Authentik

authentik is a self-hosted application that you deploy with the official Docker Compose setup or on Kubernetes via the published Helm chart. The server runs as a Python/Django backend plus a Go-based proxy outpost, and can be installed on any modern Linux host. The admin, user, and flow interfaces are web-based and work in any modern browser.

authentik acts as a provider for OAuth2, OpenID Connect (OIDC), SAML 2.0, LDAP, SCIM, and RADIUS through lightweight proxy outposts. The same instance can serve any combination of these, so you can use OIDC for one application, SAML for another, and SCIM for provisioning, without standing up separate systems.

Out of the box, authentik supports username and password, TOTP authenticator codes, WebAuthn passkeys and security keys, push notifications through the authentik mobile app, magic links, and recovery codes. Admins assemble these into login flows using stages and policies, and can add social login sources such as GitHub, Google, or generic OIDC/SAML providers.

Yes. In addition to the MIT-licensed open source project, Authentik Security Inc. sells a source-available Enterprise edition with extra features, support SLAs, and a support center. The core platform, including all the providers and outposts, is identical between the two editions.

authentik provides a REST API for users, groups, applications, sources, and every other resource, with API tokens that can be scoped and rotated from the admin interface. It also supports Blueprints, which are declarative YAML files you can apply to provision or replicate entire setups, and it ships webhooks for outbound notifications.