authentik -- a self-hosted identity provider. One login for every app you run, spoken in SAML, OAuth2/OIDC, LDAP, RADIUS and SCIM.
Alternative to: Okta Workforce Identity Starter at $6/user/month billed annually, with a $1,500 annual contract minimum -- so a five-person team pays the $1,500 whether it uses it or not. Microsoft Entra ID P1 is $7/user/month on annual commitment.
Cost to run: free licence. A VPS that meets the documented floor is roughly $15-25/month; a real instance for a few hundred users is closer to $40-80/month.
Licence: MIT for the core. Free for commercial use. Everything underauthentik/enterprise/carries a separate proprietary licence.
Runs on: any Linux host with Docker or Podman Compose, or Kubernetes via Helm. Admin UI is browser-based. Outposts ship for Linux and macOS, amd64 and arm64.
Requires: Docker or Kubernetes, PostgreSQL, Redis, and a domain with TLS before any real SSO flow will work in a browser. Documented floor is 2 CPU cores and 2GB RAM.
Traction: 24,916 stars · 1,928 forks · 432 contributors · 847 open issues / 3,685 closed.
Liveness: very live -- a commit landed 2026-08-17, one day before these figures were taken, against an active 2026.8.0 milestone.
Maturity: 2026.5.6 stable, released 2026-07-22, with 2026.8.0-rc7 already in test. CalVer, quarterly majors, and breaking changes are documented as a routine part of each release rather than avoided.
Links: repo · goauthentik.io · Trendshift peak #1, 2024-08-17
Figures as of 2026-08-18.
What it does
Authentik sits between your users and everything they log into. A user hits an app, the app hands them to authentik, authentik checks who they are, and hands back a token the app trusts. That is single sign-on, and it is the same job Okta does.
It speaks the protocols the apps already expect. SAML and OAuth2/OIDC for modern web apps. LDAP for the old ones that never learned anything else. RADIUS for network gear. SCIM for pushing user accounts out to services that want their own copy. It also does MFA, self-service password reset, and the flow builder that decides what a login actually has to survive.
The pieces you run are a server, a worker, PostgreSQL, and Redis. Optional "outposts" sit in front of applications that cannot speak any auth protocol at all and put a login wall in front of them.
What it replaces, and what that costs
Enterprise identity is priced per person per month, forever, and the floor is often higher than the headline.
Okta Workforce Identity Cloud. The Starter suite -- SSO, MFA and Universal Directory -- is $6/user/month billed annually. The Essentials suite is $17/user/month. Both carry a $1,500 annual contract minimum, which is the number that actually matters for a small team: at ten people you are not paying $720, you are paying $1,500. Professional and Enterprise tiers are not published at all.
Microsoft Entra ID. P1 is $7.00/user/month on annual commitment. P2 is $10.00/user/month. The Entra Suite is $12.00/user/month and requires a P1 subscription underneath it.
Auth0, now Okta's, prices by monthly active users rather than seats: free to 25,000 MAU on the B2C tier, then Essentials at $35/month and Professional at $240/month, both capped at 500 MAU. Enterprise is contact-sales.
JumpCloud bundles SSO and MFA at $11/user/month billed annually. Ping publishes nothing.
Here is the addition for a 50-person company, one year, list price:
Okta Starter -- 50 × $6 × 12 = $3,600
Entra ID P1 -- 50 × $7 × 12 = $4,200
JumpCloud SSO & MFA -- 50 × $11 × 12 = $6,600
authentik Enterprise -- 50 × $5 × 12 = $3,000
authentik community edition -- $0 in licence, plus roughly $480-960/year for a VPS that can actually carry it
That last line is an avoided cost, not a saving. If you are not currently paying Okta, adopting authentik does not reduce a bill -- it means you never start one. If you are paying Okta for 50 seats, the bill that stops is $3,600 a year and the bill that starts is your hosting plus your own time.
The project's own paid tier is the honest complication. authentik Enterprise is $5/user/month plus $0.02 per external user per month, billed annually. It adds Google Workspace and Entra ID sync, Chrome Enterprise Device Trust, the Shared Signals Framework, mTLS client-certificate auth, RADIUS EAP-TLS, enhanced audit logging and ticketed support. Enterprise Plus starts at $20,000/year and adds FIPS and FedRAMP compliance, SLAs and multi-instance support.
What keeps that from being a bait-and-switch is written down. Authentik's own pricing FAQ asks "Will any feature of the open source version ever become enterprise-only?" and answers: "No." That sentence is the reason this entry exists. Very few open-core projects put it in writing.
Is it still alive?
Very live, and not marginally so.
The last commit landed 2026-08-17, roughly nine hours before these figures were pulled. The releases page runs 36 pages deep, working out to a release every one to two weeks over a period of years. Issues opened between 12 and 17 August 2026 already carry maintainer-applied labels -- bug/confirmed, status/reviewing -- and milestone assignments against the 2026.8.0 release. The founder himself opened issue #24878 on 2026-08-07.
The downloads download. A 2026.5.6 release asset -- authentik-outpost-ldap_linux_amd64 -- returns HTTP 200 and a real 28MB payload from GitHub's release CDN.
Trendshift records it hitting #1 on GitHub Trending across all languages on 2024-08-17, which is a two-year-old peak that the current commit cadence has outlived.
What people say
Hacker News carries the most useful comments; Reddit was unreachable from the research sandbox and no vote counts from it are reported here rather than invented.
Fletcher Heisler, authentik's CEO, disclosing his own interest, on 2026-06-25:
"Just for clarity: Cloudflare runs authentik for their workforce identity. (source/disclosure: am CEO). Glad to see them making use of Hydra for OAuth apps!"
-- news.ycombinator.com/item?id=48676777
A user on 2026-08-06, describing where he draws the buy-versus-run line:
"I'll never vibe-code PostgreSQL. I don't want to maintain my own Kubernetes codebase. I happily pay for GitLab Enterprise and Authentik Enterprise."
-- news.ycombinator.com/item?id=49193286
The dissent is consistent and it is about weight. An r/selfhosted thread titled "Switching to Pocket-id from Authentik" carries the line "Authentik is utterly and needlessly complex, however, it's also audited and probably a lot more scanned than pocketID" -- retrievable only as a search snippet, so it is reported here without a vote count.
The catch
The documented hardware floor is understated. In issue #21413, filed 2026-04-06, an operator running roughly 1,400 users reported the worker process peaking at about 7.4GB of RAM and PostgreSQL at 1.4GB, against docs that say 2GB is the minimum. They asked for the documentation to recommend 10GB for production. A maintainer replied on 2026-04-09 that they were "looking to improve the documentation about how to scale resources for different use cases." The issue was auto-closed as stale on 2026-08-17 with no documentation fix landed.
It is a stack, not a container. PostgreSQL, Redis, a reverse proxy for TLS, and a worker process are all yours to back up, patch and monitor. Nobody is on call for you.
Breaking changes are routine. Each quarterly release documents its own. An upgrade is a review, not a version bump.
The Enterprise line is real. Google Workspace and Entra ID sync, mTLS, RADIUS EAP-TLS and the Shared Signals Framework are not in the free edition today. The written promise is that nothing already free will move -- not that everything new will be.
Credits
Jens Langhammer (BeryJu), who made the first commit in November 2018 and is now founder and CTO of Authentik Security Inc. Fletcher Heisler (@fheisler), CEO. Marc "risson" Schmitt, Marcelo Elizeche Landó and the 432 contributors on the repo. The Hacker News commenters quoted above. Pricing verified against Okta, Microsoft, Auth0 and JumpCloud's own published pages; traction and peak rank from GitHub and Trendshift.