Authentik vs Keycloak
Authentik and Keycloak compared as self-hosted identity providers for SSO: protocols (OIDC, SAML, LDAP, RADIUS, SCIM), forward-auth for apps without SSO, databases, sizing, licences, Authentik's Enterprise pricing and the current 2026 releases.
Quick Answer
Authentik is the better default for homelabs, small teams and VPS stacks: one Docker Compose file (server, worker, PostgreSQL), a built-in proxy outpost that puts SSO in front of apps with no login of their own, and it can act as an LDAP or RADIUS server for legacy apps. Keycloak is the pick for larger organisations and Java/Kubernetes shops that need clustering, a choice of production databases, an operator, fine-grained authorization services and a CNCF project with no paid edition at all.
Last updated October 22, 2026. Covers Authentik 2026.8.5 (21 October 2026) and Keycloak 26.8.1 (13 October 2026), including Keycloak 26.8's supported SCIM API and stateless multi-cluster mode, and Authentik's current Enterprise pricing.
| Feature | Authentik | Keycloak |
|---|---|---|
| Price | Free (open source); Enterprise $5/internal user/month, external users $0.02/month billed annually; Enterprise Plus from $20k/year | Free |
| Licence | MIT, except the authentik/enterprise directory (own licence) | Apache-2.0 |
| Paid Edition | Yes: Enterprise and Enterprise Plus | No (upstream project) |
| SSO Protocols | OAuth2/OIDC, SAML, LDAP, RADIUS, WS-Fed, Kerberos | OpenID Connect, OAuth 2.0, SAML 2.0 |
| Forward-Auth / Proxy for Non-SSO Apps | Yes, built-in proxy provider (proxy and forward-auth modes) | No; use a separate proxy such as OAuth2 Proxy |
| Acts as LDAP Server | Yes, LDAP provider via outpost | No |
| LDAP / AD User Federation | Yes, LDAP source | Yes, LDAP and Active Directory (plus Kerberos) |
| SCIM | Outbound SCIM provider (push users/groups to apps) | Inbound SCIM API (supported since 26.8) |
| Production Database | PostgreSQL only | PostgreSQL, MySQL, MariaDB, SQL Server, Oracle, Aurora, Azure SQL |
| Documented Minimum / Baseline | 2 CPU cores, 2 GB RAM (Docker Compose) | ~1,250 MB RAM per pod baseline (sizing guide) |
| Kubernetes Deployment | Yes, official Helm chart (authentik/authentik) | Yes, official Operator |
| Vendor-Hosted Option | No | No (upstream project) |
| Latest Release (Oct 2026) | 2026.8.5 (21 Oct 2026) | 26.8.1 (13 Oct 2026) |
Authentik
Open-source identity provider written in Python and Go, built around configurable flows and stages, with OAuth2/OIDC, SAML, LDAP, RADIUS, SCIM and proxy providers plus outposts that sit next to your reverse proxy.
Pros
- Proxy provider protects apps with no OIDC, SAML or LDAP support, in full-proxy or forward-auth mode, with setup guides for Caddy, Envoy, HAProxy, nginx and Traefik
- Can act as an LDAP server (via an outpost) and a RADIUS server for legacy apps, network gear and VPNs
- Small footprint to start: documented minimum of 2 CPU cores and 2 GB RAM, and since 2025.10 PostgreSQL is the only data store (Redis removed)
- Open-source edition already covers OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos and proxy, plus web-based RDP/SSH access, and the pricing page says no features will move from open source to Enterprise
- Outbound SCIM provider plus Google Workspace and Entra ID providers to push users and groups into other systems
- Visual flow and stage model makes custom login, enrolment and recovery flows possible without writing extensions
Cons
- Several features are Enterprise-only ($5 per internal user per month): Google Workspace and Entra ID integrations, mTLS client certificates, device trust, enhanced audit logging
- Paid ticket support only on Enterprise subscriptions over $1k; otherwise community Discord and GitHub
- PostgreSQL is the only supported database, and the 2025.10 release notes warn of about 50% more Postgres connections after the Redis removal
- No vendor-hosted version; you always run it yourself
- Smaller ecosystem of third-party extensions and enterprise integrations than Keycloak
Best For
Homelabs, startups and small-to-mid teams on Docker or a VPS who want SSO across self-hosted apps, including ones with no login integration, plus LDAP or RADIUS for legacy services.
Keycloak
Open-source identity and access management server (Java, Quarkus) and a CNCF incubation project, providing SSO over OpenID Connect, OAuth 2.0 and SAML, identity brokering, LDAP/AD user federation and fine-grained authorization services.
Pros
- Completely free under Apache-2.0, with no paid tier or feature gating in the upstream project
- Broad production database support: PostgreSQL 14–18, MySQL 8.0/8.4, MariaDB, Microsoft SQL Server, Oracle, Aurora PostgreSQL and Azure SQL
- Built for clustering: Infinispan/JGroups caching, and 26.8 made multi-cluster stateless mode (no external cache) fully supported
- Authorization Services for fine-grained policies beyond roles, plus identity brokering and social login from the admin console
- SCIM API for inbound provisioning became supported in 26.8, alongside client secret rotation
- Official container image on Quay and an Operator on OperatorHub for Kubernetes and OpenShift
Cons
- Heavier baseline: Keycloak's sizing guide puts a pod at about 1,250 MB RAM with caches, and 1 vCPU per ~15 password logins per second
- No built-in forward-auth proxy: the Louketo proxy was retired in 2020 and Keycloak's blog pointed users to OAuth2 Proxy
- Cannot act as an LDAP or RADIUS server; it federates from LDAP/AD instead
- Production setup takes more work: a real database (the default dev-file store is not for production), TLS, hostname and reverse-proxy path rules
Best For
Organisations with many apps and users, Kubernetes or Java teams, and anyone needing clustering, a non-Postgres database, fine-grained authorization or a fully free IAM with no enterprise tier.
Protecting apps that have no SSO: the practical difference
Most self-hosted stacks include tools that speak neither OIDC nor SAML: dashboards, admin panels, internal status pages. This is where the two projects diverge most. Authentik ships a proxy provider for exactly this case. In proxy mode its outpost sits in front of one upstream application. In forward-auth mode your existing reverse proxy keeps routing traffic and asks the outpost whether each request is authenticated; you can do this per application (with its own policies) or once for a whole parent domain. The docs have setup pages for Caddy, Envoy, HAProxy, nginx and Traefik, and the server container includes an embedded outpost, so a basic setup needs no extra container. Keycloak does not include an equivalent. It used to have Gatekeeper, later renamed Louketo Proxy; in August 2020 the Keycloak blog announced Louketo's end of life and suggested OAuth2 Proxy as the replacement. Today you run OAuth2 Proxy (or your reverse proxy's own OIDC module) as a separate component with Keycloak as its identity provider. It works well, but it is one more service to configure, upgrade and secure per protected app or domain. Authentik also covers the other legacy case: its LDAP provider makes authentik act as an LDAP server, so apps that only do LDAP bind can authenticate against it, and a RADIUS provider serves network devices and VPNs. Keycloak federates from LDAP and Active Directory but does not serve LDAP itself.
Deployment, databases and resource use
Authentik's documented Docker Compose install asks for a host with at least 2 CPU cores and 2 GB RAM. The stack is a server container (router, core and embedded outpost), a worker for background jobs, and PostgreSQL. Since release 2025.10 authentik no longer uses Redis at all: caching, the embedded outpost and WebSocket traffic moved to Postgres, and the release notes warn to expect about 50% more Postgres connections. It listens on 9000 (HTTP) and 9443 (HTTPS) by default, which fits behind Nginx Proxy Manager or Traefik without port clashes. Keycloak is a Quarkus-based Java server distributed as a ZIP/TAR.GZ, a container image on quay.io and an Operator. Its database guide lists PostgreSQL 14 to 18, MySQL 8.0 and 8.4, MariaDB 10.6 to 11.8, SQL Server 2019/2022, Oracle 19c/23, Aurora PostgreSQL and Azure SQL, and warns that the default dev-file store is for development only. The production guide expects TLS everywhere, a defined hostname, a reverse proxy that hides admin paths, and multiple instances clustered with Infinispan and JGroups. On memory, Keycloak's sizing guide gives a baseline of about 1,250 MB of RAM per pod including realm caches and 10,000 cached sessions, plus 1 vCPU for every 15 password logins per second and 150% headroom. On a 4 GB VPS shared with other containers, that difference is noticeable.
Pricing and licences
Keycloak is Apache-2.0 and a CNCF incubation project; the upstream project has no paid edition, and everything on its feature list is free. Authentik's core is MIT-licensed, except the authentik/enterprise directory, which has its own licence. Its pricing page has three tiers. Open Source is free and includes OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos and proxy protocols, OpenID certification, web-based RDP/SSH access, OAuth 2.0 token exchange and B2B/B2C use. Enterprise costs $5 per user per month and adds privileged access management, Google Workspace and Entra ID integrations, mTLS and RADIUS EAP-TLS, Chrome Enterprise device trust, Windows local device login, password history checks, enhanced audit logging and CSV reports. External users (customers or partners who never see the dashboard) cost $0.02 per user per month billed annually, and service accounts are free. Enterprise Plus starts at $20k a year for invoicing, SLAs, multi-instance support and FIPS. Two practical points. Authentik's pricing page commits that features will not move from open source to Enterprise. And paid support only exists on Enterprise subscriptions over $1k; Keycloak has community support only upstream. A 50-person team needing Authentik's Entra ID sync would pay about $250 a month; the same team on Keycloak pays nothing but runs its own sync tooling.
Provisioning, federation and recent releases
Both handle federation but in different directions. Keycloak's User Federation reads users from LDAP and Active Directory, supports Kerberos, and brokers logins from other OIDC or SAML identity providers and social networks. Keycloak 26.8.0 (1 October 2026) promoted its SCIM API to supported: SCIM clients such as Entra ID can create, update and delete users and groups inside a Keycloak realm. The same release made client secret rotation and multi-cluster stateless mode supported and added a preview of token exchange delegation for AI agents. 26.8.1 followed on 13 October with 19 CVE fixes, so stay current. Authentik's SCIM provider works the other way: it pushes authentik's users and groups out to downstream applications, with periodic full syncs. It also has LDAP and other sources for pulling users in, and Enterprise providers for Google Workspace and Entra ID. Authentik releases on a calendar-version scheme; 2026.8.5, a five-fix patch release, shipped on 21 October 2026. If an upstream HR or IdP system must push identities into your SSO server, Keycloak's inbound SCIM fits. If your SSO server is the source of truth and must provision accounts into SaaS apps, Authentik's outbound SCIM fits.
Verdict
Choose Authentik if you run self-hosted apps on Docker or a single VPS and want SSO in front of everything, including apps with no login integration: its proxy provider works with Traefik, nginx, Caddy, HAProxy and Envoy, it can serve LDAP and RADIUS to legacy software, and it starts on 2 CPU cores and 2 GB RAM with PostgreSQL only. Choose Keycloak if you are an organisation standardising IAM across many applications, run Kubernetes, need a database other than PostgreSQL, or want clustering and fine-grained authorization with no paid edition anywhere in the picture; budget for more memory and plan to add OAuth2 Proxy for apps that cannot speak OIDC or SAML. If you need Authentik's Google Workspace or Entra ID sync, mTLS or enhanced audit logging, price in Enterprise at $5 per internal user per month.