If you run five or more self-hosted apps, you already have the problem Authentik solves: a different username and password for each one. Nextcloud has its own account. Gitea has another. Outline, Portainer, Grafana, and Chatwoot each have their own login screen and their own user database. When someone leaves your team, you have to deactivate five accounts instead of one. When you want to enforce MFA (multi-factor authentication, requiring a second proof of identity beyond a password), you have to configure it separately in each app. Authentik is the fix.
The project lives at github.com/goauthentik/authentik and has 22,584 stars. It is an open-source identity provider, meaning it is the single service that holds your users' credentials and proves their identity to every other app in your stack.
| Fact | Value |
|---|---|
| What it is | Self-hosted identity provider and single sign-on server |
| Built by | Authentik Security Inc. (open-source) |
| License | MIT (Community Edition) |
| Platforms | Docker, Kubernetes |
| Requires | Docker; at least 2 GB RAM |
| Install method | Docker Compose |
| Verdict | Install once you are running five or more self-hosted apps and want unified login management |
What Authentik actually is
An identity provider (IdP) is the service that holds and verifies user credentials. When you log into Gmail, you are not logging into Gmail itself, you are authenticating with Google, and Google tells Gmail "yes, this is a valid user." Authentik plays that role for your self-hosted stack: it becomes the single place where usernames, passwords, and second factors are stored. Every other app defers to Authentik instead of managing its own login system.
The mechanism that makes this work is SSO (single sign-on): a system where logging into one central service automatically grants access to multiple connected applications without re-entering a password. Authentik implements SSO using the same protocols that power enterprise and cloud identity:
- OAuth2 is the open authorization standard used by "Sign in with Google" or "Sign in with GitHub." Most modern self-hosted apps support it natively.
- OIDC (OpenID Connect) is an identity layer built on top of OAuth2. It adds a standardized way to pass user profile information alongside the authentication handshake.
- SAML (Security Assertion Markup Language) is an older enterprise SSO standard that many business applications, including some on-premise tools, still require.
- LDAP (Lightweight Directory Access Protocol) is the protocol used by corporate directory services and many older apps that predate web-based SSO.
- RADIUS is used for network-level authentication, including VPN clients.
In practice, this means Authentik works with virtually every self-hosted application you might be running. The protocol diversity matters because different apps speak different login languages, and Authentik speaks all of them.
What you get after installing it
Once Authentik is running and your apps are pointed at it, the experience from a user's perspective is simple: log in once at the Authentik portal and all connected apps become accessible without additional login prompts. The administrative experience is where the real benefit shows up.
User management lives in one place. Create an account for a new team member in Authentik, assign them to the right groups, and they immediately have access to every app their group is authorized for. When someone leaves, disable their Authentik account and they lose access to everything at once.
Groups work the same way they do in any corporate directory: a group called "editors" gets access to Outline and Nextcloud; a group called "developers" gets access to Gitea and Portainer. Individual app permissions flow from group membership rather than being set separately in each application.
The application portal is a page that shows users a grid of every application they have access to. It functions like a private app launcher. Instead of bookmarking ten different URLs, users open one URL and click the app they need.
MFA enforcement is configured once and applies everywhere. Authentik supports TOTP (Time-based One-Time Passwords, the 6-digit codes that change every 30 seconds, generated by apps like Google Authenticator or 1Password), hardware security keys (like YubiKey), and WebAuthn (the browser-native biometric standard that powers Face ID and fingerprint logins on modern devices). You set the policy in Authentik and it applies across every connected app without touching each one individually.
Outpost proxies are how Authentik handles apps that do not natively support OAuth2 or OIDC. An outpost is a lightweight process that acts as a reverse proxy (a gatekeeper that intercepts traffic before it reaches an app) and adds an authentication layer to anything, even tools that were never designed with SSO in mind.
The audit log records every authentication event: who logged in, to which application, from which IP address, and when. If something looks wrong, the log is there.
The install experience
Authentik installs via Docker Compose. Docker packages software into containers (self-contained bundles that include everything the app needs to run, so it works the same way on any server). Docker Compose is a configuration file that starts multiple containers together with a single command. The official documentation at goauthentik.io provides the Compose file and a setup guide.
The process looks like this: download the docker-compose.yml file from the docs, fill in a .env file (a plain text file of environment variables, which are configuration settings Docker reads at startup) with a secret key and a password for the built-in PostgreSQL database (a widely used open-source relational database that stores Authentik's user records), and run docker compose up -d. Authentik spins up several containers: the main server, a background worker, PostgreSQL, and Redis (a fast in-memory store used for caching and session management). All of them start together from the single Compose command.
After the containers are running, you open http://your-server-ip:9000/if/flow/initial-setup/ to create your first admin account. That takes about two minutes. Then you start adding your existing apps as "providers" in the Authentik admin panel.
Adding an application involves picking the right protocol (usually OAuth2/OIDC for modern apps), copying a few configuration values out of Authentik (a client ID, a client secret, and an authorization URL), and pasting them into the relevant settings screen in your app. This process takes five to fifteen minutes per application depending on how well that application's documentation covers its SSO setup. Most popular self-hosted tools (Nextcloud, Gitea, Outline, Grafana, Portainer) have public guides covering this exact integration.
The realistic time to a working install with your first two or three apps connected is two to four hours, most of which is reading the SSO configuration docs for each individual app. The Authentik side of each integration is consistent and well-documented; the variation is in how each app handles its SSO settings screen.
Where it fits and what to compare it to
Keycloak is the other major open-source identity provider. It is more established in enterprise environments and carries more features aimed at large organizations: fine-grained authorization policies, more complex claim mapping, and deeper integration with enterprise directories. It is also significantly more complex to configure and has a steeper learning curve. For a team running ten to twenty self-hosted apps with straightforward access requirements, Authentik is the faster path to a working setup.
Auth0 (now part of Okta) is a cloud-hosted identity service that is free for up to 7,500 monthly active users. It is genuinely easier to set up than either Authentik or Keycloak, and it handles all the server maintenance. The tradeoff is that your user credentials live on someone else's infrastructure, which matters for any team taking a privacy-first approach to self-hosting. If you are self-hosting Nextcloud specifically to keep files off cloud services, routing your login credentials through Auth0 is philosophically inconsistent.
Okta is an enterprise product at enterprise prices. It belongs in a different category from Authentik entirely.
No SSO at all is the default for most self-hosted stacks. Individual passwords per app seem manageable at two or three apps, but the credential management overhead grows with every addition. At five apps, the lack of SSO starts to cost real time. At ten, it creates genuine security risk: users reuse passwords, they write them down, and offboarding becomes a multi-step manual process that people forget to complete.
The honest position is that Authentik is overkill for a single-person homelab with two apps. It pays for itself in setup time the moment you have a second person who needs access to multiple applications, or the moment you want to enforce MFA consistently across everything you run.
Verdict
Install Authentik when you have crossed five self-hosted applications and want a single point of control for every login. The setup investment is real (plan for a half-day the first time), but it eliminates a category of ongoing administrative overhead that compounds with every app you add.
The MIT license means no seat fees, no usage caps, and no vendor dependency. Authentik Security Inc. runs a cloud version that funds development, which means the community edition benefits from active maintenance without you needing to worry about the project going dormant.
The specific case for non-technical teams: Authentik's admin panel is usable by someone who is not a developer. Creating a user, adding them to a group, enabling MFA, and reviewing the audit log all happen through a web interface that does not require command-line access. Once the initial integration work is done, day-to-day user management is point-and-click.
If you are already running Coolify, Nextcloud, Gitea, Outline, or any combination of the apps covered on agenthread.co, Authentik is the natural next layer. It is the login infrastructure that ties a self-hosted stack together into something that behaves like a coherent platform instead of a collection of separate tools.