authentik is an open-source identity provider for SAML, OIDC, LDAP and RADIUS with a visual flow editor. It replaces Okta or Keycloak for self-hosters and startups that want serious SSO without the enterprise price tag.
authentik is an open-source identity provider that lets you replace Okta, Auth0 or Entra ID with software you fully control — one binary, one PostgreSQL, one Redis, and a visual flow editor that handles SAML, OIDC, LDAP and RADIUS in the same admin UI. We rate it 83/100 — outstanding for self-hosting homelabs and growing startups that want serious SSO without the Keycloak learning curve, but the initial setup will absolutely punish anyone who skips the documentation.
authentik is a modern Identity Provider (IdP) built around a concept the project calls flows — configurable, branching sequences of stages (identification, password, MFA, consent, captcha, denial) that you wire up in a graphical editor instead of YAML. The result is a single open-source binary that can act as a full SAML/OIDC IdP, an LDAP server, a RADIUS server and a forward-auth proxy, all from one admin console at the same time.
The project was started in by German engineer Jens Langhammer as an open-source hobby project (originally called Supervisr) and was formally incorporated as Authentik Security, Inc. in 2022 with backing from Open Core Ventures. The GitHub repo at goauthentik/authentik now sits at 21,200+ stars and pushes daily; the project is widely cited in r/selfhosted as the default recommendation for anyone who wants centralized login across Jellyfin, Nextcloud, Proxmox, pfSense and the rest of their homelab.
Sentiment in self-hosted communities is overwhelmingly positive but heavily caveated by the setup curve. On r/selfhosted, threads recommending authentik routinely hit hundreds of upvotes; XDA Developers published a piece in 2024 titled “Authentik was one of the most difficult services I ever set up, but now I can’t live without it” that captures the consensus exactly — flows and stages feel intimidating until they click, and then they become the reason people stay.
The recurring complaints are real. Users on Reddit and the GitHub issue tracker flag breaking changes between major versions (downgrades are explicitly unsupported, so a database backup before every upgrade is mandatory), the resource footprint when you add PostgreSQL and Redis to a small VPS, and the fact that the visual editor — while powerful — surfaces “too many options” on first run. The Cerbos and Elest.io comparison posts both flag the same trade-off: more flexibility than Authelia, less enterprise polish than Zitadel, dramatically friendlier than Keycloak.
The core project is MIT-licensed and free forever — no seat caps, no feature gating on the open-source edition. Paid tiers only unlock enterprise integrations and support.
| Plan | Price | Key Limits |
|---|---|---|
| Open Source / Community | $0 | Unlimited users and applications. Community support via Discord and GitHub. MIT license. |
| Enterprise | $5 / user / month + $0.02 / external user / month | Billed annually. Adds Google Workspace + Entra ID provisioning, Device Trust, mTLS, advanced audit, ticket-based support over $1k. |
| Enterprise Plus | From $20,000 / year | Custom contracts, dedicated support and SLAs, FIPS compliance for FedRAMP, volume discounts for thousands of users. |
Best for: Self-hosters consolidating logins across a homelab; small-to-mid startups (5–500 employees) that want a single SSO surface for SaaS apps and internal tools without paying Okta’s $6–$15/user; platform teams that need an LDAP server, OIDC IdP and forward-auth proxy in the same daemon; and any organization required to keep identity data on-prem.
Not ideal for: Teams that need a managed cloud IdP with no operational burden — pick Clerk, Better Auth or Auth0 instead. Also a poor fit if your workload is purely a B2C SaaS where developer-first APIs and embeddable UI components matter more than enterprise SSO protocols.
Pros:
Cons:
Authelia is lighter and YAML-configured — better for two-user homelabs with Traefik, but no SAML or LDAP server. Keycloak is the enterprise heavyweight with deeper realm and federation features but a notoriously steep admin console. Zitadel is the cloud-native, Go-based newcomer with multi-tenant architecture and event sourcing — pick it if you’re building B2B SaaS with strict tenant isolation and don’t mind AGPL.
Yes — if you are willing to invest a weekend in the docs. authentik hits a sweet spot the rest of the open-source IdP space hasn’t: enough protocol coverage and policy expressiveness to replace Okta in a small company, but a UX modern enough that a single platform engineer can run it without becoming a full-time identity admin. Once your flows are configured the daily operational burden is minimal, and the MIT license means you can scale to thousands of users without a single invoice. 83/100 reflects that — almost a 90 if not for the upgrade fragility and the very real ramp time.
ServiceNow and Accenture Launch Forward Deployed Engineering Program to Scale Agentic AI in the Enterprise (May 6, 2026)
At Knowledge 2026, ServiceNow and Accenture announced a joint forward deployed engineering program that drops co-located engineer pods into customer environments to ship agentic AI workflows natively on the ServiceNow AI Platform — with access to 300+ pre-built agent skills and the AI Control Tower as the governance backbone.
May 7, 2026
ReFiBuy Raises $13.6M Seed to Help Brands Get Recommended by AI Shopping Agents (May 5, 2026)
ReFiBuy, the Raleigh-based agentic commerce platform from ChannelAdvisor founder Scot Wingo, closed an oversubscribed $13.6M seed led by NewRoad Capital Partners on May 5, 2026 — betting that the next billion-dollar e-commerce moat is being chosen by ChatGPT, Claude and Perplexity.
May 7, 2026
OpenAI Replaces ChatGPT's Default Model With GPT-5.5 Instant — 52.5% Fewer Hallucinations, 30% Shorter Answers (May 5, 2026)
OpenAI on May 5 swapped GPT-5.3 Instant for the new GPT-5.5 Instant as ChatGPT's default model, claiming 52.5% fewer hallucinated claims on high-stakes prompts and 30% more concise answers. The model also rolls into the API as chat-latest and adds personalization from Gmail and past chats for Plus and Pro web users.
May 7, 2026
Is this product worth it?
Built With
Compare with other tools
Open Comparison Tool →
