authentik review

authentik is a self-hosted, open-source identity provider: it sits between users and applications to manage authentication and access. Instead of depending on a third-party identity service, you run it on infrastructure you control. The project describes it as suitable for both workforce and customer identity use cases.

It supports OAuth2/OIDC, SAML2, SCIM, LDAP, RADIUS and Kerberos, alongside proxy-based access. The homepage also lists multi-factor authentication. For authentication flows, authentik offers prebuilt workflows and configurable templates, with policies and APIs for customizing or automating behavior. Deployment templates are listed for Kubernetes, Terraform and Docker Compose.

That flexibility is the point, but it also means authentik is not just a login screen you switch on. You need to deploy and maintain the identity service, then connect it to applications whose own authentication options vary. In one Reddit thread, a self-hoster said the range of integrations was useful but that the initial setup was tricky.

The strongest case is consolidating logins across a mixed self-hosted stack. authentik supports several identity protocols and can also put a proxy-based authentication layer in front of services without compatible built-in SSO, according to the project’s feature list. A commenter on r/selfhosted described that breadth as useful when applications offer different authentication methods; another said the integration guides helped with setup. The service you’re protecting still matters: not every app supports SSO, as users in the same discussion pointed out.

The price is unusually accessible for a self-hosted identity provider. The pricing page lists the Open Source plan at $0, with OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos and proxy access, plus web-based RDP/SSH access and community Discord support. It lists no paid support on that plan. Enterprise customer accounts cost $0.02 per user per month, billed annually; workforce accounts cost $5 per user per month, also billed annually. Agent and service accounts are included with Enterprise. The project’s workflows, policies, APIs and deployment templates also give teams options to adapt authentication and deployment rather than rely on a single fixed setup.

The trade-off for control is operational work. You host and maintain the identity provider yourself, and Reddit users describe a learning curve around setup and authentik’s terminology. One commenter called the first setup tricky; another said custom names such as “flow” made the learning curve steeper. A separate user reported that authentik used too much memory for their setup, but the thread gives no measurements, so that is an individual report, not a published requirement.

SSO also depends on what each application supports. Users note that some services lack compatible SSO, which can leave an extra authentication step rather than a shared login. For a small, internal-only setup, one Reddit commenter questioned the value when services were already behind a VPN.

The free plan has no paid support, according to the pricing page. Enterprise pricing is annual; monthly billing prices are not published. Workforce accounts are $5 per user per month and customer accounts are $0.02 per user per month, billed annually. Enterprise Plus starts at $20,000 annually, with dedicated support and customized SLAs. The page lists ticket support for workforce subscriptions over $1,000, not for every paid customer.

The Open Source plan is free. It includes OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos, proxy access, web-based RDP/SSH access and community Discord support, but no paid support. It is positioned for homelabs and simple use cases.

Enterprise pricing is billed annually; the pricing page does not list monthly billing prices. Workforce accounts cost $5 per user per month, billed annually. Customer accounts cost $0.02 per user per month, also billed annually. Both include Enterprise features. Agent and service accounts are included with Enterprise.

The big jump is Enterprise Plus: it starts at $20,000 annually, or $1,666.67 per month equivalent. That tier adds dedicated support, customized SLAs, volume discounts, multi-instance deployment support and FIPS compliance for FedRAMP requirements. The pricing page does not publish a monthly billing option. Budget for the self-hosting work, too: the free plan has no paid support, and the listed Enterprise support threshold is subscriptions over $1,000.

Moving to authentik means running and maintaining a self-hosted identity provider. Before switching, inventory your applications’ login protocols and authentication flows: authentik lists support for OIDC, SAML, LDAP, SCIM, RADIUS and Kerberos, plus customizable workflows and policies. The published information does not specify migration tooling, export formats or how existing users and credentials transfer, so confirm those details before planning a cutover.

Leaving may be easier for applications using standard protocols, but custom workflows and policies still need to be mapped to the replacement. The product information says authentik has APIs, but does not describe data-export options or configuration portability. That leaves practical migration questions to verify.

We can’t responsibly summarize why people leave per Reddit: no Reddit posts or comments were included in the published material. What we can say is that teams unwilling to self-host, or needing paid support on the free plan, are a poor fit based on the stated positioning and plan limits.