authentik

authentik is an open-source identity and access management platform that organizations deploy on their own infrastructure. It is best suited to teams securing a mixed workforce, customer, and legacy application estate with one policy layer. Its protocol and authentication breadth is impressive, but operating the service yourself is unavoidable.

Overview

authentik combines workforce single sign-on, customer identity management, zero-trust controls, legacy application integration, and API security. It can run with Docker or Kubernetes on infrastructure you control, making it a practical option when data residency or deployment control matters. The trade-off is clear: there is currently no hosted version, so installation, maintenance, and availability remain your responsibility.

The product covers both modern federation and older environments. OAuth2/OpenID Connect, SAML2, LDAP, RADIUS, SCIM, Kerberos, and WS-Federation support reduce the need to bolt separate identity products onto different parts of a stack.

Key features

Authentication and adaptive access

Multi-factor authentication includes TOTP and WebAuthn/FIDO2 passkeys, with hardware and software authenticators. Static tokens, email, SMS, and Duo provide additional methods, although organizations should choose carefully between stronger phishing-resistant credentials and more convenient fallbacks. Conditional policies can evaluate user attributes, time, and location, allowing different access requirements for different contexts instead of enforcing one blanket rule.

Integrations and provisioning

Directory synchronization and lifecycle provisioning address account movement as people join, change roles, or leave. Google Workspace, GitHub, Slack, and AWS are named integrations, while most applications supporting SAML or OAuth/OpenID Connect can be configured. This makes authentik particularly useful for estates that mix SaaS, internal services, and older directory-bound applications.

Devices and security controls

The authentik Agent extends authentication to Windows, macOS, and Linux device login, and can authenticate CLI tools such as kubectl and AWS. Audit logging, session binding, GeoIP and impossible-travel detection, and client-certificate authentication through mTLS add controls beyond basic sign-in. These capabilities suit security-conscious administrators, but they also increase the policy and operational decisions a small team must own.

Pricing

The free Open Source edition costs nothing. It includes OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos, and proxy support, with community Discord support and no vendor support. It is aimed at homelabs and simpler deployments; the absence of formal support matters when identity is business-critical.

Enterprise costs $5 / user / month, billed annually. External users cost $0.02 / external user / month, while service accounts have no charge. Ticket-based support applies to subscriptions over $1k. This is the sensible tier for organizations that need a commercial relationship and predictable per-user pricing, provided their annual commitment and support threshold fit their budget.

Enterprise Plus uses custom contracts and adds expert support, dedicated support and SLAs, multi-instance deployment support, and FIPS compliance for FedRAMP requirements. It targets organizations with demanding compliance or availability obligations rather than teams seeking a low-cost upgrade from the community edition.

Platforms

authentik is available through web and API interfaces and supports Linux, macOS, and Windows environments. Its self-hosted deployment model includes Docker and Kubernetes, while the Agent handles local device authentication across those three desktop operating systems.

Who it's for

Choose authentik when you have administrators capable of running identity infrastructure and need one open-source system across workforce SSO, customer identities, legacy protocols, and APIs. It is also a strong fit for teams requiring passkeys, adaptive policies, directory provisioning, or device and CLI authentication. Homelab users and straightforward deployments can stay on the free edition. Organizations needing SLAs, expert assistance, multiple instances, or FedRAMP-oriented FIPS compliance should budget for Enterprise Plus.

It is a poor match for buyers who want a managed identity service, because authentik has no hosted offering, or for small teams that cannot provide ongoing operational ownership and do not want to pay for enterprise support.

Pros and cons

• Pros: Broad protocol coverage spans modern SSO, directories, provisioning, and legacy systems.
• Pros: Passkeys, TOTP, hardware authenticators, and contextual policies support stronger, more flexible access decisions.
• Pros: Device login and CLI authentication extend identity controls beyond browser applications.
• Pros: The free open-source edition removes license cost for homelabs and simple self-hosted use.
• Cons: No hosted version means your team must deploy, maintain, and secure the service.
• Cons: Community support is the only support on the free edition; vendor assistance requires paid enterprise subscriptions, with ticket support tied to subscriptions over $1k.
• Cons: Enterprise Plus pricing is custom, making costs harder to forecast for advanced support and compliance needs.

Alternatives

miniOrange Identity and Access Management is worth considering when you want a freemium option with a free trial and support for Android and iOS as well as self-hosted platforms.

FusionAuth is an alternative for teams seeking a free, unlimited self-hosted community tier with core authentication features.

Ory suits buyers comparing self-hosted components with a paid production environment priced at $770 per year.

Google Cloud Identity is the better direction when Android, iOS, and web access matter and a $6 per-user monthly annual plan with automated provisioning is acceptable.

AWS IAM Access Analyzer is a narrower, free choice for validating IAM policies rather than running a complete identity platform.

Descope is an option for teams wanting open-source SDKs and a free tier capped at 7,500 monthly active users.

Entrust Identity App is a free mobile and desktop app whose activation depends on an organization using Identity Enterprise.

Evolveum midPoint is another free open-source option, with clustering and selected features requiring an active support subscription.

Browse the Identity and Access Management Software, Passkey Authentication Software, and Single Sign-On Software rankings for broader comparisons.

Verdict

authentik is a strong recommendation for technically capable organizations that want open-source, self-hosted identity across modern, legacy, and device-based workflows. Its main reason to choose is unusually broad protocol, MFA, policy, and integration coverage in one platform. Look elsewhere if you need a hosted service or included vendor support without an enterprise subscription.