authentik

authentik is an open-source identity and access management platform for teams that want to run sign-in and access controls on their own infrastructure. It is especially suited to organizations with a mix of workforce, customer, and legacy applications. Its protocol breadth is a strong reason to consider it; teams wanting hosted identity should look elsewhere.

Overview

authentik brings workforce single sign-on, customer identity management, zero-trust security, legacy application integration, and API security into one self-hostable product. Its broad protocol support can help consolidate identity across a varied application estate. The trade-off is operational: deployment is on customer infrastructure, including Docker and Kubernetes, and authentik currently has no hosted version.

Key features

Authentication and access control

Multi-factor authentication includes TOTP and WebAuthn/passkeys, with hardware or software authenticators. Other supported methods include static tokens, email, SMS, and Duo. Conditional access policies can take user attributes, time, and location into account, giving teams a way to apply different access rules by context. Audit logging, session binding, GeoIP and impossible-travel detection, and mTLS client certificate authentication add controls for organizations with more demanding security needs.

Protocols and integrations

OAuth2/OpenID Connect, SAML2, LDAP, SCIM, RADIUS, Kerberos, and WS-Federation cover modern federation alongside directory and legacy access needs. Directory sync and lifecycle provisioning are supported. Google Workspace, GitHub, Slack, and AWS are examples of integrations, and applications supporting SAML or OAuth/OpenID Connect can generally be configured to work with authentik. That flexibility is useful for mixed stacks, though teams should expect to manage their own deployment and application configuration.

Device support

The authentik Agent works with Windows, macOS, and Linux for local device login and CLI authentication, including tools such as kubectl and AWS. This extends the product beyond browser sign-in for teams managing those operating systems and command-line workflows.

Pricing

The free Open Source edition costs nothing. It includes OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos, and proxy support, with community Discord and no support. It is positioned for homelab users and simple use cases; organizations relying on timely vendor assistance should weigh the lack of support before adopting it for critical identity infrastructure.

Enterprise costs $5 a month, billed annually, at $5 / user / month. External users cost $0.02 / external user* / month, and service accounts have no cost. It includes ticket-based support for subscriptions over $1k. This is the paid option for teams that need a subscription and may qualify for ticket support, but the annual billing term and per-user charges matter as workforce or external-user counts grow.

Enterprise Plus has custom pricing. It adds custom contracts and expert support, dedicated support and SLAs, multi-instance deployment support, and FIPS compliance for FedRAMP requirements. It is the fit for organizations that need those support and deployment commitments or FIPS compliance; smaller installations may not need the additional tier.

Platforms

authentik supports API, Linux, macOS, self-hosted, web, and Windows environments. Running it on customer infrastructure provides deployment control, but also means the operating organization is responsible for hosting it rather than relying on a hosted authentik service.

Who it's for

authentik suits IT and security teams consolidating sign-in across workforce and customer applications, especially where legacy protocols, device authentication, or adaptable access policies matter. It is also a credible choice for homelab users and simpler deployments through the free edition. Teams without capacity to operate identity infrastructure, or those that require a hosted service, should choose another approach.

Pros and cons

Broad protocol coverage: modern federation, directory, provisioning, and legacy protocols make it practical for mixed application environments.

Flexible authentication and policy controls: passkeys and other MFA methods pair with conditional access and security features such as mTLS and travel detection.

Free self-hosted edition: the Open Source plan covers core protocols and proxy support without a license charge, making it viable for homelabs and simple use cases.

Self-hosting is mandatory: there is no hosted version, so buyers must provide and operate the infrastructure.

Free-plan support is limited: community Discord is the support channel, while vendor ticket support is tied to paid subscriptions over $1k.

Enterprise costs scale with users: the annual $5 per-user price and external-user charge can add up for larger populations.

Alternatives

miniOrange Identity and Access Management is worth comparing for buyers who want a freemium IAM option with a free Customer IAM plan that includes two to three social logins, plus a free trial.

FusionAuth is another freemium choice; its free Community plan is self-hosted and described as unlimited, making it a relevant comparison for teams prioritizing a free self-hosted tier.

Ory offers a freemium option with a Developer tier and a Production plan at $770 a year, a comparison for teams evaluating a priced production tier.

SpiderOak is an alternative with a free open-source offering and paid plans, though its listed platform coverage is Linux, macOS, and Windows.

Evolveum midPoint is a free, open-source option with no license fee; clustering and selected features require an active support subscription.

Google Cloud Identity may suit buyers preferring a cloud identity option, with a Premium annual or fixed-term plan priced at $6 a month.

AWS IAM Access Analyzer is a narrower free alternative for IAM policy validation and policy generation rather than a broad identity platform.

Descope is a freemium alternative whose free plan includes 7,500 MAUs, 10 monthly active tenants, and 3 SSO connections; it also states that all SDKs are open source.

For broader comparisons, see Identity and Access Management Software, Single Sign-On Software, and Passkey Authentication Software.

Verdict

Choose authentik if you need broad identity protocols, flexible authentication, and self-hosted control across workforce, customer, and legacy applications. Its free edition is substantial for homelabs and simple use cases, while Enterprise adds annual per-user pricing and access to paid support. Look elsewhere if you need hosted identity or cannot take on infrastructure management and the support limits of the free plan.