Authelia vs Authentik
Authelia and Authentik compared for self-hosted SSO: forward auth vs a full identity provider, OIDC/SAML/LDAP support, user stores, MFA, resource needs and Enterprise pricing as of October 2026.
Quick Answer
Authelia is a lightweight 2FA and SSO companion for your reverse proxy: a small Apache-2.0 service configured in YAML, with users in a file or LDAP and an OpenID Certified (still beta-labelled) OIDC provider. Authentik is a full identity provider with its own user directory, admin UI, enrollment flows and SAML, LDAP, SCIM and RADIUS support, at the cost of a PostgreSQL-backed stack that needs 2 CPU cores and 2 GB RAM. Pick Authelia to put a login wall in front of apps cheaply; pick Authentik when apps need SAML or LDAP or users must sign themselves up.
Last updated October 29, 2026. Covers Authelia v4.39.28 (17 Sep 2026) and Authentik 2026.8.5 (21 Oct 2026), with Authentik's current Enterprise pricing and both projects' architecture, protocol and MFA docs, as of 29 Oct 2026.
| Feature | Authelia | Authentik |
|---|---|---|
| Licence | Apache-2.0 | MIT core; Enterprise code under a separate licence |
| Price | Free | Free; Enterprise $5/user/month (annual) |
| How It Protects Apps | Forward-auth companion to your reverse proxy, plus OIDC provider | Full IdP: native protocols, plus proxy / forward-auth outposts |
| SSO Protocols Served | OpenID Connect 1.0 / OAuth 2.0 (OpenID Certified, labelled beta); no SAML or LDAP server | OIDC/OAuth2, SAML, LDAP, SCIM, RADIUS, Kerberos, WS-Fed, proxy |
| User Store | YAML file or external LDAP / Active Directory | Built-in user directory (PostgreSQL) |
| Self-Service Sign-up | No (can only link to an external sign-up service) | Yes, enrollment flows (optional email verification) |
| MFA Methods | TOTP, WebAuthn security keys, Duo push | TOTP, WebAuthn, Duo, email, SMS, static recovery codes |
| Passwordless Passkeys | Yes, since v4.39.0 | Yes (WebAuthn / FIDO2 / Passkeys stage) |
| Storage Backend | SQLite, MySQL or PostgreSQL; Redis for HA sessions | PostgreSQL only |
| Footprint / Minimum Resources | Static binary; ~28 MB compressed amd64 image | Server + worker + PostgreSQL; min 2 CPU cores, 2 GB RAM |
| Admin Web UI | None; YAML config (admin dashboard on roadmap) | Yes, full admin interface |
| Reverse Proxy Integration | Traefik, Caddy, Envoy, NGINX, NPM, SWAG, HAProxy, Skipper | Any proxy via forward auth, or its own outpost proxies traffic |
| Latest Release (Oct 2026) | v4.39.28 (17 Sep 2026) | 2026.8.5 (21 Oct 2026) |
Authelia
Open-source 2FA and single sign-on server that sits beside your reverse proxy, answering forward-auth checks and acting as an OpenID Connect 1.0 provider.
Pros
- Small footprint: a static binary or a roughly 28 MB (compressed amd64) container image, and the 'Lite' setup needs only a YAML user file and SQLite
- Works with the proxy you already run, with official guides for Traefik, Caddy, Envoy, NGINX, Nginx Proxy Manager, SWAG, HAProxy and Skipper
- OpenID Certified OIDC provider, so OIDC-capable apps can log in through it instead of only being gated by proxy headers
- Fine-grained access rules by subdomain, user, group, request URI, HTTP method and network, with one-factor or two-factor per rule
- Passkeys, WebAuthn security keys, TOTP and Duo push, plus regulation that bans accounts after too many failed attempts
- Apache-2.0 licensed, with every feature in the one free build
Cons
- No SAML provider, LDAP server, SCIM or RADIUS; a SAML 2.0 provider is still on the roadmap's planning list
- No internal user database or registration: users live in a YAML file or an LDAP/Active Directory you run separately
- No admin web UI; everything is YAML configuration (an administrator dashboard is a roadmap item)
- The project still labels OIDC as beta and warns that occasional breaking changes are possible
- HTTPS-only by design, and high availability needs Redis plus an external MySQL or PostgreSQL database
Best For
Homelabs and small teams already running Traefik, Caddy or NGINX who want a lightweight 2FA login wall in front of their apps, plus OIDC for apps that support it.
Authentik
Open-source identity provider with its own user directory, visual flows and providers for OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos and proxy-based forward auth.
Pros
- Covers almost every protocol an app might need: OIDC/OAuth2, SAML, LDAP, SCIM, RADIUS, Kerberos, WS-Fed and a proxy provider
- Built-in user directory with enrollment (self sign-up) and recovery flows assembled from stages and policies
- Full admin web interface, so routine changes need no config-file edits
- MFA covers TOTP, WebAuthn/passkeys, Duo, email, SMS and static recovery codes, and stages can be bound per user or group
- Free open-source edition, and the vendor commits to never moving open-source features into Enterprise
- Web-based RDP/SSH access (Remote Access Control) is included in the free edition
Cons
- Heavier stack: server, worker and PostgreSQL containers, with a stated minimum of 2 CPU cores and 2 GB RAM
- Flows, stages, bindings and policies take real time to learn compared with one YAML file
- The default Compose file mounts the Docker socket into the worker for outpost management, a risk you may want to proxy or remove
- No hosted version, and paid support only comes with an Enterprise subscription
- Enterprise features such as Entra ID and Google Workspace integration or mTLS cost $5 per internal user per month, billed annually
Best For
Setups that need a real identity provider: SAML or LDAP for older apps, user self sign-up, a web admin UI, or a path to enterprise features and vendor support.
Forward-auth companion vs full identity provider
The two projects start from different ideas. Authelia's own docs describe it as a companion to reverse proxies: every incoming request triggers an authentication check against Authelia, which tells the proxy to let the request through, block it, or redirect the user to Authelia's login portal. Authelia never sits in the data path to your application, so the payload of a protected REST or GraphQL API never reaches it, only headers such as Authorization. It also refuses to run over plain HTTP, because the session cookie is only sent over secure connections. Authentik is an identity provider first. Applications are paired with providers (OIDC/OAuth2, SAML, LDAP, SCIM, RADIUS, WS-Fed and others), and a proxy provider exists for apps with no native auth. That proxy provider has three modes: its outpost proxies traffic itself, your existing reverse proxy forwards auth checks for one application, or one provider protects every app under a parent domain. The last mode is the closest match to Authelia's model, but the docs note it cannot apply per-application authorization rules. In practice: if your mental model is 'my proxy plus a login page', Authelia fits; if it is 'a central directory that apps log into', Authentik does.
Protocols: where Authelia stops
Protocol coverage is the most common reason people move from Authelia to Authentik. Authelia is OpenID Certified for the Basic, Implicit, Hybrid, Form Post and Config OP profiles, so any app with OIDC login can use it as a provider. The project still calls OIDC a beta feature, enabled only when you configure the provider and register clients, and warns that occasional breaking changes may happen as it implements the specs. Beyond OIDC there is nothing to serve: no SAML 2.0 provider (it is listed under planning on the roadmap), no LDAP server for apps that only speak LDAP, no SCIM provisioning and no RADIUS. Authelia consumes LDAP as a user backend but does not expose one. Authentik's free edition lists OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos and proxy support, and is also OpenID Certified. Its docs add WS-Fed, Shared Signals Framework and single logout across OIDC and SAML, plus Entra ID and Google Workspace providers that its pricing page places in Enterprise. If you run anything that predates OIDC, such as a NAS, VPN, wiki or older enterprise app that only takes SAML or LDAP, Authentik covers it and Authelia does not.
Users, sign-up and day-to-day administration
Authelia has two user backends: a YAML file holding users and hashed passwords, or an LDAP directory such as OpenLDAP, FreeIPA or Active Directory. Its first-factor docs state plainly that Authelia has no internal registration; the registration option only shows a link to a sign-up service you run elsewhere, and accounts must already exist in the backend. Users can reset passwords with email identity verification and enrol second factors themselves, but adding a user means editing the file or the directory. There is no admin web UI; an administrator dashboard and CLI are roadmap items. Authentik keeps users in its own PostgreSQL-backed directory and gives you a full admin interface. Behaviour is built from flows made of stages, with policies and user or group bindings deciding which stages run. Example blueprints include two-stage enrollment, enrollment with email verification and recovery with email plus MFA. The authenticator validation stage accepts Duo, email, SMS, static recovery codes, TOTP and WebAuthn/passkeys, and can force enrolment when a user has none. The trade-off is learning curve. Authelia's YAML is quick for one admin who likes config as code; Authentik's flow editor is more powerful but takes longer to understand.
Resources, storage and high availability
Authelia is the lighter service. It ships as a static binary, Debian package or container, and the 4.39.28 image on Docker Hub is roughly 28 MB compressed for amd64. The documented 'Lite' Compose bundle runs with a file user store and SQLite, which the README says is fine for internet-facing use but will not scale well. Storage can be SQLite, MySQL or PostgreSQL, and holds preferences, second-factor devices and authentication logs, with sensitive columns encrypted by a key you supply. Sessions are kept in memory by default; the docs recommend Redis for production and require it for highly available setups, alongside a remote SQL database. Authentik's architecture has a server container (core plus an embedded outpost), a worker container for background tasks such as email and notifications, and PostgreSQL for all configuration and data. The Docker Compose guide asks for at least 2 CPU cores and 2 GB RAM and describes Compose as suitable for test and small-scale production setups; a Helm chart exists for Kubernetes. The default Compose file also mounts the Docker socket into the worker so it can manage outposts; the docs suggest a socket proxy or manual outposts if that worries you. On a small VPS that is already busy, the difference is noticeable.
Cost: free software vs an Enterprise tier
Authelia is Apache-2.0 and has no paid edition on the pages we read; the project currently asks for donations toward a security audit. Support comes from GitHub, Matrix and Discord. Authentik's open-source edition is free and covers OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos, proxy, web-based RDP/SSH and OpenID certification, with community Discord and no support. Enterprise costs $5 per user per month plus $0.02 per external user per month, billed annually, with no charge for service accounts. It adds features such as privileged access management, Google Workspace and Entra ID integration, mTLS client certificates, Chrome Enterprise device trust, enhanced audit logging and scheduled offboarding, with ticket support for subscriptions over $1k. Enterprise Plus starts at $20k a year for invoicing, SLAs, multi-instance deployments and FIPS. Licences are validated locally, so Enterprise also works air-gapped, and it uses the same container images as the open-source build. For a 25-person internal team, Enterprise would be about $1,500 a year. Authentik also states it will never move open-source features into Enterprise, which matters if you are wary of open-core drift. For a homelab, both cost nothing.
Verdict
Choose Authelia if what you need is a 2FA login wall in front of self-hosted apps behind Traefik, Caddy, NGINX or Nginx Proxy Manager, your users fit in a YAML file or an existing LDAP directory, and you like a small Apache-2.0 service configured as code; its certified OIDC provider covers apps that can do OIDC. Choose Authentik if any app needs SAML, LDAP, SCIM or RADIUS, if users should sign up or recover accounts on their own, if someone other than you will administer it through a web UI, or if you may later want vendor support; budget for PostgreSQL and at least 2 CPU cores and 2 GB RAM. If you only need forward auth today and are unsure, start with Authelia: switching later means re-pointing your proxy's forward-auth target, re-registering OIDC clients and migrating users, which is work but not a rewrite.