authentik: The Open-Source Identity Provider With 24,000+ GitHub Stars That Replaces Okta and Auth0

Every developer eventually hits the same wall: you need authentication. Passwords, OAuth flows, SAML assertions, session management, multi-factor auth — the list keeps growing. And the default move? Hand it off to Auth0, Okta, or Firebase Auth and pay per monthly active user.

But what if you could self-host a battle-tested Identity Provider that speaks every protocol your apps need — and costs you nothing but server resources?

authentik is an open-source IdP that's been quietly gaining momentum on GitHub, now sitting at 24,027 stars and trending today. Built by the goauthentik team, it's designed to be "the authentication glue you need" — a tagline that's both modest and accurate.

What Exactly Is authentik?

authentik is an open-source Identity Provider that handles Single Sign-On (SSO), multi-factor authentication, user provisioning, and authorization for your applications. Think of it as a self-hosted alternative to Okta, Auth0, or Azure AD — but one you control completely.

Unlike many auth solutions that lock you into a single protocol or cloud, authentik is protocol-agnostic. It speaks:

• OAuth2 / OpenID Connect (OIDC) — for modern web and mobile apps
• SAML 2.0 — for enterprise SSO integrations
• LDAP — for legacy app compatibility
• RADIUS — for network authentication
• Proxy Provider — for apps that don't support any standard protocol

The proxy provider is particularly clever: it sits in front of any app (even one with zero auth support) and injects authentication headers. This means you can add SSO to tools like Grafana, Portainer, or Home Assistant without modifying their code.

Why 24,000+ Developers Chose authentik Over SaaS Auth

The authentication-as-a-service market is dominated by providers that charge based on Monthly Active Users (MAUs). Auth0's free tier caps at 25,000 MAUs. Okta's developer edition has similar limits. For growing applications, these costs scale fast.

authentik takes a fundamentally different approach:

1. Zero Per-User Costs

Self-hosted means your costs are tied to infrastructure, not user count. Whether you have 100 users or 100,000, the price is the same: whatever your server costs.

2. Complete Data Sovereignty

User credentials, session data, and audit logs never leave your infrastructure. For GDPR-sensitive applications or regulated industries, this is a game-changer. You're not trusting a third party with your users' passwords and MFA tokens.

3. Protocol Flexibility Without Vendor Lock-in

Need to add SAML support to your app next year? Already done. Want to migrate from OAuth to OIDC? It's a configuration change, not a migration project. authentik doesn't push you toward one protocol — it supports all of them equally.

4. Built-in Flows Engine

authentik's flows system lets you visually design authentication workflows. Need a custom enrollment flow that requires email verification + manager approval? You can build it without writing code. Need to add a consent screen between login and redirect? Drag and drop.

Getting Started: authentik in Docker Compose

Let's get authentik running locally. The Docker Compose setup takes about 5 minutes:

# docker-compose.yml
version: "3.4"

services:
  postgresql:
    image: docker.io/library/postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
      POSTGRES_USER: ${PG_USER:-authentik}
      POSTGRES_DB: ${PG_DB:-authentik}
    volumes:
      - database:/var/lib/postgresql/data

  redis:
    image: docker.io/library/redis:alpine
    command: --save 60 1 --loglevel warning
    restart: unless-stopped
    volumes:
      - redis:/data

  server:
    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server:2024.12}
    restart: unless-stopped
    command: server
    environment:
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
    volumes:
      - ./media:/media
      - ./custom-templates:/templates
    ports:
      - "9000:9000"
      - "9443:9443"

  worker:
    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server:2024.12}
    restart: unless-stopped
    command: worker
    environment:
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}

volumes:
  database:
  redis:

Generate a secret key, then launch:

# Generate secret key
echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60)" > .env
echo "PG_PASS=$(openssl rand -base64 36)" >> .env

# Start authentik
docker compose up -d

# Access at http://localhost:9000
# Complete the initial setup wizard

After the initial setup wizard (which takes about 2 minutes), you'll have a fully functional Identity Provider running locally.

Real-World Example: Adding SSO to a Node.js App

Let's wire up a real application. Here's how to add OIDC-based SSO to an Express.js app using authentik as the IdP:

// Step 1: Create an OIDC Provider in authentik UI
// Applications → Providers → Create → OpenID Connect
// Redirect URIs: http://localhost:3000/auth/callback
// Note the Client ID, Client Secret, and OpenID Configuration URL

// Step 2: Express.js app with passport-openidconnect
const express = require('express');
const passport = require('passport');
const OpenIDConnectStrategy = require('passport-openidconnect');
const session = require('express-session');

const app = express();

app.use(session({ secret: 'your-session-secret', resave: false, saveUninitialized: true }));
app.use(passport.initialize());
app.use(passport.session());

passport.serializeUser((user, done) => done(null, user));
passport.deserializeUser((user, done) => done(null, user));

passport.use('oidc', new OpenIDConnectStrategy({
  issuer: 'https://your-authentik-domain/application/o/your-app/',
  authorizationURL: 'https://your-authentik-domain/application/o/authorize/',
  tokenURL: 'https://your-authentik-domain/application/o/token/',
  userInfoURL: 'https://your-authentik-domain/application/o/userinfo/',
  clientID: process.env.AUTHENTIK_CLIENT_ID,
  clientSecret: process.env.AUTHENTIK_CLIENT_SECRET,
  callbackURL: 'http://localhost:3000/auth/callback',
  scope: 'openid profile email'
}, (issuer, profile, done) => {
  // User authenticated — profile has email, name, etc.
  console.log('Authenticated user:', profile.displayName);
  return done(null, profile);
}));

app.get('/auth/login', passport.authenticate('oidc'));

app.get('/auth/callback',
  passport.authenticate('oidc', { failureRedirect: '/login' }),
  (req, res) => res.redirect('/dashboard')
);

app.get('/dashboard', (req, res) => {
  if (!req.isAuthenticated()) return res.redirect('/auth/login');
  res.send(`Welcome, ${req.user.displayName}! You're logged in via authentik.`);
});

app.listen(3000, () => console.log('App running on port 3000'));

That's it. Your Node.js app now delegates authentication entirely to authentik. Users get a polished login page, MFA support, and session management — all without you writing auth logic.

Key Benefits at a Glance

• Self-hosted, zero per-user cost — no MAU pricing surprises as you scale
• Protocol-agnostic — SAML, OAuth2, OIDC, LDAP, RADIUS, and proxy support in one tool
• GDPR-friendly — user data stays on your infrastructure, never leaves
• Visual flows engine — design custom auth workflows without code
• Kubernetes-native — official Helm chart for production clusters
• Active community — 24K+ GitHub stars, 1.8K+ forks, regular releases
• Drop-in Okta/Auth0 replacement — migrate without rewriting your app's auth layer
• Free and open-source — MIT-licensed core with optional enterprise features

authentik vs Keycloak vs Authelia

The self-hosted IdP space has three main contenders. Here's how they compare:

authentik's sweet spot is the middle ground: more feature-rich than Authelia, lighter than Keycloak, with a modern UI and flow engine that neither competitor offers.

Frequently Asked Questions

Is authentik free to use in production?

Yes. authentik's core is open-source under a permissive license. You can self-host it in production for free. They offer an optional enterprise tier with additional features like compliance reporting and premium support, but the core IdP functionality is fully available in the free version.

Can authentik replace Okta or Auth0 for my existing apps?

Absolutely. Since authentik supports standard protocols (OIDC, SAML, OAuth2), any app that currently uses Okta or Auth0 can be reconfigured to point to authentik instead. The migration typically involves updating your app's OIDC/SAML configuration URLs — no code changes needed in most cases.

What are the minimum system requirements for authentik?

For a small deployment (up to ~1,000 users), authentik runs comfortably on 2 CPU cores and 2GB RAM. The core components are a Python server, a Go worker, PostgreSQL, and Redis. Docker Compose is recommended for small setups; Kubernetes with the official Helm chart for larger deployments.

Does authentik support multi-factor authentication (MFA)?

Yes, authentik supports TOTP (Google Authenticator compatible), WebAuthn/FIDO2 (hardware security keys and passkeys), SMS-based OTP, and email-based OTP. MFA can be required per-user, per-group, or conditionally based on login context (e.g., require MFA only from untrusted networks).

How does authentik handle user provisioning and deprovisioning?

authentik supports SCIM (System for Cross-domain Identity Management) for automated user provisioning. You can sync users from external directories (Active Directory, Google Workspace) via LDAP or SAML JIT provisioning. When a user is disabled in the source directory, authentik automatically revokes their access to all connected applications.

Is authentik suitable for large enterprises with thousands of users?

Yes. authentik is used by organizations ranging from small startups to enterprises with tens of thousands of users. The Kubernetes deployment option scales horizontally — you can run multiple server and worker replicas behind a load balancer. Their enterprise offering adds features like compliance audit logs and priority support for large-scale deployments.