authentik
The authentication glue you need.
authentik is an open-source identity and access project on GitHub under a license set out in its repository, with 26k stars. It is built with CPython, TypeScript, Axum and sqlx. Its last push was today.
- Stars
- 26k
- License
- See repository
- Activity
- Active
- Latest release
- version/2026.8.5
Against what buyers need
Identity and access: covers 97% of the checklist. An identity provider with OIDC, SAML, LDAP, RADIUS, Kerberos, a SCIM provider and a proxy outpost that puts a login in front of apps without one, all in the free edition, plus editable login flows and a clear admin UI. Google Workspace and Entra ID sync, enhanced audit logging and support are in Enterprise ($5 per workforce user per month), and there are no B2B customer organisations. Missing: organisations and multi-tenancy for B2B.
Judgement
- What it is
- Complete system
- What it does
- A self-hosted identity provider for single sign-on over SAML, OAuth2 and OIDC, LDAP and RADIUS, with configurable login flows, MFA and a proxy for apps that have no SSO.
- Adopt it when
- You want one login for many self-hosted and SaaS apps without paying per user for Okta or Entra ID, and can run it yourself.
- Watch out
- Some features are in the paid Enterprise tier, and its flow and stage model takes time to learn.
- Ready for
- Production-ready
- Runs as
- Self-hosted server
- Built with
- Python, Django, TypeScript, Go, Rust and PostgreSQL
- How established
- Established: started 6 years ago, latest release version/2026.8.5.
- What the license allows
- GitHub could not read the license. Check it in the repository before reusing any code.
Judged on 2026-11-06 from the project's README and GitHub data. The license and age lines are worked out directly.
Compare authentik
Built from
Follow it down: authentik → CPython → GCC → LLVM project → runs on a microchip
Open-source alternatives to authentik
-
1
Keycloak keycloak
Open Source Identity and Access Management For Modern Applications and Services
Building block Production-ready You need self-hosted SSO across many applications with enterprise protocols and no licence fees.
★ 38k Apache-2.0 Java Active, pushed today
-
2
Better Auth better-auth
The most comprehensive authentication framework
Building block Production-ready You are building a TypeScript web app and want auth in your own codebase and database instead of a hosted service.
★ 31k MIT TypeScript Active, pushed 4 days ago
-
3
Authelia authelia
The Single Sign-On Multi-Factor portal for web apps. OpenID Certified™ and Post-Quantum Cryptography Ready.
Complete system Production-ready You self-host several web apps behind Nginx, Traefik or Caddy and want one login with MFA in front of them.
★ 30k Apache-2.0 Go Active, pushed today
-
4
Devise heartcombo
Flexible authentication solution for Rails with Warden.
Building block Production-ready You are building a Rails app with conventional email and password accounts.
★ 24k MIT Ruby Active, pushed 30 days ago -
5
Casbin apache
Apache Casbin: an authorization library that supports access control models like ACL, RBAC, ABAC.
Building block Production-ready Your application needs configurable permission rules without writing an authorisation engine.
★ 20k Apache-2.0 Go Active, pushed 3 days ago
-
6
openGym DuarteSantos8
Open-source gym & body-weight tracker, now in the App Store (iPhone + Apple Watch) and as an Android APK. Plan routines, log workouts, see which muscles are trained, import from Strong/Hevy/FitNotes. Self-host it or use it on the phone alone.
Complete system Experimental You want a free workout log you can self-host or keep on your phone, without a subscription app.
★ 19k AGPL-3.0 JavaScript Active, pushed 3 days ago -
7
ZITADEL zitadel
ZITADEL - Identity infrastructure, simplified for you.
Building block Production-ready You build a B2B SaaS that needs per-customer organisations and SSO without assembling it yourself.
★ 16k AGPL-3.0 Go Active, pushed yesterday
-
8
Logto logto-io
🧑🚀 Authentication and authorization infrastructure for SaaS and AI apps, built on OIDC and OAuth 2.1 with multi-tenancy, SSO, and RBAC.
Building block Production-ready You want an Auth0-like service with ready sign-in screens that you can self-host or use as cloud.
★ 15k MPL-2.0 TypeScript Active, pushed today
Commercial identity providers and single sign-on servers
-
1
Microsoft Entra ID Microsoft
Strengthen identity security with Microsoft Entra ID, a cloud identity and access (IAM) solution that prevents identity attacks and supports SSO and Zero Trust.
Complete system Production-ready Your organisation uses Microsoft 365 and wants identity and SSO without another vendor.
508 readers a month Since 2008 Commercial
-
2
Ping Identity Ping Identity
Ping Identity helps you protect your users and every digital interaction they have while making experiences frictionless.
Complete system Production-ready A large enterprise or bank has complex hybrid identity needs, including on-premise federation.
498 readers a month Since 2002 Commercial
-
3
JumpCloud JumpCloud
JumpCloud makes it simple to manage Windows, Apple, Linux, and Android devices and to deliver secure access with SSO, MFA, Zero Trust, RADIUS, and more.
Complete system Production-ready A small or midsize company without Active Directory wants one place for users, devices and access.
179 readers a month Commercial
-
4
Amazon Cognito Amazon Web Services
Implement customer identity and access management (CIAM) that scales to millions of users with Amazon Cognito, fully managed authentication service.
Building block Production-ready An application already on AWS needs cheap customer sign-in at scale.
Commercial
-
5
Auth0 Okta, Inc.
Secure users, AI agents, and more with Auth0, a production-ready authentication and authorization platform built to help you ship faster and drive sign-ups.
Building block Production-ready A product team wants a complete login system for its customers with enterprise SSO and does not want to build auth.
Commercial
-
6
AWS IAM Identity Center Amazon Web Services
IAM Identity Center helps you securely create, or connect, your workforce identities and manage their access centrally across AWS accounts and applications.
Complete system Production-ready You run several AWS accounts and want engineers to sign in once with roles assigned centrally.
Commercial
Stars, license and activity come from GitHub and refresh on a rolling hourly schedule. The project's own description is quoted as written.