Authentik

Flexible identity provider with flows suited to smaller self-hosted stacks

Review status: Evaluated. Read the evidence and pilot limits below before choosing.

open-core full guide featured

Overview

Authentik is an open-source identity provider popular in self-hosted environments. Coworking tech operators use it as a lighter-weight alternative to full enterprise IAM when exposing internal tools to staff.

At a glance

Field	Value
Categories	`identity-sso`, `security-compliance`
Deployment	`self-hosted`
License class	open-core (`MIT`)
Cost model	`free-self-hosted`
Implementation difficulty	`moderate`
Maintenance burden	`medium`
Maturity	`stable`
Freshness status	`partially-verified` (2026-07-17)
Completeness	`editorially-reviewed`
Confidence	`medium`
Directory tier	`evaluated`

Cost reality

Open-source software; infrastructure and maintenance are operator costs. Commercial support may be offered by the vendor.

Pricing and free-tier limits change frequently; re-check official pricing before budget decisions.

Official pricing

Tasks reduced or augmented

Software does not replace community or ops staff. It may reduce or augment:

Fronting internal apps with SSO
Reducing shared passwords for ops tools
Automating deprovisioning for departing staff

Human oversight still needed

Flow design
MFA enforcement
Application access reviews

Manual process this can replace

provision-member-access

Relationship: partial automation
Automation level: assisted
Manual process this can replace: Creating separate digital application accounts and assigning access in each application by hand.
Tasks it can reduce: Centralizes staff authentication and applies configured group and application policies consistently.
Role it assists: it-security-administrator
What still requires a person: Verify identity and approved entitlement, authorize each application role, review exceptions, and confirm effective access in the protected application.
What happens if it fails: An incorrect identity or policy mapping can grant excess application access or lock out an authorized worker, requiring immediate human containment and reconciliation.
How to measure the pilot: For two approved pilot users, all expected application grants and denials match the signed access matrix with no unexplained result.
Confidence: low

revoke-departing-access

Relationship: partial automation
Automation level: assisted
Manual process this can replace: Finding and disabling a departing worker’s separate digital application accounts one by one.
Tasks it can reduce: Provides one identity control point for disabling configured application access and reviewing related events.
Role it assists: it-security-administrator
What still requires a person: Confirm authorized scope and timing, assess active sessions and accounts outside Authentik, preserve required records, and verify each application no longer permits access.
What happens if it fails: Premature disablement can interrupt operations, while incomplete revocation can leave a departed worker able to reach sensitive applications.
How to measure the pilot: A test leaver is denied new login at the approved time and every protected application and residual session is reconciled by a named reviewer.
Confidence: low

Data held

identities
MFA factors
application access policies
logs
Personal data: yes
Payment data: no / not primary

Risks

Area	Notes
Vendor lock-in	Evaluate export formats and API completeness before deep customization.
Security	Apply updates promptly; restrict admin access; enable TLS.
Compliance	Operator remains responsible for privacy and local regulatory obligations.
Licensing	Confirm current LICENSE file for enterprise components.
Operational	Plan backups, monitoring, and a restore drill before production use.

Coworking fit

Roles: technical-operator, operations-manager

Workflows: access-provisioning, member-offboarding, compliance-review

Problems: integrate-stack, secure-door-access, self-host-for-data-control

Smallest useful experiment

Deploy Authentik with Docker Compose, protect one internal app with a proxy provider, and enroll two staff users with MFA.

Initial planning estimate (unverified): 1–3 days

Implementation guide

See the human-written implementation guide.

Verification

Status: partially-verified
Completeness: editorially-reviewed
Confidence: medium
Tier: evaluated
Last reviewed: 2026-07-17
Sources:

Seed entry compiled from official project sites and repositories. Re-verify pricing, license text, and feature claims before production decisions. Star counts and free-tier numeric limits intentionally omitted unless verified at review time.