authentik

authentik is an open-source identity and access management product for teams that need sign-in across workforce, customer, and legacy applications. It suits organizations able to run identity services on their own infrastructure. Its broad protocol coverage is a strong reason to consider it; the lack of a hosted option is a decisive drawback for teams that want a provider to operate the service.

Overview

authentik brings workforce single sign-on, customer identity management, zero-trust security, legacy application integration, and API security into one self-hostable product. That range is useful for organizations with varied identity needs and a mixed application estate. Deployment on customer infrastructure, including Docker and Kubernetes, gives teams control over where the service runs, but also leaves them responsible for operating it. authentik currently has no hosted version.

Key features

Authentication and access control

Multi-factor authentication supports TOTP and WebAuthn/passkeys, including hardware and software authenticators. Other supported methods include static tokens, email, SMS, and Duo. Conditional access policies can use user attributes, time, and location, giving administrators practical ways to tailor access to context. Directory sync and lifecycle provisioning support broader identity administration, while adaptive access is also supported.

Protocols, integrations, and devices

OAuth2/OpenID Connect, SAML2, LDAP, SCIM, RADIUS, Kerberos, and WS-Federation cover modern federation as well as directory and legacy access needs. Google Workspace, GitHub, Slack, and AWS are named integration examples, and applications that support SAML or OAuth/OpenID Connect can generally be configured to work with authentik. This breadth makes the product especially relevant when an organization cannot standardize on a single protocol.

The authentik Agent integrates with Windows, macOS, and Linux for local device login and authentication of CLI tools such as kubectl and AWS. Security features include audit logging, session binding, GeoIP and impossible-travel detection, and client certificate authentication using mTLS. These capabilities add useful controls for teams managing varied users and environments, though they still require a self-operated deployment.

Pricing

Free and Open Source

The Free and Open Source plans are both free. They include OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos, proxy support, and Community Discord access. The Open Source plan is positioned for homelab users and simple use cases; it explicitly includes no support. These plans make sense for individuals and teams able to manage the product themselves, but the community channel is a limited support arrangement for organizations that need accountable response or expert help.

Enterprise

Enterprise costs $5 a month, billed annually, at $5 / user / month. External users cost $0.02 / external user* / month, and service accounts have no cost. Ticket-based support is included for subscriptions over $1k. It is the paid option for organizations that need a defined per-user price and support, although the support threshold means smaller subscriptions should not assume ticket support is included.

Enterprise Plus

Enterprise Plus has custom pricing and is aimed at buyers seeking custom contracts and expert support. It adds dedicated support and SLAs, multi-instance deployment support, and FIPS compliance for FedRAMP requirements. Those provisions suit organizations with demanding operational or compliance needs; teams that do not need them may find the self-managed open-source editions or standard Enterprise plan a better fit.

Platforms

authentik is available for API, Linux, macOS, web, and Windows use, with self-hosted deployment. Its Windows, macOS, and Linux Agent support extends local login and CLI authentication to those desktop and server environments. The deployment model makes it a poor match for teams that require a hosted identity service.

Who it's for

authentik fits organizations consolidating workforce SSO, customer identity, API access, and legacy application authentication, particularly when their applications use different protocols. Homelab users and people with simple use cases can start with the open-source edition. Teams should choose a paid subscription when they need enterprise support, and Enterprise Plus when dedicated support, SLAs, multi-instance deployment, or FIPS compliance for FedRAMP requirements matter. It is not the right choice for buyers unwilling to operate their own infrastructure.

Pros and cons

• Broad protocol coverage: OAuth2/OpenID Connect, SAML2, LDAP, SCIM, RADIUS, Kerberos, and WS-Federation make it useful across modern and legacy systems.
• Flexible access controls: MFA methods, contextual policies, adaptive access, and device authentication support varied sign-in requirements.
• Self-hosted deployment: Running on customer infrastructure, including Docker and Kubernetes, gives teams control over deployment.
• No hosted version: Every organization must operate the infrastructure, ruling it out for teams seeking a managed service.
• Limited free support: The open-source plans provide Community Discord, while Enterprise ticket support applies to subscriptions over $1k.
• Per-user paid pricing: Enterprise charges $5 / user / month billed annually, with an additional external-user charge, so costs depend on the user mix.

Alternatives

Consider FusionAuth if its free Community plan, described as unlimited and self-hosted with core authentication features, better fits your needs. miniOrange Identity and Access Management is another freemium option, with a free Customer IAM plan that includes two to three social logins and a free trial. Ory may suit buyers comparing a freemium option with a $770 / year Production plan; its Developer tier has no published price.

AWS IAM Access Analyzer is a free alternative for IAM policy validation and policy generation. Clerk offers a free Hobby plan with 50,000 MRU per app, up to three dashboard seats, up to five user impersonations, and three social connections. Descope offers a free tier with 7,500 MAUs, 10 monthly active tenants, and three SSO connections. Entrust Identity App is free to download, with activation requiring an organization using Identity Enterprise. Evolveum midPoint is open source with no license fee; clustering and selected features require an active support subscription.

For broader comparisons, browse Identity and Access Management Software, Passkey Authentication Software, or Single Sign-On Software.

Verdict

Choose authentik if your organization needs identity across varied protocols and applications and has the capacity to run the service itself. Its open-source editions offer a wide foundation, and paid plans add support and higher-assurance capabilities. Look elsewhere if you need hosted identity management or cannot take on infrastructure operations.