authentik
authentik: A broad, self-hosted identity stack for teams that need open-source control. Ranked #2 of 33 in OAuth Server Software by our editors (9.2/10); pricing: Free plan; best for feature-rich open-source identity teams.
At a glance
- Editor score9.2 / 10
- PricingFree plan
- Best forFeature-rich open-source identity teams
- Free planYes
- Paid from$5/user/mo
- Facts checked19 Sep 2026
Where it wins
- Free open-source tier covers major identity and directory protocols
- MFA, adaptive policies, provisioning, and application proxying
- Enterprise adds PAM, audit logging, and scheduled offboarding
Where it doesn't
- Deployment is self-hosted rather than hosted by the vendor
- Advanced enterprise capabilities require paid plans
- Enterprise Plus uses custom contracts and dedicated support
Our verdict on authentik
authentik is a self-hosted identity provider and single sign-on platform for site administrators, application developers, and security engineers. Its free open-source edition supports OAuth2/OpenID Connect, SAML, LDAP, SCIM, RADIUS, Kerberos, and proxy use cases. It also includes configurable authentication flows, user and group management, multi-factor authentication, policy-based access control, directory synchronization, and application integrations. Teams that want control over deployment and a broad protocol set should find the product a strong fit; organizations seeking a vendor-hosted identity service should look elsewhere.
The Free plan provides the open-source edition with support for OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos, and proxy deployments, plus community Discord support. Enterprise is listed at $5 per user per month when billed annually and adds privileged access management, Google Workspace and Microsoft Entra ID integrations, scheduled user offboarding, and enhanced audit logging. Enterprise Plus adds custom contracts, expert support, dedicated support and SLAs, multi-instance deployment support, and FIPS compliance for FedRAMP requirements. The published plans make authentik suitable for teams that want to begin with a free deployment and add governance features as their requirements grow.
Its standout strength is breadth across authentication, access policy, directory lifecycle, and remote access. MFA options include static tokens, TOTP, WebAuthn/passkeys, email, SMS, and Duo, while policies can use attributes, time, location, and request context. The platform also supports RDP, SSH, and VNC access, OAuth 2.0 token exchange, API security, and approval-based privileged access with automatic expiration. That scope will appeal to security teams consolidating identity workflows, but it also brings self-hosted deployment responsibility. Choose authentik for protocol flexibility and open-source control; choose an alternative if a hosted service or a narrower, simpler identity tool is the priority.
Your product? Our editors can test authentik in depth and publish a review, labelled as paid · from $149/mo →
authentik pricing
All 3 authentik plans and prices →
authentik fact sheet
| Free plan | Yes |
|---|---|
| Paid from | $5/user/mo |
| OpenID Connect | Not verified |
| SAML support | Not verified |
| Self-hosting | Not verified |
| Token introspection | Not verified |
| Machine-to-machine auth | Not verified |
| Deployment model | Not verified |
| Deployment | Cloud, Self-hosted |
| Platforms | Web |
| Integrations | 11 integrations: OAuth2, OpenID Connect, SAML2, LDAP, SCIM, RADIUS … |
| Pricing | Free plan (source) |
| Website | goauthentik.io |
| Facts checked | 19 Sep 2026 |
authentik integrations
authentik lists 11 integrations on its own site.
- OAuth2
- OpenID Connect
- SAML2
- LDAP
- SCIM
- RADIUS
- Kerberos
- WS-Federation
- Microsoft Entra ID
- Google Workspace
- Shared Signals Framework
Alternatives to authentik
- KeycloakA broad, self-hosted IAM server for standards-based authentication and authorization.9.4
- WSO2 Identity ServerA broad self-hosted IAM platform for enterprise OAuth, OIDC, SAML, and provisioning needs.9.1
- Apereo CASA broad, auditable SSO foundation for teams prepared to run identity infrastructure.9.0
See all authentik alternatives →
authentik vs the competition
- authentik vs Keycloak
- authentik vs WSO2 Identity Server
- authentik vs Apereo CAS
- authentik vs OpenIddict
- authentik vs Ory
- authentik vs Amazon Cognito
Compare authentik with any tool side by side →
Also Ranked In
authentik is ranked in 5 of our directories.
Used authentik? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used authentik for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
authentik is listed in our OAuth Server Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/authentik/"><img src="https://www.itechguides.com/best/badge/authentik.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update