authentik OpenID Connect Provider
Open-source identity provider and SSO platform for self-hosting, built around configurable flows and stages. Acts as an OpenID Connect (OpenID Certified), OAuth 2.0, SAML 2.0, WS-Federation, LDAP, RADIUS and SCIM provider, and can federate from LDAP, Active Directory, Kerberos, SAML, OAuth and social sources. Policies written in Python, an application proxy and a Terraform provider cover customization and automation. The core is MIT licensed, with an Enterprise edition adding Privileged Access Management, Entra ID and Google Workspace sync, mTLS and extended audit features. There is no hosted offering.
Features
If you want to compare OpenID Connect features of different providers, please check out the OpenID Connect Providers benchmark.
Looking for authentik’s (C)IAM features like MFA, SSO, and user management? View authentik on the (C)IAM Identity Providers benchmark.
Frequently Asked Questions
Does authentik support the Authorization Code grant type?
authentik supports Authorization Code grant type. Read more
Does authentik support the Refresh Token grant type?
authentik supports Refresh Token grant type. Requires the offline_access scope and its scope mapping. Read more
Does authentik support the Client Credentials grant type?
authentik supports Client Credentials grant type. Read more
Does authentik support the Implicit grant type?
authentik supports Implicit grant type. Marked as legacy in the docs, which recommend the code flow with PKCE. Read more
Does authentik support the Token Exchange grant type?
authentik supports Token Exchange grant type. Impersonation and delegation. Delegation (on-behalf-of) needs 2026.8 or later. Read more
Does authentik support the Client Initiated BackChannel Authentication grant type?
authentik does not support Client Initiated BackChannel Authentication grant type.
Does authentik support the Device Authorization Grant grant type?
authentik supports Device Authorization Grant grant type. Read more
Does authentik support the JWT Bearer Token grant type?
authentik partially supports JWT Bearer Token grant type. JWTs issued by federated providers can authenticate through the client credentials grant, rather than the standalone JWT bearer grant. Read more
Does authentik support the Resource Owner Password Credentials grant type?
authentik partially supports Resource Owner Password Credentials grant type. Machine-to-machine clients can pass a username and app password to the client credentials grant. The standard password grant type is not documented. Read more
Does authentik support the PKCE extension?
authentik supports PKCE extension. Read more
Does authentik support the Authorization Endpoint endpoint?
authentik supports Authorization Endpoint endpoint. Read more
Does authentik support the Token Endpoint endpoint?
authentik supports Token Endpoint endpoint. Read more
Does authentik support the UserInfo Endpoint endpoint?
authentik supports UserInfo Endpoint endpoint. Read more
Does authentik support the Token Revocation endpoint?
authentik supports Token Revocation endpoint. Public and confidential clients can revoke their own tokens. Read more
Does authentik support the Token Introspection endpoint?
authentik supports Token Introspection endpoint. Confidential clients can introspect only the tokens they issued. Read more
Does authentik support the Device Authorization Endpoint endpoint?
authentik supports Device Authorization Endpoint endpoint. Read more
Does authentik support the OpenID Connect Discovery Endpoint endpoint?
authentik supports OpenID Connect Discovery Endpoint endpoint. Per-provider discovery document at /application/o/<slug>/.well-known/openid-configuration. Read more
Does authentik support the none token endpoint authentication method?
authentik supports none token endpoint authentication method. Public clients. Read more
Does authentik support the client_secret_basic token endpoint authentication method?
authentik supports client_secret_basic token endpoint authentication method. Read more
Does authentik support the client_secret_post token endpoint authentication method?
authentik supports client_secret_post token endpoint authentication method. Read more
Does authentik support the none prompt?
authentik supports none prompt.
Does authentik support the login prompt?
authentik supports login prompt.
Does authentik support the consent prompt?
authentik supports consent prompt.
Does authentik support the select_account prompt?
authentik does not support select_account prompt.
Does authentik support the create prompt?
authentik does not support create prompt.
Does authentik support the RP-initiated Logout feature?
authentik supports RP-initiated Logout feature. End-session endpoint, plus front-channel and back-channel logout. Read more
Does authentik support the Dynamic Client Registration Protocol feature?
authentik supports Dynamic Client Registration Protocol feature. Enabled through the goauthentik.io/oidc/dcr scope. Not yet covered by the OpenID certification. Read more
Does authentik support the Refresh Token Rotation feature?
authentik supports Refresh Token Rotation feature. Depends on provider configuration. Read more
Does authentik support the OAuth 2.0 Demonstrating Proof of Possession (DPoP) feature?
authentik partially supports OAuth 2.0 Demonstrating Proof of Possession (DPoP) feature. The bound_key scope binds the ID token to a client key. The access token is not sender-constrained. Read more
Compare with other providers
Note: The current data is based on provider documentation/experience and may not be 100% accurate.