Stars
Forks
Watchers
Developer links
Authentik
With over 24,000 GitHub stars and a rapidly growing community of self-hosters, authentik delivers enterprise-grade identity management that replaces commercial solutions like Okta and Auth0 with a fully self-hosted platform requiring no per-user licensing fees. The platform serves as a unified identity provider supporting SAML 2.0, OAuth 2.0 and OpenID Connect, LDAP for legacy application compatibility, SCIM 2.0 for automated user provisioning, and RADIUS for network device authentication. The visual flow designer enables administrators to create custom authentication workflows combining password verification, multi-factor authentication with TOTP, WebAuthn, and SMS codes, email verification, captcha challenges, and conditional logic based on user attributes or device context. The forward-auth and reverse proxy integration works seamlessly with Traefik, Nginx, Caddy, and Envoy to protect applications that lack built-in authentication. User enrollment flows support self-registration with configurable approval workflows, invitation links, and automatic group assignment. The LDAP outpost exposes user and group data to legacy applications requiring LDAP bind authentication, while the SCIM provider automates user lifecycle management with downstream applications. Multi-tenancy support through brands allows a single authentik instance to serve multiple organizations with independent domains, branding, and authentication policies. The admin interface provides comprehensive user management, group hierarchy, application catalog, event logging with GeoIP enrichment, and system health monitoring. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Licensed under a source-available license with an open-source community edition.
Benefits
- Unified Identity Provider Platform
- Centralize authentication across your entire application stack with SAML, OAuth2, OpenID Connect, LDAP, SCIM, and RADIUS support from a single platform, eliminating scattered credential management and inconsistent access policies.
- Visual Authentication Flow Designer
- Build custom login workflows combining passwords, MFA with TOTP and WebAuthn, email verification, captchas, and conditional logic through an intuitive drag-and-drop flow editor without writing authentication code.
- Reverse Proxy Forward Authentication
- Protect any web application with SSO by adding forward-auth headers through Traefik, Nginx, Caddy, or Envoy integration, enabling authentication for applications that lack built-in identity provider support.
- Zero Per-User Licensing Costs
- Replace Okta and Auth0 per-user pricing with a self-hosted platform supporting unlimited users, unlimited applications, and all authentication protocols without feature restrictions or usage-based billing.
Features
- Multi-Protocol SSO Support
- SAML 2.0, OAuth 2.0, OpenID Connect, LDAP, SCIM 2.0, and RADIUS protocols provide compatibility with virtually any application or service requiring authentication.
- Multi-Factor Authentication
- TOTP authenticator apps, WebAuthn hardware keys, SMS verification codes, and email confirmation provide layered security with configurable enforcement policies.
- LDAP Outpost Integration
- Expose user directory and group membership via LDAP protocol for legacy applications requiring traditional directory service bind authentication and search operations.
- Custom Enrollment Workflows
- Self-registration with configurable approval workflows, invitation links, automatic group assignment, and conditional access policies based on user attributes.
- Event Logging with GeoIP
- Comprehensive authentication event audit trail with GeoIP location enrichment, user agent parsing, and configurable alerting for suspicious login patterns.