authentik 2026.8 landed on 18 August 2026, tagged version/2026.8.0. It is a major release rather than a patch, and with an identity provider that distinction matters: when the SSO falls over, everything behind it falls over too. Here is what changed for the free community edition, plus the two breaking changes worth reading before you pull the new image.
The certification is the real news
authentik is now OpenID Certified™ by the OpenID Foundation. The certification covers the OpenID Provider profiles (Basic, Implicit, Hybrid, Config and Form Post OP) and the logout profiles: RP-Initiated, Front-Channel and Back-Channel.
That reads like paperwork right up until the evening you spend working out why one OIDC client refuses to log out cleanly. Certification means the behaviour has been formally tested against the specification, not just against whichever applications the maintainers happened to try. Keycloak and Authelia are the usual comparison points here, and authentik now has a formal answer in that conversation.
The Rust rewrite does not make anything faster yet
Two components that were written in Go have been rewritten in Rust: the authentik server’s request entrypoint, and the proxy outpost. The Django core was left alone. Only the front door moved.
The maintainers are blunt about what this buys you today, which is nothing. The rewrite targeted a one-for-one match with the old code and ships no improvements of its own. It is groundwork for bringing the Django core and the Rust proxy closer together later. If a summary frames this as a speed boost, it is wrong. One thing did change in practice: server and worker health checks now run through the Rust entrypoint.
What community users actually get
User switching is the most visible addition. Several authentik accounts can stay signed in inside the same browser, and you swap between them from the account menu. An admin enables it by choosing a User switch flow for a brand. Because that is an ordinary authentik flow, policies can demand a password, MFA, or something lighter before the switch goes through. Successful switches are logged.
Object attributes are custom fields you define under Directory > Object attributes as text, number or boolean, with options for required, unique and regular-expression validation. They apply to users, groups, application entitlements and device access groups, and the API enforces the same rules too. Ready-made definitions for identity, contact, address, Unix and employee data ship disabled by default.
Dynamic Client Registration lets applications register themselves instead of making an admin hand-build an application and a provider for each one. Admins keep control through policy bindings and restrictions on grant types, scope mappings and token validity.
The remaining OAuth work is more specialised. Token exchange is off by default and switched on in the provider’s Grant Types. On-behalf-of delegation follows RFC 8693 and uses the act claim. OpenID key binding ties ID tokens to a key the client must prove it holds, so a stolen token is not enough on its own.
A few operational changes worth knowing:
- A Sync Group Parents option preserves nested group hierarchies coming from an LDAP source.
- Policy, group and user bindings can carry an expiry date, so temporary access cleans itself up.
- PostgreSQL connection poolers are supported in transaction mode, alongside a separate direct connection for operations that need a stable session.
- Smaller items: a compact list view on the application dashboard, Ed448 signing for OAuth/OIDC providers, SAML
ForceAuthnnow requiring fresh authentication, and deleting an authenticator stage no longer wiping enrolled devices.
Two breaking changes to handle
The hash_password management command no longer accepts the password as a positional argument. Run it bare and type the password at a masked prompt:
docker compose run --rm server hash_passwordFor scripted use, pipe the password in on standard input instead:
echo "$PASSWORD" | docker compose run --rm server hash_passwordThe WebAuthn setup stage has lost its Prevent duplicate devices option. It compared attestation certificates, which manufacturers deliberately share across entire production batches, so buying two security keys at the same time could get the second one rejected as a duplicate. It has been disabled by default since 2026.5.4, and the upgrade needs no action from you.
Base URL becomes mandatory in 2026.11
A new Base URL system setting holds your instance’s external URL. Set it under System > Settings, through the API, or with AUTHENTIK_WEB__BASE_URL at install time. Enter the scheme and host only, even when authentik is served under a subpath.
It becomes required in authentik 2026.11, and the maintainers recommend setting it now rather than mid-upgrade. Separately, AUTHENTIK_POSTGRESQL__CONN_OPTIONS and its replica equivalent are deprecated and will be removed in a future release. 2026.8 itself adds no new prerequisites, and the lifecycle tooling now blocks unsupported major-version jumps before migrations start.
Expect new task errors after the upgrade
Task status now follows what the task logged. A task that logged an error but finished anyway used to be recorded as successful, and the System Tasks page hides successful tasks by default, so the failure never surfaced. Those now appear as errors or warnings. Failures already happening in your instance may show up for the first time right after you upgrade. That is the reporting becoming honest, not a regression.
What is Enterprise only
Several of the release’s larger names are paid features, not community ones: Privileged Access Management with approver-gated application access requests that expire, Agent accounts (service accounts acting for a parent user), scheduled user offboarding, self-hosted event maps with an embedded basemap for air-gapped networks, and WS-Federation providers issuing SAML 1.1 assertions.
The full release notes are on the authentik documentation site, and the tagged build is on GitHub. Our Authentik overview covers the four-container Compose stack and how it compares with Keycloak and Authelia. The proxy outpost normally sits behind a reverse proxy such as Traefik.