authentik Setup: Self-Host SSO for Every App in 15 Minutes

authentik is an open source identity provider you run on your own hardware, and it speaks the four protocols a mixed stack actually needs: OAuth2/OIDC, SAML, LDAP and RADIUS. It added roughly 470 stars in a day this week on top of about 24,000 total, and for a project that started in 2019 that kind of spike almost always means a release is landing. It is. The 2026.8 release candidates went up on August 3, and that version makes authentik officially OpenID Certified. Budget about fifteen minutes to go from an empty directory to a working login page.

• Stable today is 2026.5.6, published July 22. 2026.8 is still in release candidates and brings privileged access management, account switching and OpenID certification.
• Two documented install paths: Docker Compose for small and test setups, Helm for clusters. Both are four commands or fewer.
• One instance can front an app that only speaks SAML, an app that only speaks OIDC, and an app that speaks no auth protocol at all, using the proxy outpost.
• The core is MIT licensed, but PAM, scheduled offboarding and WS-Federation sit behind the enterprise license, so check the feature list against your requirements before you commit.

What is authentik and why is it trending?

The repository tagline is blunt: "The authentication glue you need." That is fair. authentik is a Python and Django application that becomes the single login system for everything else you run, whether that is a SaaS app expecting SAML, an internal dashboard expecting OIDC, a network appliance that only knows RADIUS, or an old service with no authentication at all. It sits at about 24,000 stars and 1,843 forks, and the maintainers sell an enterprise tier aimed at organizations replacing Okta, Auth0, Entra ID or Ping.

RelatedKaneo Setup: Self-Host a Free Jira Alternative in 10 Minutes

The spike traces to the 2026.8 release candidates, six of which landed on August 3. authentik is now OpenID Certified by the OpenID Foundation across the Basic, Implicit, Hybrid, Config and Form Post provider profiles plus all three logout profiles, which is a credential procurement teams ask for by name. The release also adds OAuth 2.0 token exchange, key-bound ID tokens, nested LDAP group sync and policy bindings that expire on a schedule, and it moves the server entrypoint and proxy outpost from Go to Rust. The notes are candid about that last part: a one-to-one port that "currently does not bring any improvements" and exists to set up future work.

How do you install authentik with Docker Compose?

This is the documented path for test setups and small production deployments. You need a host with at least 2 CPU cores and 2 GB of RAM, and Docker Compose v2 or Podman. Start by pulling the official compose file into an empty directory.

# Linux
wget https://docs.goauthentik.io/compose.yml

# macOS
curl -O https://docs.goauthentik.io/compose.yml

Next, generate the database password and the secret key. The docs suggest a password generator such as pwgen, or openssl, writing both straight into a .env file beside the compose file. One documented limit: PostgreSQL will not accept passwords longer than 99 characters, so do not get creative with the length.

# write the two required secrets into .env
echo "PG_PASS=$(openssl rand -base64 36 | tr -d '\n')" >> .env
echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60 | tr -d '\n')" >> .env

# optional: opt in to error reporting
echo "AUTHENTIK_ERROR_REPORTING__ENABLED=true" >> .env

By default authentik listens internally on 9000 for HTTP and 9443 for HTTPS. If you want it on the standard web ports instead, add two more lines to .env before you start anything, then bring the stack up.

# optional, in .env: expose 80 and 443 instead of 9000 and 9443
COMPOSE_PORT_HTTP=80
COMPOSE_PORT_HTTPS=443

docker compose pull
docker compose up -d

Once the containers settle, open http://<your server IP or hostname>:9000. authentik walks you into an initial setup flow and asks you to set a password for akadmin, the default administrator. From there the next steps are adding an application and its provider, then creating a real user for yourself and leaving akadmin alone.

What does the Kubernetes install look like?

For clusters the project ships a Helm chart. Write a values.yaml with a secret key, a PostgreSQL password, and either an ingress hostname or a Gateway API route, then install it. Migrations run automatically on startup.

helm repo add authentik https://charts.goauthentik.io
helm repo update
helm upgrade --install authentik authentik/authentik -f values.yaml

One caveat the docs state plainly: the PostgreSQL database the chart installs by default is meant for demos and test environments. Production deployments should point authentik at a separately managed database, with CloudNativePG and the Zalando Postgres Operator named as the common options.

How does it compare with the alternatives?

The honest read: Authelia is lighter and lovely if every app already sits behind a reverse proxy and you never need SAML. Keycloak is the heavyweight with the deepest enterprise history. authentik wins on breadth per unit of effort, because one instance covers the SAML app, the OIDC app, the RADIUS appliance and the legacy web tool without a second project bolted on for each.

What are the gotchas before you rely on it?

Six things worth knowing on day one rather than day thirty. The compose file statically references whatever version was current when you downloaded it, so upgrading means fetching a fresh compose.yml, not just pulling images. 2026.8 adds lifecycle tooling that refuses unsupported major-version skips before migrations start.

RelatedWorld Monitor Setup: Self-Host a Global Intel Dashboard

Second, the default compose file mounts /var/run/docker.sock into the worker container so authentik can deploy outposts for you. That is a real privilege escalation surface. The docs point at a Docker socket proxy as a mitigation, or you can drop the mount and deploy outposts manually.

Third, do not mount /etc/timezone or /etc/localtime into the containers. Internal operations run in UTC and the UI localizes for the reader; overriding it breaks OAuth and SAML authentication, which the project documents against a long-running GitHub issue.

Fourth, check the feature gating: privileged access management, scheduled offboarding, self-hosted event maps and WS-Federation are enterprise features in 2026.8. Fifth, the hash_password command no longer accepts a password as a positional argument. Use the interactive prompt or pipe it in.

# 2026.8: interactive prompt, or pipe via stdin for automation
docker compose run --rm server hash_password

Sixth, and this one is about you rather than the software: the moment authentik fronts your apps, it becomes the single point of failure for all of them. Back up the database from day one and keep a documented way back in if the instance is down. Also set the new Base URL system setting now, because the release notes say it becomes required in 2026.11.

Our take

Protocol coverage is not what makes authentik stick. Keycloak has covered the same ground for years with more enterprise mileage behind it. The difference is the flow builder: the login experience is something you assemble from stages in a UI instead of something you fork and maintain a theme for. That one decision is why so many homelabs and small platform teams land here after trying something heavier. The proxy outpost is the other half of the pitch, because in any real environment a good share of internal tools have no auth story at all and never will.

The risk is the open core line. A release whose headline features are PAM, scheduled offboarding and WS-Federation, all enterprise, says something about where development attention goes next. That is a legitimate way to fund the work, and the community edition is still a complete identity provider rather than a demo. Just go in knowing which column your requirements fall into. Standing it up this weekend? Install 2026.5.6, get one application working end to end, and wait for 2026.8 to leave release candidate before migrating anything that matters.

Original analysis by GenZTech. Tool documentation: goauthentik/authentik on GitHub.