Put Authentik in front of your services through an outpost, then choose the traffic pattern that matches your policy needs. Use single-application forward authentication when each service needs its own groups or policies; use domain-level forward authentication when several services can share one policy; use proxy mode when Authentik should carry the application traffic itself. Preserve the original host, scheme, and client address, restrict trusted proxy networks, and add WebAuthn for phishing-resistant multi-factor authentication.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What Authentik protects
Authentik is an identity layer for applications that do not provide the access controls you need at the edge. A reverse proxy receives a request for a self-hosted service, asks an Authentik outpost whether the request is authenticated and authorized, and either sends the request to the application or redirects the user to sign in. The application can remain unchanged.
As an Amazon Associate I earn from qualifying purchases.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThe outpost is the component that connects your reverse proxy to Authentik. Your public proxy handles the service hostname and TLS. Authentik handles the login flow, session cookie, group and policy evaluation, and optional multi-factor authentication. This separation lets you protect several unrelated applications without adding a different login system to each one.
There are three practical arrangements:
- Proxy mode: application traffic passes through an Authentik outpost.
- Single-application forward authentication: the existing reverse proxy keeps handling application traffic and calls the outpost for an authentication decision for one application.
- Domain-level forward authentication: one provider protects multiple applications below the same parent domain and shares the authentication URL and cookie scope.
The choice affects where traffic flows, how many providers you maintain, and whether each service can have independent authorization rules.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Choose the right protection pattern
| Pattern | Traffic path | Policy granularity | Administration | Best fit |
|---|---|---|---|---|
| Proxy mode | Client → Authentik outpost → application | Application is represented by the proxy provider and application configuration | Central traffic path; the outpost carries requests | Services where routing through the outpost is acceptable |
| Single-application forward auth | Client → existing reverse proxy → application; proxy asks outpost before forwarding | Independent groups, policies, and bindings for each service | One provider and application per independently governed service | Different teams, risk levels, or access rules per application |
| Domain-level forward auth | Client → existing reverse proxy → application; one shared check covers several hosts | Shared policy; no separate application-level authorization rules per service | One provider, shared authentication URL, and parent-domain cookie scope | A family of services with the same audience and policy |
When proxy mode is appropriate
Proxy mode makes Authentik an explicit hop for the application request. It can simplify a deployment in which you want the outpost to own the protected route, but it adds that hop to every request and requires the outpost to reach the application reliably. Confirm that the service works through the outpost before moving production traffic, especially if it uses long-lived connections, large uploads, or unusual HTTP methods.
When to use single-application forward auth
Use this mode when a service needs its own groups, policies, or bindings. Create a separate Authentik application and proxy provider for that service. The reverse proxy continues to send ordinary application requests to the normal upstream, while the public host also routes /outpost.goauthentik.io to the outpost. This keeps application traffic on your existing proxy while Authentik supplies the authentication decision.
Recommended Free Tools
When domain-level forward auth is safe
Domain-level forward auth reduces configuration by sharing one provider across multiple applications under the same parent domain. It is suitable when those applications should have the same access policy. It cannot express different application-level authorization rules for each service. If one application must be restricted to a smaller group, split it into its own application and provider instead of trying to override the shared domain policy.
Plan the deployment before changing routes
- List each public hostname, its upstream address, whether it uses WebSockets, and the groups that should have access.
- Decide whether each hostname belongs to an independent policy or a shared parent-domain policy.
- Place the Authentik outpost where the reverse proxy can reach it over a private network.
- Decide how users will enroll a second factor and how administrators will recover an account.
- Prepare a rollback path: keep the existing upstream route documented and test an administrative route that does not depend on the new policy.
For a first rollout, protect one low-risk service, verify login and logout behavior, then copy the pattern to the remaining hosts. Do not put authentication middleware on Authentik’s own router; doing so can create a redirect loop or make the identity service unreachable.
Configure a protected service with forward authentication
1. Deploy and connect the outpost
Install an Authentik outpost that can reach your Authentik server and that is reachable from the reverse proxy. When the outpost connects to an HTTPS upstream, configure certificate validation rather than disabling verification. Keep the internal Authentik service ports 9000 and 9443 reachable only from trusted containers or networks when using a proxy such as Traefik.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Give the outpost a stable internal address. Your reverse proxy needs to reach it for the authentication endpoint and, in proxy mode, for application requests. Avoid exposing the internal management path directly to the public Internet.
2. Create the provider and application
- Create a proxy provider for the service or service group.
- For an independently governed service, create a dedicated application and bind the provider to it. Assign the required groups and policies to that application.
- For a shared domain, configure one provider for the parent domain and confirm that every child host is intended to inherit the same access policy.
- Set the external host and scheme exactly as users will access them. A mismatch between the public hostname and the host seen by Authentik can produce incorrect redirects or cookies.
Use separate applications whenever an authorization decision must differ. A shared domain provider is an administrative shortcut, not a replacement for per-service policy design.
3. Route the authentication endpoint
For single-application forward auth, leave the service’s normal path pointed at its existing upstream and add a route for /outpost.goauthentik.io on the same public host. That path must reach the outpost. The reverse proxy’s authentication middleware should call the outpost before allowing the protected request through.
Domain-level forward auth uses the same concept but applies the check across the selected hosts. Verify the parent-domain cookie scope: a broad cookie domain is convenient, but it also means a session is presented to every covered host.
4. Preserve the request identity
The reverse proxy must pass the original request context to Authentik and to the application. Preserve:
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
X-Forwarded-Host(or the originalHostvalue), so redirects and cookie scope use the public hostname.X-Forwarded-Proto, so Authentik knows whether the client used HTTP or HTTPS.X-Forwarded-For, so the client address is available for logging and policy decisions.
Authentik accepts forwarded headers only from trusted proxy networks. Set AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS to the networks that directly connect to Authentik. Do not include a network from which untrusted clients can connect; otherwise a client could forge the headers that determine its apparent host, scheme, or address.
5. Support WebSockets and HTTP/1.1 upgrades
Applications such as terminals, dashboards, and collaboration tools often use WebSockets. The proxy must send Connection: Upgrade and Upgrade: WebSocket over HTTP/1.1 for those routes. Apply the upgrade settings to the application route, and test them after enabling authentication; a successful page load does not prove that the WebSocket handshake works.
6. Test the complete session flow
- Open the public service hostname in a private browser window.
- Confirm that an unauthenticated user is redirected to Authentik.
- Sign in with an account that should be allowed and verify that the application loads from its normal upstream.
- Sign in with an account that lacks the required group or policy and confirm that access is denied.
- Log out, close the browser, and repeat the test to ensure an old session is not masking a routing error.
- Test a WebSocket, upload, redirect, and any API endpoint that the service needs.
Reverse-proxy requirements by platform
The product-specific syntax differs, but the security requirements do not. Configure the equivalent of an authentication subrequest or forward-auth middleware, route the outpost path, and preserve the headers listed above.
Nginx
Use an authentication subrequest for the protected location and keep the application proxy_pass target separate from the outpost location. Forward the original host, scheme, and client address. Add HTTP/1.1 upgrade handling to locations that carry WebSockets. Ensure the outpost endpoint is not itself placed behind the same authentication subrequest.
Free tools Windows power users keep installed
One-click scans. No signup required.
Traefik
Attach a forward-auth middleware to application routers, but not to Authentik’s own router. Keep the internal 9000/9443 connection available only on trusted container networks. Define a separate route for /outpost.goauthentik.io and confirm that the middleware forwards the original host and scheme. If the outpost uses HTTPS, validate its certificate.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Caddy
Map the public host to its ordinary upstream and use the forward-auth equivalent for the access check. Preserve the incoming host and forwarded headers. Add explicit WebSocket testing for services that maintain live connections, because a page that returns correctly can still fail at the upgrade step.
HAProxy and Envoy
Use their native external-auth or forward-auth mechanism to call the outpost, then continue to the normal backend only on a successful decision. Verify that the authentication request receives the original host, scheme, and client address and that the response headers needed for the session are returned to the browser. Keep the outpost management interface private.
Make MFA resistant to phishing
Authentik’s hardening guidance describes requiring a second factor as “the single most effective change you can make to an authentication flow.” Add an Authenticator Validation stage and require users to enroll an authenticator. Authentication alone protects the front door; MFA limits the damage from a stolen password.
Use WebAuthn when phishing resistance matters
WebAuthn binds the credential to the legitimate site origin, making it substantially harder for a fake login page to reuse the response. Authentik’s WebAuthn setup stage supports:
- Security keys such as a YubiKey or Google Titan.
- Platform authenticators such as Windows Hello, Touch ID, and Face ID.
- Passkeys stored by an operating system or password manager.
In the Authenticator Validation stage, restrict accepted device classes to WebAuthn when phishing resistance is the goal. Set WebAuthn user verification to Required when your threat model requires proof that the legitimate user unlocked the authenticator, rather than merely possession of a key.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Make a hardware key mandatory
- Use the WebAuthn setup stage to enroll the hardware key.
- Allow the WebAuthn device class in Authenticator Validation.
- Require that validation stage in the login flow used by the protected applications.
- Enroll a second key or document an administrator recovery process before enforcing the requirement.
Enrollment and validation filters must agree. Authentik notes that older enrollments or unrecognized AAGUIDs can pass a filter without a stored device type. If an allowlist must be enforceable, affected users should re-enroll their authenticators after the policy is corrected.
Protect secrets and sessions
AUTHENTIK_SECRET_KEY signs session cookies and supports cryptographic operations. Generate it from a cryptographically secure source, keep it out of version control, and inject it through a secret manager or equivalent protected mechanism. Treat it as a deployment secret rather than ordinary configuration.
Changing the secret invalidates active sessions. Plan the change as a controlled sign-out event: notify users, confirm that administrators have a working recovery method, rotate the value, and verify that new logins and MFA challenges work afterward.
Keep Authentik patched
Track Authentik security advisories and upgrade promptly. Advisory GHSA-qgqp-xh8r-v73r describes an email-authenticator MFA bypass fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2. Until the relevant fixed version is installed, do not rely on email MFA as the factor protecting your self-hosted services. Prefer WebAuthn or another factor appropriate to your deployment’s threat model.
After an upgrade, test the login flow, outpost connectivity, cookies, WebSockets, and at least one denied-policy case. A version change can expose an existing header or certificate mistake even when the application itself has not changed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Troubleshoot the most common failures
| Symptom | Likely cause | What to check |
|---|---|---|
| Redirect loop between the service and Authentik | Forward-auth middleware is applied to Authentik’s own router, or the public scheme/host is not preserved | Exclude Authentik’s router; verify Host/X-Forwarded-Host and X-Forwarded-Proto. |
| Authentication endpoint returns 404 | The public host does not route /outpost.goauthentik.io to the outpost |
Check the path match, router priority, and outpost reachability. |
| Users authenticate but are denied unexpectedly | Wrong application binding, group, policy, or domain-level provider | Review the application-to-provider binding and test with an account deliberately placed inside and outside the required group. |
| Redirects point to an internal hostname or HTTP | Original host or scheme was lost at the proxy | Preserve Host/X-Forwarded-Host and X-Forwarded-Proto; confirm the external URL in the provider. |
| Client IPs all appear to be the proxy | X-Forwarded-For is missing, overwritten, or not trusted |
Pass the client chain and restrict AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS to direct proxy networks. |
| WebSocket connection closes immediately | HTTP/1.1 upgrade headers were not passed | Send Connection: Upgrade and Upgrade: WebSocket on the application route. |
| Outpost cannot connect to an HTTPS upstream | Certificate validation failure or an incomplete trust chain | Install a valid chain and keep TLS verification enabled; do not solve the problem by disabling validation. |
| A WebAuthn device passes an allowlist unexpectedly | Older enrollment or unrecognized AAGUID has no stored device type | Have the affected user re-enroll, then retest the device-class restriction. |
Operational checklist
- Every protected host has an explicit choice of proxy mode, single-application forward auth, or domain-level forward auth.
- Independent groups and policies use separate applications and providers.
- The outpost path is reachable on the public host, while Authentik’s internal ports remain private.
- The proxy preserves host, scheme, and client address and trusts forwarded headers only from known networks.
- WebSocket routes pass HTTP/1.1 upgrade headers.
- Authenticator Validation is required, with WebAuthn selected when phishing resistance is required.
- WebAuthn enrollment and validation device filters are aligned, and users have a recovery credential.
AUTHENTIK_SECRET_KEYis generated securely, stored outside version control, and rotated deliberately.- Security advisories are monitored and the deployment is on a version that fixes known MFA bypasses.
- Login, denial, logout, WebSocket, upload, redirect, and recovery scenarios are tested after every routing or Authentik change.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
