Authentik

Flexible identity provider with flows suited to smaller self-hosted stacks

oss-osi-approved full guide featured

Overview

Authentik is an open-source identity provider popular in self-hosted environments. Coworking tech operators use it as a lighter-weight alternative to full enterprise IAM when exposing internal tools to staff.

At a glance

Field	Value
Categories	`identity-sso`, `security-compliance`
Deployment	`self-hosted`
License class	oss-osi-approved (`GPL-3.0-only`)
Cost model	`free-self-hosted`
Implementation difficulty	`moderate`
Maintenance burden	`medium`
Maturity	`stable`
Verification	`partially-verified` (2026-07-17)

Cost reality

Open-source software; infrastructure and maintenance are operator costs. Commercial support may be offered by the vendor.

Pricing and free-tier limits change frequently; re-check official pricing before budget decisions.

Official pricing

Tasks reduced or augmented

Software does not replace community or ops staff. It may reduce or augment:

Fronting internal apps with SSO
Reducing shared passwords for ops tools
Automating deprovisioning for departing staff

Human oversight still needed

Flow design
MFA enforcement
Application access reviews

Data held

identities
MFA factors
application access policies
logs
Personal data: yes
Payment data: no / not primary

Risks

Area	Notes
Vendor lock-in	Evaluate export formats and API completeness before deep customization.
Security	Apply updates promptly; restrict admin access; enable TLS.
Compliance	Operator remains responsible for privacy and local regulatory obligations.
Licensing	Confirm current LICENSE file for enterprise components.
Operational	Plan backups, monitoring, and a restore drill before production use.

Coworking fit

Roles: technical-operator, operations-manager

Workflows: access-provisioning, member-offboarding, compliance-review

Problems: integrate-stack, secure-door-access, self-host-for-data-control

Smallest useful experiment

Deploy Authentik with Docker Compose, protect one internal app with a proxy provider, and enroll two staff users with MFA.

Typical time to first value: 1–3 days

Implementation guide

See the human-written implementation guide.

Verification

Status: partially-verified
Last reviewed: 2026-07-17
Sources:

Seed entry compiled from official project sites and repositories. Re-verify pricing, license text, and feature claims before production decisions. Star counts and free-tier numeric limits intentionally omitted unless verified at review time.