authentik is a complete identity provider that issues OIDC and SAML, serves an LDAP outpost for apps that only speak LDAP, and forward-authenticates apps that have no login of their own. It replaces hosted SSO such as Okta, Auth0 or Entra ID for a self-hosted stack.
Our verdict on authentik#
authentik is the only thing in this category that covers all four integration styles: native OIDC, SAML, an LDAP outpost for apps that speak nothing else, and a proxy provider for apps with no auth at all. That completeness is why people choose it and the memory is why they leave. The docs ask for 2 CPU cores and 2 GB of RAM, and a real install spends roughly a gigabyte idle across three containers before anyone logs in. The good news since 2025.10 is that Redis is gone: caching, the embedded outpost's session store and websockets all moved into PostgreSQL, so you run one fewer container and budget about 50 percent more database connections. Licensing is MIT for everything except the authentik/enterprise/ directory, which needs a paid subscription. Nothing behind that wall matters at home: it is Google Workspace and Entra provisioning, RADIUS EAP-TLS, detailed audit logging and CSV export.
Who authentik is for#
Choose it if
- You need SAML for one stubborn application and OIDC for everything else, and refuse to run two identity servers.
- Apps with no authentication at all: the proxy provider plus the embedded outpost gives you forward auth without adding a second product.
- You want one admin UI that shows who logged into what, with an event trail you can search.
- Hosts with 4 GB or more to spare, where a gigabyte of Python is an acceptable line item.
Look elsewhere if
- You are on a 2 GB Raspberry Pi. The documented minimum is 2 GB for authentik alone and you will be swapping before you finish the setup flow.
- You want configuration you can diff and review. authentik's config is objects in Postgres edited through a web UI; blueprints exist but are a second system to learn.
- You need one OIDC issuer for three apps. Pocket ID or Authelia does that in a tenth of the memory and a hundredth of the concepts.
What running it actually looks like#
Three containers: server, worker and PostgreSQL. Redis was removed in 2025.10, so a compose file older than that still starts a Redis you no longer need; upgrade with --remove-orphans to clear it. Generate AUTHENTIK_SECRET_KEY and a Postgres password into .env before first boot. The server wants ./media and ./custom-templates mounted, and the worker wants the Docker socket if you want it to manage outpost containers for you. It listens on 9000 for HTTP and 9443 for HTTPS. First run is /if/flow/initial-setup/, which creates the akadmin password and then closes. From 2026.8 the server only honors X-Forwarded-* headers from networks listed in AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS, so set that before pulling the new tag or every client IP becomes your reverse proxy.
Resource profile#
- Memory
- 1000 MB idle, around 1600 MB in ordinary use. Two Python containers plus PostgreSQL. The docs state a 2 CPU core and 2 GB RAM host minimum and that is not padding; server and worker each sit in the hundreds of megabytes before anyone logs in.
- CPU and acceleration
- Idle CPU is close to zero, but the worker wakes on a schedule for outpost sync, blueprint reconciliation and directory sync, and startup takes tens of seconds while Django migrations and blueprints apply. No GPU, and no sustained load from ordinary logins.
- Storage growth
- Postgres grows almost entirely from the event log, which records every login, flow execution and API call. Shorten the event retention on a small instance or it becomes your largest table. Uploaded icons and backgrounds in the media volume are negligible.
- Operational load
- 4 of 5, Heavy. Three services around a real database, calendar-versioned releases roughly monthly, and breaking changes that land in ordinary releases: Redis was removed in 2025.10 and trusted proxy CIDRs became mandatory in 2026.8. A restore needs the Postgres dump and the original secret key together.
Figures describe a small single-household install and are the working assumptions behind our stack planner. Your numbers will differ with library size, user count and hardware. See methodology.
Data and backup surface#
PostgreSQL is the system of record: users, groups, applications, providers, flows, stages, policies, certificates and tokens all live there. Take a pg_dump, not a file copy of the Postgres data directory. Keep AUTHENTIK_SECRET_KEY with the dump but not inside it, because it lives outside the database and a restore with a different key invalidates sessions and encrypted values. The media/ volume holds uploaded icons and backgrounds; custom-templates/ holds any email templates you wrote. Everything else in the containers is rebuilt from the image. A rehearsed restore looks like: fresh containers, identical secret key, load the dump, start the worker, then let outposts reconnect on their own.
Derived backup shape
Postgres dump. pg_dump (or pg_dumpall) into a file, then snapshot that file plus the app's data volume.
Traps and surprises#
Removing Redis changes your Postgres tuning
2025.10 moved caching, embedded outpost sessions and websockets from Redis into PostgreSQL and dropped the Redis dependency entirely. The release notes warn to expect roughly 50 percent more database connections. If you run an external Postgres with a conservative max_connections, authentik starts refusing connections under load after the upgrade. Raise the limit, delete the old redis config keys, and clear the orphaned container.
Trusted proxy CIDRs became mandatory in 2026.8
The server now ignores forwarded request headers unless the connection comes from a network listed in AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS. Upgrade without setting it and every login appears to originate from your reverse proxy: IP-based policies stop matching, the event log becomes useless, and rate limiting counts everyone as one client. Set the CIDR for your proxy network before you pull the tag, not after.
You can lock yourself out by editing a flow
Authentication is a flow made of stages and policies, and the defaults are editable objects, not code. Remove the wrong stage from the default authentication flow and nobody can log in, including akadmin. The way out is docker compose run --rm server create_recovery_key 10 akadmin, which prints a link valid for ten minutes. Write that command down before you start editing flows, not after.
Proxy provider redirect loops
The embedded outpost runs inside the server container and needs the browser to reach it at the external hostname configured on the provider. If the provider's external host, the app's real hostname and the proxy's forwarded headers disagree, you get an endless bounce between the app and /outpost.goauthentik.io/. The fix is always the same: make the three agree, and route /outpost.goauthentik.io/ on the protected host back to authentik.
MIT core, licensed enterprise directory
authentik moved from GPLv3 to MIT in 2022 when Authentik Security was founded, so the core is genuinely permissive. Everything under authentik/enterprise/ is not: it needs a paid subscription covering your user count, and the features are gated at runtime by a license key. Check the enterprise feature list before you design around Google Workspace or Entra ID provisioning, client certificate auth, or detailed audit logs.
Specifications#
- Category
- Passwords, SSO and identity
- Licence
- MIT (core); authentik/enterprise/ under a separate Authentik Security license (Permissive)
- Written in
- Python / Django, Go (outposts), TypeScript
- First release
- 2020
- Maturity
- Stable
- Datastore
- PostgreSQL
- Default ports
9000,9443- Ships as
- docker compose, helm chart, kubernetes operator
- arm64 builds
- Yes
- Identity
- Native OIDC. It is the identity provider, and it can also federate upward: OAuth, SAML, LDAP and Kerberos sources let you chain an existing directory or social login behind it.
- Replaces
- Okta, Auth0, Microsoft Entra ID, OneLogin
- Project site
- goauthentik.io
- Source
- github.com/goauthentik/authentik
- Documentation
- docs.goauthentik.io
Alternatives to authentik#
Everything else in passwords, sso and identity, closest in operational weight first.
| Tool | Ops load | Idle RAM | Licence |
|---|---|---|---|
| Keycloak | 4, Heavy | 750 MB | Apache-2.0 |
| Authelia | 3, Moderate | 35 MB | Apache-2.0 |
| Vaultwarden | 2, Light | 40 MB | AGPL-3.0 |
| LLDAP | 1, Set and forget | 15 MB | GPL-3.0 |
| Pocket ID | 1, Set and forget | 30 MB | BSD-2-Clause |
Where authentik comes up elsewhere#
Head to head
Migration guides
Guides
Research
Calculators
Reference
Sources#
Facts on this page were checked against the project's own material. Where a number is our own estimate rather than a published figure, the text says so.
Published . Last reviewed . Found something out of date? Tell us and we will fix it and log the change.