Authentik

Authentik is a self-hosted identity provider that puts one login screen in front of every app on your network, speaking OAuth2/OIDC, SAML, LDAP, RADIUS, or plain forward-auth depending on what the app understands. Instead of a separate password for Nextcloud, Gitea, and your Grafana dashboard, you sign into Authentik once and it vouches for you everywhere else.

What Authentik actually does

Authentik acts as a provider for whatever protocol an app already speaks. OAuth2 and OIDC cover most modern web apps, SAML handles the older enterprise-style software that still expects it, LDAP lets legacy tools bind against it like they would against Active Directory, and RADIUS covers network gear like VPN concentrators or Wi-Fi controllers. For anything with no SSO support at all, an Authentik outpost sits in front of it as a forward-auth proxy, so even a dumb static site can end up behind a login wall.

What sets Authentik apart from a bolt-on login page is flows: every login, enrollment, password reset, and MFA prompt is a configurable sequence of stages built in the admin UI, not a fixed form. Want a captcha before the password field, or an email verification step for new users? That’s a flow edit, not a code change. MFA covers WebAuthn, passkeys, TOTP, static recovery codes, and Duo push, and policies can restrict logins by group, network, or flag one as suspicious based on distance from the last login.

Installing Authentik with Docker

Authentik isn’t a single container you point a volume at. The official Docker Compose setup runs four services: PostgreSQL for all configuration data, Redis as the cache and task broker, a server container handling the web UI and API, and a worker container running background jobs like email sending. Server and worker share the same ghcr.io/goauthentik/server image; only the command differs.

services:
  postgresql:
    image: docker.io/library/postgres:16-alpine
    restart: unless-stopped
    volumes:
      - database:/var/lib/postgresql/data
    environment:
      POSTGRES_PASSWORD: ${PG_PASS}
      POSTGRES_USER: authentik
      POSTGRES_DB: authentik
  redis:
    image: docker.io/library/redis:alpine
    command: --save 60 1 --loglevel warning
    restart: unless-stopped
    volumes:
      - redis:/data
  server:
    image: ghcr.io/goauthentik/server:2026.2.3
    restart: unless-stopped
    command: server
    environment:
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
    ports:
      - "9000:9000"
      - "9443:9443"
    depends_on:
      - postgresql
      - redis
  worker:
    image: ghcr.io/goauthentik/server:2026.2.3
    restart: unless-stopped
    command: worker
    environment:
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
    depends_on:
      - postgresql
      - redis

volumes:
  database:
  redis:

docker compose pull
docker compose up -d

Once both containers are healthy, open http://your-server-ip:9000 and you’re prompted to set a password for the default akadmin account. That’s the whole first-run flow, everything else, providers, applications, flows, gets configured from inside the admin interface afterward.

Locking down a first install

Authentik vs Keycloak vs Authelia

Keycloak is the older, Java-based identity provider Red Hat maintains: similar protocol coverage and a longer enterprise track record, but a dated admin console and its own external database to run. Authelia goes the other way, a single lightweight Go binary configured through one YAML file, built as a forward-auth companion for a reverse proxy rather than a full identity provider with its own user database.

	Authentik	Keycloak	Authelia
Protocols	OAuth2/OIDC, SAML, LDAP, RADIUS, forward-auth	OAuth2/OIDC, SAML, LDAP	Forward-auth only (OIDC provider added later, limited)
Stack	Server + worker + PostgreSQL + Redis	Java server + external database	Single binary + config file
Admin interface	Full web UI, flow builder	Web UI, dated but functional	YAML file, no built-in UI
Best fit	Full IdP replacement for a homelab or small org	Enterprise environments already in the Red Hat ecosystem	Bolting login onto apps that sit behind a reverse proxy already

• Covers OAuth2/OIDC, SAML, LDAP, and RADIUS from one deployment, no separate tool per protocol
• Flows and policies configure through the admin UI instead of restarting a service with a new config file
• MIT-licensed core with an active release cadence and a large integration library
• Outposts extend SSO to apps that were never built to support it

• Four containers and two extra data stores to back up and keep updated, versus one binary for Authelia
• Flows, providers, and outposts take real time to learn before SSO clicks into place
• Overkill if all you need is forward-auth in front of two or three internal dashboards

Authentik earns its keep once you’re juggling logins for more than three or four self-hosted apps, at which point one identity provider beats one password per service. For more homelab access and identity tooling, browse our Network & Security archive, or see how Tailscale handles network-level access instead of application-level login.

FAQ

Is Authentik really free?

Yes. The core is MIT-licensed and free for any use, self-hosting included. Authentik Security also sells a paid Enterprise tier with extra RBAC controls, FIPS-compliant crypto, and support contracts, but nothing in the free edition is crippled to push you toward it.

Do I need PostgreSQL and Redis, or can I skip them?

Both are required. PostgreSQL stores every user, application, and flow definition; Redis handles caching and passes background jobs to the worker container. There’s no SQLite or single-file mode for either one.

Can Authentik replace Active Directory?

For authentication and SSO, largely yes, its LDAP outpost lets legacy software bind against Authentik the way it would against AD. It doesn’t replace Group Policy or Windows domain administration, so a mixed environment often keeps AD for endpoint management while routing application logins through Authentik.

Is Authentik overkill for a small homelab?

For one or two apps, probably. Four containers and a flow-based config is a lot of overhead for a single Grafana dashboard. It pays off once several apps each need their own login, one account replacing five separate passwords.