Authentik
Authentik is an open-source identity provider and single sign-on platform, and a self-hosted alternative to Okta, Auth0, and Microsoft Entra ID. It centralizes login for web apps, VPNs, and infrastructure through SAML, OAuth2/OpenID Connect, LDAP, RADIUS, and SCIM, with a flow engine that lets you compose enrollment, MFA, and recovery journeys visually. Run it for a homelab or scale it to a production cluster.
Overview
Description
Authentik is an open-source Identity Provider (IdP) and single sign-on solution, and a self-hosted alternative to Okta, Auth0, and Microsoft Entra ID. A configurable flow engine models every authentication, enrollment, and recovery journey as a sequence of stages, so policies like MFA, captcha, and consent are composed rather than coded. It speaks SAML, OAuth2/OpenID Connect, LDAP, RADIUS, and SCIM, letting one directory back every app you run.
Features
- Protocol support: SAML 2.0, OAuth2/OIDC, LDAP, RADIUS, SCIM, and proxy/forward-auth outposts.
- Flow engine: Visual, stage-based flows for login, enrollment, MFA, and password recovery.
- Multi-factor auth: TOTP, WebAuthn/passkeys, SMS, email, and static recovery codes.
- Directory sync: Inbound and outbound sync with Active Directory, Entra ID, and Google Workspace.
- Application proxy: Add authentication in front of apps that have none via reverse-proxy outposts.
- Self-service: Branded user portal, admin interface, and a full REST API.
Technology Stack
- Python / Django core with a Go-based outpost proxy
- PostgreSQL database and Redis for caching and tasks
- TypeScript / Lit web interface
- Docker Compose and Helm for deployment
Requirements
- Docker and Docker Compose (or Kubernetes with the official Helm chart)
- PostgreSQL and Redis (bundled in the sample compose file)
- Minimum ~2 GB RAM; an SMTP server for email notifications
Categories
Topics
Learning resources
Authentik: Single Sign-On for Your Self-Hosted Apps (Forward Auth and OAuth2)
Deploying authentik and putting it in front of self-hosted apps with forward auth, plus configuring an OAuth2 provider for apps with native OIDC support.
By · Invalid Date
ArticleInstall authentik with Docker Compose
The official self-hosting guide: download the compose file, generate secrets, run the database migrations, and create the initial admin account through the recovery flow.
By authentik · Invalid Date
