Nacho
Authelia OpenID Connect Provider
Authelia is an open-source, OpenID Certified authentication and authorization server that acts as a companion for reverse proxies (nginx, Traefik, Caddy, Envoy, HAProxy, Skipper), providing 2FA/SSO via forward-auth, and, since Beta 8+, a self-hostable OpenID Connect 1.0 Provider for statically configured OAuth 2.0/OIDC clients.
Features
If you want to compare OpenID Connect features of different providers, please check out the OpenID Connect Providers benchmark.
Looking for Authelia’s (C)IAM features like MFA, SSO, and user management? View Authelia on the (C)IAM Identity Providers benchmark.
Frequently Asked Questions
Does Authelia support the Authorization Code grant type?
Authelia supports Authorization Code grant type. Read more
Does Authelia support the Refresh Token grant type?
Authelia supports Refresh Token grant type. Read more
Does Authelia support the Client Credentials grant type?
Authelia supports Client Credentials grant type. Read more
Does Authelia support the Implicit grant type?
Authelia partially supports Implicit grant type. OAuth 2.0 Multiple Response Types are certified (id_token, token, hybrid), but the documentation strongly recommends only the code response type, calling the others less secure. Read more
Does Authelia support the Token Exchange grant type?
Authelia does not support Token Exchange grant type. OAuth 2.0 Token Exchange is listed as unsupported in the OIDC support chart, and is on the roadmap. Read more
Does Authelia support the Client Initiated BackChannel Authentication grant type?
Authelia does not support Client Initiated BackChannel Authentication grant type. OpenID Connect CIBA Flow is listed as unsupported and not yet started on the roadmap. Read more
Does Authelia support the Device Authorization Grant grant type?
Authelia supports Device Authorization Grant grant type. OAuth 2.0 Device Authorization Flow is listed as complete, with a configurable device_code lifespan. Read more
Does Authelia support the JWT Bearer Token grant type?
Authelia does not support JWT Bearer Token grant type. Not documented as a supported authorization grant type; JWT/private_key_jwt support is limited to client authentication.
Does Authelia support the SAML 2.0 Bearer Assertion grant type?
Authelia does not support SAML 2.0 Bearer Assertion grant type. SAML 2.0 Profile for OAuth 2.0 is listed as unsupported in the OIDC support chart. Read more
Does Authelia support the Resource Owner Password Credentials grant type?
Authelia does not support Resource Owner Password Credentials grant type. Resource Owner Password Credentials grant is listed as unsupported in the OIDC support chart. Read more
Does Authelia support the PKCE extension?
Authelia supports PKCE extension. OpenID Certified for PKCE. Enforcement policy (never, public_clients_only, always) is configurable per client. Read more
Does Authelia support the PAR extension?
Authelia supports PAR extension. Pushed Authorization Requests can be required globally or per client via require_pushed_authorization_requests. Read more
Does Authelia support the RAR extension?
Authelia does not support RAR extension. OAuth 2.0 Rich Authorization Requests is listed as unsupported in the OIDC support chart. Read more
Does Authelia support the JAR extension?
Authelia supports JAR extension. OAuth 2.0 JWT-Secured Authorization Request is listed as complete in the OIDC support chart. Read more
Does Authelia support the Authorization Endpoint endpoint?
Authelia supports Authorization Endpoint endpoint. Read more
Does Authelia support the Token Endpoint endpoint?
Authelia supports Token Endpoint endpoint. Read more
Does Authelia support the UserInfo Endpoint endpoint?
Authelia supports UserInfo Endpoint endpoint. Read more
Does Authelia support the Token Revocation endpoint?
Authelia supports Token Revocation endpoint. OAuth 2.0 Token Revocation is listed as complete. Read more
Does Authelia support the Token Introspection endpoint?
Authelia supports Token Introspection endpoint. OAuth 2.0 Token Introspection and JWT Response for Token Introspection are both listed as complete, including stateless JWT access token introspection. Read more
Does Authelia support the Device Authorization Endpoint endpoint?
Authelia supports Device Authorization Endpoint endpoint. Read more
Does Authelia support the OpenID Connect Discovery Endpoint endpoint?
Authelia supports OpenID Connect Discovery Endpoint endpoint. OpenID Connect Discovery 1.0 is OpenID Certified; responses can optionally be signed. Read more
Does Authelia support the OAuth 2.0 Authorization Server Metadata Endpoint endpoint?
Authelia supports OAuth 2.0 Authorization Server Metadata Endpoint endpoint. OAuth 2.0 Authorization Server Metadata and Issuer Identification are both listed as complete. Read more
Does Authelia support the none token endpoint authentication method?
Authelia supports none token endpoint authentication method. Default for public clients. Read more
Does Authelia support the client_secret_basic token endpoint authentication method?
Authelia supports client_secret_basic token endpoint authentication method. Default for confidential clients. Read more
Does Authelia support the client_secret_post token endpoint authentication method?
Authelia supports client_secret_post token endpoint authentication method. Read more
Does Authelia support the client_secret_jwt token endpoint authentication method?
Authelia partially supports client_secret_jwt token endpoint authentication method. OAuth 2.0 JWT Profile for Client Authentication is listed as partial in the support chart. Read more
Does Authelia support the private_key_jwt token endpoint authentication method?
Authelia partially supports private_key_jwt token endpoint authentication method. OAuth 2.0 JWT Profile for Client Authentication is listed as partial in the support chart; OAuth 2.0 Private Key JWT itself is listed as complete. Read more
Does Authelia support the tls_client_auth token endpoint authentication method?
Authelia does not support tls_client_auth token endpoint authentication method. OAuth 2.0 Mutual-TLS is listed as unsupported in the OIDC support chart. Read more
Does Authelia support the none prompt?
Authelia supports none prompt. Read more
Does Authelia support the login prompt?
Authelia supports login prompt. Read more
Does Authelia support the consent prompt?
Authelia supports consent prompt. Read more
Does Authelia support the create prompt?
Authelia does not support create prompt. Authelia has no self-service user registration; OpenID Connect 1.0 User Registration is listed as unsupported. Read more
Does Authelia support the RP-initiated Logout feature?
Authelia does not support RP-initiated Logout feature. OpenID Connect RP-Initiated Logout 1.0 is listed as unsupported and is on the roadmap. Read more
Does Authelia support the Dynamic Client Registration Protocol feature?
Authelia does not support Dynamic Client Registration Protocol feature. Clients are statically defined in configuration; OAuth 2.0 and OpenID Connect Dynamic Client Registration are both listed as unsupported and are on the roadmap. Read more
Does Authelia support the Dynamic Client Registration Management Protocol feature?
Authelia does not support Dynamic Client Registration Management Protocol feature. Read more
Does Authelia support the Refresh Token Rotation feature?
Authelia supports Refresh Token Rotation feature. Read more
Does Authelia support the Refresh Token Rotation Grace Period feature?
Authelia does not support Refresh Token Rotation Grace Period feature.
Does Authelia support the OAuth 2.0 Demonstrating Proof of Possession (DPoP) feature?
Authelia does not support OAuth 2.0 Demonstrating Proof of Possession (DPoP) feature. OAuth 2.0 DPoP is listed as unsupported in the OIDC support chart. Read more
Does Authelia support the FAPI 1.0 Security Profile - Part 1: Baseline feature?
Authelia does not support FAPI 1.0 Security Profile - Part 1: Baseline feature. Not listed in the OIDC support chart; only FAPI 2.0 items (partial) are documented.
Does Authelia support the FAPI 1.0 Security Profile - Part 2: Advanced feature?
Authelia does not support FAPI 1.0 Security Profile - Part 2: Advanced feature. Not listed in the OIDC support chart; only FAPI 2.0 items (partial) are documented.
Does Authelia support the FAPI 2.0 Security Profile feature?
Authelia partially supports FAPI 2.0 Security Profile feature. Read more
Does Authelia support the FAPI 2.0 Message Signing feature?
Authelia partially supports FAPI 2.0 Message Signing feature. Read more
Does Authelia support the JARM feature?
Authelia supports JARM feature. OAuth 2.0 JWT Secured Authorization Response Mode is listed as complete. Read more
Compare with other providers
Note: The current data is based on provider documentation/experience and may not be 100% accurate. Please open an issue if you have spotted any inconsistencies.