authentik

authentik is an identity provider for single sign-on. It connects services via OpenID Connect, SAML, LDAP, RADIUS, SCIM and a proxy provider, among others, and manages users, groups and access flows through a web interface.

The actively maintained open-source core is self-hosted, licensed under MIT and built mainly with Python, TypeScript and PostgreSQL. Its SSO protocols work without an enterprise subscription.

Fact Sheet

Categories
Status
Actively maintained
License
  • MIT
Operation
  • On-Premises / Self-hosted
Technologies
  • Python
  • TypeScript
  • PostgreSQL
Single Sign-On (SSO)
MCP server
  • Unknown: not specified

Data last checked on October 27, 2026

Proprietary Enterprise Edition

authentik Enterprise adds privileged access management, integration with Google Workspace and Microsoft Entra ID, client certificate authentication, extended audit logs and scheduled offboarding, among other features. These additional components fall under the enterprise license. Keep the paid support offerings separate from the license rights to the MIT core.

The authentik Enterprise Edition License applies only to the enterprise components. Using them in production requires a valid enterprise subscription for the right number of user seats. Copying and modifying them for development and testing is allowed without a subscription. Beyond that, the license prohibits publishing, distributing, sublicensing and selling these components.

Open-Source Alternatives

In the Category «Identity and Access Management (IAM)»

Authelia

Authelia adds single sign-on, multi-factor authentication, and rule-based access control for web applications to reverse proxies.

  • IAM

Casdoor

Casdoor is a self-hostable IAM and SSO platform with user management, a web console, and support for numerous identity protocols.

  • IAM

Kanidm

Kanidm manages identities centrally and connects web applications, Linux systems, SSH access, and network and VPN sign-ins.

  • IAM

LLDAP

LLDAP provides a simplified LDAP directory with a web interface for users, groups, passwords and custom attributes.

  • IAM

Pocket ID

Pocket ID provides a passwordless OpenID Connect and OAuth 2.0 provider where users sign in with passkeys.

  • IAM