authentik vs Kinde

authentik is an open-source, self-hostable identity and access management product for workforce single sign-on, customer identity, zero-trust security, legacy application integration and API security. It supports OAuth2/OpenID Connect, SAML2, LDAP, RADIUS, SCIM and Kerberos, as well as WS-Federation. MFA options include TOTP, WebAuthn/passkeys, email, SMS, Duo and static tokens. Access policies can consider factors such as user attributes, time and location. Security features include audit logging, session binding, GeoIP and impossible-travel detection, and client certificate authentication with mTLS. It can run on customer infrastructure, including Docker and Kubernetes; the pricing FAQ says there is no hosted version currently. The authentik Agent integrates with Windows, macOS and Linux for local device login and CLI authentication. A free open-source plan includes community Discord support but no product support. Enterprise costs $5 a month, billed annually, at $5 per user per month; external users are $0.02 per month and service accounts have no cost.

Kinde is a cloud platform combining authentication, access management, subscription billing, and feature management for SaaS products. Sign-in options include passwords, passwordless access, enterprise SSO, machine-to-machine access, social and developer logins, and multi-factor authentication. Organizations and multi-tenancy support B2B models. Feature flags provide 10 on Free and unlimited flags on Pro and higher plans. The Free plan includes 10,500 monthly active users, two custom roles, 10 permissions, five custom properties, one webhook, and two environments. Paid plans start at $25 a month. Listed billing transaction fees are 0.7% on Free and Pro, 0.6% on Plus, and 0.5% on Scale; prices are indicative and vary with actual usage. Kinde provides APIs and SDKs for iOS and Android. It lists ISO 27001 registration, SOC 2 Type 2 attestation, HIPAA compliance, and GDPR compliance. Stated protections include AES256 encryption at rest and TLS 1.2 or later in transit, alongside OAuth 2.0, CSRF protections, DMARC, DNSSEC, and a strict content security policy.