no hosted version.goauthentik.io · read 11 Oct 2026
- Device support
- The authentik Agent integrates with Windows, macOS, and Linux devices for local device login and authentication of CLI tools such as kubectl and AWS.goauthentik.io · read 11 Oct 2026
- FIPS
- The pricing page lists FIPS compliance for FedRAMP requirements with Enterprise Plus.goauthentik.io · read 11 Oct 2026
- Identity management
- authentik is an open-source, self-hostable extended identity and access management product.goauthentik.io · read 11 Oct 2026
- Intended users
- The Open Source plan is described as being for homelab users and simple use cases, while Enterprise Plus is described as being for custom contracts and expert support.goauthentik.io · read 11 Oct 2026
- Protocols
- Listed protocols include OAuth2/OpenID Connect, SAML2, LDAP, RADIUS, SCIM, and Kerberos.goauthentik.io · read 11 Oct 2026
- Security features
- Listed security features include audit logging, session binding, GeoIP/impossible-travel detection, and client certificate authentication using mTLS.goauthentik.io · read 11 Oct 2026
- Support
- The open-source plan lists community Discord and no support; paid support is offered as part of enterprise software subscriptions, with ticket support for Enterprise subscriptions over $1k.goauthentik.io · read 11 Oct 2026
- Use cases
- The product supports workforce single sign-on, customer identity management, zero-trust security, legacy application integration, and API security.goauthentik.io · read 11 Oct 2026
