Authelia review
A flexible, free MFA server for reverse-proxy-based self-hosted environments.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Authelia is an open-source authentication and authorization server for web applications running in self-hosted environments. It combines multi-factor authentication, single sign-on, and access-control policies for teams managing services behind reverse proxies. Supported factors include username and password, TOTP, FIDO2 WebAuthn security keys, passkeys, and Duo mobile push. Deployment is available through Docker, Kubernetes, or bare metal, making it suited to Linux-based infrastructure owners who want control over their authentication layer without a commercial plan.
Its strongest fit is the reverse-proxy ecosystem. Authelia integrates with Traefik, Caddy, Envoy, HAProxy, NGINX, NGINX Proxy Manager, SWAG, and Skipper through forwarded authentication, proxy authorization endpoints, or trusted headers. It can also act as an OpenID Connect 1.0 provider and connect to LDAP. Access policies can be scoped by domain, path, user, group, network, and HTTP method, giving administrators more control than a basic login gateway. Passkeys and WebAuthn also support passwordless authentication for compatible workflows.
The trade-off is operational scope. Authelia is designed to be deployed and maintained by the organization using it, so it fits best where infrastructure administration is already part of the operating model. Its authentication backends center on LDAP and YAML files, and its overall focus is web access through reverse proxies rather than a broad enterprise MFA suite. Choose Authelia for free, open-source MFA and SSO across self-hosted applications; consider another category option if you need a managed service or a wider enterprise platform.
Authelia pros and cons
- Where it wins
- Supports TOTP, WebAuthn, passkeys, and Duo mobile push
- Works with major reverse proxies, LDAP, Docker, and Kubernetes
- Provides fine-grained access policies and OpenID Connect 1.0
- Where it doesn't
- Self-hosted deployment requires infrastructure and ongoing administration
- Its focus is narrower than full enterprise MFA suites
- Authentication backends are limited to LDAP and YAML files
Authelia fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update