authentik IAM Provider
Open-source identity provider and SSO platform for self-hosting, built around configurable flows and stages. Acts as an OpenID Connect (OpenID Certified), OAuth 2.0, SAML 2.0, WS-Federation, LDAP, RADIUS and SCIM provider, and can federate from LDAP, Active Directory, Kerberos, SAML, OAuth and social sources. Policies written in Python, an application proxy and a Terraform provider cover customization and automation. The core is MIT licensed, with an Enterprise edition adding Privileged Access Management, Entra ID and Google Workspace sync, mTLS and extended audit features. There is no hosted offering.
Features
- DockerKubernetesAWS
If you want to compare IAM features of different providers, please check out the (C)IAM Identity Providers benchmark.
Looking for authentik’s OpenID Connect protocol compatibility? View authentik on the OpenID Connect Providers benchmark.
Frequently Asked Questions
Does authentik support Username and Password authentication method?
authentik supports Username and Password authentication method. Identification and Password stages in the default authentication flow. Read more
Does authentik support Social Sign-in authentication method?
authentik supports Social Sign-in authentication method. Social login sources such as Apple, Discord, GitHub, Twitch and X, plus generic OAuth and SAML sources. Read more
Does authentik support Passkey authentication method?
authentik supports Passkey authentication method. WebAuthn / FIDO2 authenticator stage supports passkeys and security keys, and a passwordless flow can be built on it. Read more
Does authentik support Magic Link authentication method?
authentik partially supports Magic Link authentication method. The Email stage sends a one-time link, used out of the box for account recovery and enrollment. A login flow built on it needs custom flow configuration. Read more
Does authentik support Anonymous / Guest authentication method?
authentik does not support Anonymous / Guest authentication method. Every session belongs to an authenticated user. There is no anonymous or guest login.
Does authentik support Time-based One-Time Password (TOTP) MFA?
authentik supports Time-based One-Time Password (TOTP) MFA. TOTP authenticator setup stage. Read more
Does authentik support HMAC-based One-Time Password (HOTP) MFA?
authentik does not support HMAC-based One-Time Password (HOTP) MFA. Only time-based TOTP is offered. Static recovery codes are the only other OTP type.
Does authentik support Universal 2nd Factor (U2F) MFA?
authentik supports Universal 2nd Factor (U2F) MFA. Security keys through the WebAuthn authenticator stage. Read more
Does authentik support WebAuthn MFA?
authentik supports WebAuthn MFA. WebAuthn / FIDO2 authenticators (security keys and passkeys) as a second factor. Read more
Does authentik support Email Code MFA?
authentik supports Email Code MFA. Email authenticator setup stage. Read more
Does authentik support Phone Code MFA?
authentik supports Phone Code MFA. SMS authenticator setup stage, with Twilio or a generic HTTP gateway. Read more
Does authentik support Recovery Code MFA?
authentik supports Recovery Code MFA. Static authenticator stage generates single-use recovery tokens. Read more
Does authentik support Push Notification MFA?
authentik partially supports Push Notification MFA. Push approval is available only through the Duo authenticator stage. There is no native authentik push app. Read more
Does authentik support Adaptive / Risk-Based MFA MFA?
authentik partially supports Adaptive / Risk-Based MFA MFA. Policies on GeoIP, ASN, network and reputation can decide whether the authenticator validation stage prompts for MFA. There is no built-in risk scoring engine. Read more
Does authentik support Cisco Duo MFA?
authentik supports Cisco Duo MFA. Duo authenticator setup stage. Read more
Does authentik support Step-Up Authentication MFA?
authentik partially supports Step-Up Authentication MFA. Flows and stage bindings can be attached to individual applications, and the validation stage supports a last-validation threshold to force re-authentication. There is no ACR-based step-up. Read more
Does authentik support OpenID Connect (OIDC) integration protocol?
authentik supports OpenID Connect (OIDC) integration protocol. OAuth2 / OpenID Connect provider. OpenID Certified as of 2026.8. Read more
Does authentik support SAML 2.0 integration protocol?
authentik supports SAML 2.0 integration protocol. SAML 2.0 identity provider. Read more
Does authentik support WS-Federation integration protocol?
authentik supports WS-Federation integration protocol. WS-Federation provider. Read more
Does authentik support Machine-to-Machine (M2M) Authentication integration protocol?
authentik supports Machine-to-Machine (M2M) Authentication integration protocol. Client credentials grant for service accounts and federated JWT authentication. Read more
Does authentik support OpenID Connect (OIDC) Federation identity federation?
authentik supports OpenID Connect (OIDC) Federation identity federation. OAuth / OpenID Connect sources let users sign in with an external identity provider. Read more
Does authentik support SAML 2.0 Federation identity federation?
authentik supports SAML 2.0 Federation identity federation. SAML source for federating with an external SAML identity provider. Read more
Does authentik support Active Directory / LDAP identity federation?
authentik supports Active Directory / LDAP identity federation. LDAP source with Active Directory and FreeIPA synchronization, and an LDAP provider to expose authentik as a directory. Read more
Does authentik support Azure Active Directory (Entra ID) identity federation?
authentik supports Azure Active Directory (Entra ID) identity federation. Sign in with Entra ID through an OAuth source (open source). The Entra ID provider for outbound sync is Enterprise only. Read more
Does authentik support Bulk User Import user management?
authentik partially supports Bulk User Import user management. No CSV import in the UI. Users can be created through the REST API and blueprints, or synced from LDAP and SCIM sources. Read more
Does authentik support Bulk User Export user management?
authentik partially supports Bulk User Export user management. Users can be listed and exported through the REST API. There is no one-click user export in the UI. Read more
Does authentik support Bulk User Update / Delete user management?
authentik partially supports Bulk User Update / Delete user management. Bulk deletion is available in the admin UI. Bulk updates go through the REST API or blueprints.
Does authentik support Upsert on Import user management?
authentik partially supports Upsert on Import user management. Blueprints are declarative and idempotent, so re-applying them updates existing objects. Read more
Does authentik support Inbound SCIM Provisioning user management?
authentik supports Inbound SCIM Provisioning user management. SCIM source lets an external system provision users and groups into authentik. Read more
Does authentik support Outbound SCIM Provisioning user management?
authentik supports Outbound SCIM Provisioning user management. SCIM provider pushes users and groups to downstream applications. Read more
Does authentik support SCIM Groups Provisioning user management?
authentik supports SCIM Groups Provisioning user management. Groups are synchronized in both the SCIM source and the SCIM provider. Read more
Does authentik support Just-In-Time (JIT) User Provisioning user management?
authentik supports Just-In-Time (JIT) User Provisioning user management. Sources create users on first login through an enrollment flow, with property mappings applied to the new user. Read more
Does authentik support Self-Service Profile Management Portal user management?
authentik supports Self-Service Profile Management Portal user management. User interface where users edit their profile, manage MFA devices and change their password, driven by a configurable user settings flow. Read more
Does authentik support User Account Linking user management?
authentik supports User Account Linking user management. Sources can link an external identity to an existing user by identifier, email or username. Read more
Does authentik support User Blocking / Banning user management?
authentik supports User Blocking / Banning user management. Users can be deactivated, which blocks login and revokes sessions. Read more
Does authentik support User Metadata user management?
authentik supports User Metadata user management. Free-form JSON attributes on users, groups and other objects. Read more
Does authentik support Application Metadata user management?
authentik partially supports Application Metadata user management. Attributes can be set on groups and applications, but there is no separate application-metadata store per user.
Does authentik support User Search user management?
authentik supports User Search user management. Searchable user list in the admin interface and the REST API. Read more
Does authentik support Role-Based Access Control (RBAC) user management?
authentik supports Role-Based Access Control (RBAC) user management. Roles assigned to groups, with global and object-level permissions. Read more
Does authentik support Organizations (Multi-Tenancy B2B) user management?
authentik partially supports Organizations (Multi-Tenancy B2B) user management. Brands give per-domain branding and flow selection inside one instance. Hard tenant isolation needs separate instances, with multi-instance support in Enterprise Plus. Read more
Does authentik support Password Strength Policies user management?
authentik supports Password Strength Policies user management. Password policy supporting length, character classes, HaveIBeenPwned and zxcvbn checks. Password history checks are Enterprise. Read more
Does authentik support Username Restrictions user management?
authentik partially supports Username Restrictions user management. Prompt-stage field validation and expression policies can enforce username rules. There is no dedicated setting.
Does authentik support Progressive Profiling / Forms user management?
authentik partially supports Progressive Profiling / Forms user management. Prompt stages with policy bindings can collect extra attributes on later logins. Read more
Does authentik support Attribute-Based Access Control (ABAC) access control?
authentik partially supports Attribute-Based Access Control (ABAC) access control. Expression policies written in Python can evaluate user, group, request and context attributes to allow or deny access. Read more
Does authentik support Fine-Grained Authorization (FGA / ReBAC) access control?
authentik does not support Fine-Grained Authorization (FGA / ReBAC) access control. No relationship-based or fine-grained authorization engine.
Does authentik support API Authorization (Scopes / Permissions) access control?
authentik partially supports API Authorization (Scopes / Permissions) access control. Scope mappings add scopes and claims to tokens. There is no resource-server permission model. Read more
Does authentik support Audit Log Retention security feature?
authentik supports Audit Log Retention security feature. Events are stored for 365 days by default, with configurable retention. Read more
Does authentik support Audit Log Streaming security feature?
authentik supports Audit Log Streaming security feature. Events can go to webhook and email notification transports, or be forwarded from container logs. Read more
Does authentik support Security Center (Threat Monitoring Dashboard) security feature?
authentik partially supports Security Center (Threat Monitoring Dashboard) security feature. Admin overview dashboard and event log. The login event map is Enterprise only. Read more
Does authentik support Encryption in Transit security feature?
authentik supports Encryption in Transit security feature. The server serves HTTPS directly, or sits behind a TLS-terminating reverse proxy. Read more
Does authentik support Bot Detection security feature?
authentik supports Bot Detection security feature. Captcha stage supports reCAPTCHA, hCaptcha, Cloudflare Turnstile and others. Read more
Does authentik support Brute Force Protection security feature?
authentik supports Brute Force Protection security feature. Reputation policy scores IPs and usernames from failed logins and blocks access below a threshold. Read more
Does authentik support Suspicious IP Throttling security feature?
authentik supports Suspicious IP Throttling security feature. Reputation policy tracks per-IP scores. Network and GeoIP policies can also deny by address or location. Read more
Does authentik support Breached Password Detection security feature?
authentik supports Breached Password Detection security feature. Password policy can check passwords against HaveIBeenPwned. Read more
Does authentik support Credential Guard (Dark Web Monitoring) security feature?
authentik does not support Credential Guard (Dark Web Monitoring) security feature.
Does authentik support Tenant Access Control List (IP ACL) security feature?
authentik partially supports Tenant Access Control List (IP ACL) security feature. Network-binding policies restrict access by IP or CIDR per flow, application or source. Read more
Does authentik support Device Fingerprinting security feature?
authentik partially supports Device Fingerprinting security feature. Chrome Enterprise Device Trust connector and endpoint stages check device posture (Enterprise). Read more
Does authentik support Per-Organization Branding multi-tenancy?
authentik supports Per-Organization Branding multi-tenancy. Brands apply logo, title, CSS and default flows per domain. Read more
Does authentik support Per-Organization MFA Policy multi-tenancy?
authentik partially supports Per-Organization MFA Policy multi-tenancy. A brand or application can use its own flow, and so its own MFA stages.
Does authentik support Hosted / Universal Login Page branding feature?
authentik supports Hosted / Universal Login Page branding feature. Flow-driven login pages hosted by authentik. Read more
Does authentik support Embedded / Native Login Components branding feature?
authentik partially supports Embedded / Native Login Components branding feature. The flow executor API lets a client render its own login UI, but there are no packaged embeddable components. Read more
Does authentik support White-Label / Full Brand Removal branding feature?
authentik supports White-Label / Full Brand Removal branding feature. Branding, custom CSS and templates are available in the open source edition. Read more
Does authentik support Localization / i18n branding feature?
authentik supports Localization / i18n branding feature. Interface and flows are translated, and prompt fields can be localized.
Does authentik support Prebuilt UI Components (SDK) branding feature?
authentik does not support Prebuilt UI Components (SDK) branding feature.
Does authentik support Login / Auth Analytics Dashboard analytics?
authentik partially supports Login / Auth Analytics Dashboard analytics. Admin overview charts for logins, failed logins and authorizations. CSV reports and the event map are Enterprise. Read more
Does authentik support FedRAMP Authorization compliance?
authentik partially supports FedRAMP Authorization compliance. FIPS-compliant build offered to help meet FedRAMP requirements. authentik is not itself FedRAMP authorized. Read more
Does authentik support GDPR: Right to be Forgotten (User Deletion) compliance?
authentik supports GDPR: Right to be Forgotten (User Deletion) compliance. Users can be deleted from the admin UI, the API, or a User delete stage. Read more
Does authentik support Consent Management compliance?
authentik supports Consent Management compliance. Consent stage asks users to approve scopes, with configurable expiry per application. Read more
Does authentik support Region Deployment compliance?
authentik does not support Region Deployment compliance. authentik has no hosted offering. You choose the region by choosing where to deploy it.
Does authentik support Private Cloud Deployment compliance?
authentik supports Private Cloud Deployment compliance. Self-hosted with Docker Compose, Kubernetes (Helm), or an AWS CloudFormation template. Read more
Does authentik support SDK Coverage developer integration?
authentik partially supports SDK Coverage developer integration. Generated API clients for Go, Python, TypeScript and Rust. Applications integrate through standard OIDC and SAML libraries. Read more
Does authentik support Management API developer integration?
authentik supports Management API developer integration. REST API with an OpenAPI schema covering everything the admin UI does. Read more
Does authentik support Actions / Extensibility Pipeline developer integration?
authentik supports Actions / Extensibility Pipeline developer integration. Python expression policies and property mappings run inside flows and token issuance. Read more
Does authentik support TypeScript Support in Extensibility developer integration?
authentik does not support TypeScript Support in Extensibility developer integration. Extensions are written in Python.
Does authentik support Custom Domain developer integration?
authentik supports Custom Domain developer integration. Any domain can be bound to a brand. Read more
Does authentik support Deploy CLI (Infrastructure as Code) developer integration?
authentik partially supports Deploy CLI (Infrastructure as Code) developer integration. Blueprints describe configuration as YAML applied on startup or from a repository. There is no dedicated deploy CLI. Read more
Does authentik support Terraform Provider developer integration?
authentik supports Terraform Provider developer integration. Official Terraform provider maintained by authentik. Read more
Does authentik support Custom Database Connections developer integration?
authentik partially supports Custom Database Connections developer integration. LDAP and SCIM sources can bring in users from an external directory. There is no custom database script connection. Read more
Does authentik support Native Webhook Support developer integration?
authentik supports Native Webhook Support developer integration. Webhook notification transport sends events to any HTTP endpoint. Read more
Does authentik support Universal Login / Hosted Login Page Customization developer integration?
authentik supports Universal Login / Hosted Login Page Customization developer integration. Flows, stages, policies, CSS and templates control the full login experience. Read more
Does authentik support Custom Email Provider (SMTP) developer integration?
authentik supports Custom Email Provider (SMTP) developer integration. Any SMTP server, set through environment variables. Read more
Does authentik support Email Templates developer integration?
authentik supports Email Templates developer integration. Customizable HTML email templates for the Email stage and notifications. Read more
Does authentik support Custom OIDC Claims / Token Enrichment developer integration?
authentik supports Custom OIDC Claims / Token Enrichment developer integration. Scope property mappings in Python add claims to ID tokens and userinfo. Read more
Does authentik support No-Code Auth Flow Builder / Orchestration feature?
authentik supports No-Code Auth Flow Builder / Orchestration feature. Flows chain stages with policy bindings to build login, enrollment, recovery and logout journeys, with a flow inspector for debugging. Read more
Does authentik support Identity Verification / Document Proofing feature?
authentik does not support Identity Verification / Document Proofing feature.
Does authentik support Decentralized / Verifiable Credentials feature?
authentik does not support Decentralized / Verifiable Credentials feature.
Does authentik support Built-in Billing / Subscription Management feature?
authentik does not support Built-in Billing / Subscription Management feature.
Does authentik support Agentic AI / MCP Server Authentication feature?
authentik partially supports Agentic AI / MCP Server Authentication feature. Agent accounts for non-human identity are an Enterprise feature. Token exchange and dynamic client registration work with MCP-style clients. Read more
Compare with other providers
Note: The current data is based on provider documentation/experience and may not be 100% accurate.