# authentik

Source: https://startwithidentity.com/vendors/open-source/authentik/
Last updated: 2026-06-19
License: content by Start with Identity. Cite the source URL.

---

## Overview

Authentik is an open-source [identity](https://startwithidentity.com/guides/fundamentals/what-is-iam/) provider focused on being approachable to self-host while still covering enterprise protocols. It supports OIDC, SAML, LDAP, SCIM, and a forward-auth proxy, and is popular in homelab and SMB settings for its clean admin interface and flexible, flow-based authentication engine. See the [open-source IAM category](https://startwithidentity.com/vendors/open-source/).

## What it is good at

Authentication and SSO breadth with low setup friction are the strengths. Configurable login flows (stages you chain together) make complex MFA and conditional logic approachable, and the built-in proxy lets you put SSO in front of apps that have no native auth. Protocol coverage including SCIM and LDAP is good for the category, and the admin UI is friendlier than most self-hosted alternatives, which is why it is a homelab and SMB favorite.

## Where it falls short

Fine-grained authorization is basic compared with Ory Keto, the project leans on a single company so the contributor base and partner ecosystem are smaller than Keycloak's, and some enterprise features and support sit in the paid edition. Scaling and high availability are doable but require your own work. It is a strong, friendly option that is still maturing on the governance and authorization fronts.

## Pricing

Open source and free to self-host. A paid Enterprise edition adds support, RBAC enhancements, and other features. There is no hosted option: authentik's [pricing page](https://goauthentik.io/pricing/) states "We do not currently provide a hosted version of authentik." Compare with the [TCO calculator](https://startwithidentity.com/tools/tco-calculator/).

## Best for, and who should look elsewhere

Choose Authentik for an easy self-hosted SSO with a clean admin UI and flexible login flows, especially for homelabs and SMBs. For a larger enterprise ecosystem, see [Keycloak](https://startwithidentity.com/vendors/open-source/keycloak/); for modern API-first design, see [Zitadel](https://startwithidentity.com/vendors/open-source/zitadel/); for deep fine-grained authorization, see [Ory](https://startwithidentity.com/vendors/open-source/ory/).

## Bottom line

The most user-friendly self-hosted IdP for small teams and homelabs, with surprisingly broad protocol support. Look elsewhere if you need deep authorization or a big enterprise ecosystem.