authentik
A modern identity provider for SSO, MFA and access policies — self-hosted, no per-user tax.
authentik
authentik is an open-source Identity Provider built in Python and Go. It speaks SAML 2.0, OAuth 2.0, OpenID Connect, LDAP, SCIM and RADIUS, supports passwordless and WebAuthn flows, and ships a flexible flow builder you can use to encode any onboarding, MFA or risk policy you need.
Identity is the most expensive recurring line in the SaaS stack — Okta and Entra ID charge per user, per feature, per environment. authentik gives you the same building blocks (SSO, MFA, conditional access, user lifecycle, OIDC for your own apps) on infrastructure you own, with all enterprise features open-source and free to use.
Capabilities
Every protocol that matters
SAML 2.0, OAuth 2.0, OIDC, LDAP, SCIM, RADIUS and proxy-based SSO for legacy apps — one IdP fronting your whole estate.
Flow-based policy engine
Compose login, enrollment, password-reset and MFA flows visually. Add conditions like "geo not in DE/AT/CH → require WebAuthn" without writing code.
Passwordless and WebAuthn
Hardware keys, platform authenticators and passkeys are first-class — drop passwords entirely for the workforce that's ready.
Brokered and federated logins
Let users sign in via Google, Microsoft, GitHub or any OIDC/SAML upstream while you stay the source of truth for roles and access.
Why this beats the proprietary default
The same advantages apply across every product on this page — open source is a category-level upgrade, not a niche preference.
Auditable source code
Anyone can read, review and audit the code. Security researchers, your own engineers, or an independent auditor — no black boxes, no "trust us".
Your data, your infrastructure
Runs on hardware you control, in a jurisdiction you choose. No silent data exports to a US hyperscaler, no "product improvement" sampling of your content.
Predictable cost, no per-seat tax
Pay for hosting and operations, not for every user, mailbox or feature flag. Adding the tenth or hundredth user doesn't multiply your bill.
Exit is built in
Open standards, open formats, no vendor lock-in. If you ever want to move — to another host, another team, in-house — the data and the software are yours to take.
Want to run authentik on your terms?
We host, monitor, patch and back up the whole stack on European infrastructure — so you get the open-source upside without the operations cost.