# Authelia

> A light login portal with two-factor auth in front of your reverse proxy

Category: Self hosted apps (https://aiarabicdev.com/self-hosted)
Canonical page: https://aiarabicdev.com/self-hosted/authelia
Tags: authentication, 2fa, sso, security, reverse-proxy

Authelia adds a login page and two-factor authentication in front of web apps through your reverse proxy, and can also act as an OpenID Connect provider. It is Apache-2.0 licensed, written in Go, and uses very little memory.

## Facts

- Licence: Apache-2.0
- Language: Go
- Cost: Free and open source
- Self hostable: yes
- Added: 2026-10-25
- Last checked: 2026-10-25

## Links

- Website: https://www.authelia.com
- Source: https://github.com/authelia/authelia

## A gate in front of your apps

Authelia works with reverse proxies that support forward authentication. Each request is checked first, and anyone without a session is sent to the Authelia portal to sign in with a password and a second factor such as TOTP or a WebAuthn key. Access rules decide which users can reach which domains.

It suits people who already run a reverse proxy and want a simple, solid login layer for dashboards and tools. It can also serve OpenID Connect to apps that support it, which covers a good part of single sign-on needs.

## What running it costs

It is a single Go binary using tens of megabytes of RAM. Users live in a YAML file or an LDAP directory, and settings are a configuration file rather than a web interface. For more than one instance you add Redis for sessions and a SQL database for storage.

Back up the configuration, the users file and the storage database. Because it guards other apps, a mistake in its rules can lock you out or let too much through, so test access rules carefully after every change.

## Reach for it when

- you run a reverse proxy and want two-factor login in front of apps
- you want an authentication layer that uses almost no resources
- you are comfortable managing configuration in files

## Watch out for

- there is no admin web interface, users and rules are managed in files or LDAP
- it depends on a reverse proxy with forward authentication support
- misconfigured access rules can quietly expose an app or lock you out

---

aiarabicdev is a free directory of open source tools. No affiliate links, no sponsored placements.
New entries are announced at https://t.me/arabic_Intelligence