Authentik
An identity provider for single sign-on across your self-hosted apps
Alternative toOktaAuth0
Authentik gives all your self-hosted apps one login, with single sign-on over OIDC, SAML and LDAP, multi-factor authentication and a proxy for apps that have no login of their own. Most of the code is MIT licensed, and enterprise features sit under a separate paid license.
Best for when
- you run several apps and want one login for all of them
- you want passkeys or two-factor login in front of apps without it
- you manage accounts for family members or a small team
Watch out for
- flows, stages and providers are a lot of concepts for a first setup
- it becomes a single point of failure for logging into everything
- it uses more RAM than lighter authentication tools
One account for every app
Instead of separate passwords for every service, apps that support OIDC or SAML send users to Authentik to sign in. For apps with no login at all, its proxy outpost can sit in front and require authentication. It supports TOTP, WebAuthn passkeys and other factors, plus user enrolment and recovery flows.
It suits homelabs and small organisations with many apps and several users. The flexibility comes from flows and stages you can customise, which is powerful but takes time to understand.
What running it costs
It runs as a server and a worker with a PostgreSQL database, and the documentation suggests around two gigabytes of RAM. Back up the database and the media folder, and keep a way into your apps that does not depend on Authentik, in case it breaks.
Once it is in place, it becomes the front door to everything. Keep it updated quickly when security releases ship, protect admin accounts with strong factors, and think carefully before exposing it to the internet.
