authentik
Self-hosted identity provider with visual auth flows and SSO.
About
authentik is an open-source identity provider built with Python (Django) and a TypeScript frontend, aimed at self-hosters who want a full Okta or Auth0 alternative under their own control. It supports OAuth2/OIDC, SAML, LDAP, RADIUS, and SCIM, and its visual flow designer lets admins compose login, registration, MFA, and recovery journeys from modular stages without writing code. Community comparisons put it around 20,000 GitHub stars, making it one of the most popular self-hosted IdPs.
Since version 2025.10 the stack dropped its separate Redis requirement, running server, worker, and PostgreSQL only. Conditional access policies can factor in group membership, time, device, and IP, and forward-auth mode puts SSO in front of apps with no native support. The trade-off versus lighter tools is operational weight: it is a multi-component Python application, not a single Go binary, and idles at a few hundred megabytes of RAM.
What it can do
- Full IdP: OAuth2/OIDC, SAML, LDAP, RADIUS, SCIM
- Visual flow designer for login, MFA, and recovery journeys
- Policy engine with group, time, device, and IP conditions
- Forward-auth proxy mode for apps without native SSO
Setup
Deploy with the official Docker Compose file (wget the compose file from goauthentik.io, then docker compose up -d) or via Helm on Kubernetes.
Prerequisites
Docker or Kubernetes; PostgreSQL (bundled in the compose setup).
Use cases
Works with
Trust score — 8/10
Scored 8/10 (verified tier, metrics-v1). Evidence: Verified via vendor site/docs/GitHub and reputable coverage, wave 93; Trending score 76/100 from researcher assessment.
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.