Authentik vs. Authelia 2026: Which Self-Hosted Identity Provider Fits?

Authentik or Authelia? The question comes up in every self-hosting forum – and the answer is less nuanced than most comparisons suggest. Authelia is an excellent auth gateway for homelabs. But as soon as a business needs SAML for legacy apps, LDAP for network devices, SCIM for automated on-/offboarding, or centralized user management with flows and policies – Authelia reaches its limits. Authentik covers all of that, as an open-source solution with MIT license. And with authhost, you get Managed Authentik Hosting from €34.90/month – without the operations overhead.

Also worth reading: Keycloak Alternative for SMBs

Quick Comparison: Authentik vs. Authelia at a Glance

Table of Contents

• What Is Authelia?
• What Is Authentik?
• Architecture: Auth Gateway vs. Identity Provider
  • Authelia: In Front of the Reverse Proxy
  • Authentik: Central Identity Platform
  • Architecture Comparison
• Protocol Support: The Decisive Difference
• MFA and Conditional Access
  • MFA Methods
  • Conditional Access
• User Management and Automation
  • Authelia: Minimal by Design
  • Authentik: Full Identity Platform
• Resource Usage: Lightweight vs. Full-Stack
  • Docker Footprint Comparison
• Reverse Proxy Integration vs. Application Proxy
  • Authelia: Forward-Auth Specialist
  • Authentik: Three Integration Paths
• Security and Community
  • Security
  • Community and Development
• Setup and Operations: YAML vs. Self-Service Portal
  • Authelia: YAML Configuration
  • Authentik: Web UI + Flow Engine
  • authhost: Managed Authentik Hosting
• Cost Comparison
  • Authelia: Free, But Operations Overhead
  • Authentik Self-Hosted: Free or $5/User/Month
  • authhost: Flat Rate Without Per-User Fees
  • Cost Comparison: 50 Users, 3 Years
• Decision Guide: When Authelia, When Authentik?
  • Authelia is the right choice if you:
  • Authentik / authhost is the better choice if you:
  • The Short Formula
• Conclusion
• Sources

What Is Authelia?

Authelia is an open-source authentication server written in Go. It acts as a companion for reverse proxies – Nginx, Traefik, Caddy, HAProxy, Envoy – placing a login page with MFA in front of your applications.

What Authelia does well:

• Login portal with MFA (TOTP, WebAuthn, Passkeys, Duo Push)
• OpenID Connect 1.0 provider (OpenID Certified since 2024)
• Granular access policies per subdomain/path
• Brute-force protection and session management
• Extremely lightweight: <20 MB image, ~30 MB RAM

What Authelia cannot do by design:

• No SAML 2.0 provider (on roadmap, no published timeline)
• No LDAP server (can only use LDAP as backend, not provide it)
• No SCIM provisioning
• No RADIUS
• No application proxy for apps without native SSO support
• No visual flow engine or workflow automation
• No full user management dashboard
• No user impersonation

Authelia was built for a specific purpose: placing an authentication layer in front of a reverse proxy. It does this excellently – but it is not an identity provider in the true sense.

What Is Authentik?

Authentik is an open-source identity provider written in Python/Django with a TypeScript frontend. It is the self-hosted alternative to commercial solutions like Okta, Auth0, or Azure AD – with full protocol support and a visual flow engine.

What Authentik offers:

• SSO via OIDC, OAuth2, SAML 2.0, LDAP, SCIM, RADIUS, and Kerberos
• Full admin dashboard with user management
• Flow engine: authentication processes as configurable flows with stages, policies, and providers – visually modeled
• Application proxy: SSO for applications that don't speak OIDC or SAML
• LDAP outpost: full LDAP server for legacy applications
• RADIUS outpost: authentication for VPN, WiFi, and network devices
• SCIM provisioning: automatic on-/offboarding via HR systems or IdPs
• Remote Access Gateway: browser-based RDP, SSH, and VNC access
• Conditional access: GeoIP checks, impossible travel detection, device posture
• User impersonation for support and debugging
• MIT license: no usage restrictions, including commercial use

Authentik Enterprise ($5/user/month) adds features that most SMBs don't need: Google Workspace integration, WS-Federation, mTLS login, extended compliance reports. The open-source version covers the majority of business requirements.

Architecture: Auth Gateway vs. Identity Provider

Authelia: In Front of the Reverse Proxy

User ──► Reverse Proxy (Traefik/Nginx) ──► Authelia checks login ──► App
                                                │
                                          MFA, Session, OIDC

Authelia guards the entrance. It sits as forward-auth middleware in front of the reverse proxy and decides: may the user pass or must they log in first? This works via auth_request (Nginx), forwardAuth (Traefik), or forward_auth (Caddy).

Advantage: Extremely lightweight, fast to set up, minimally invasive. Disadvantage: The application behind it knows nothing about the user – except via HTTP headers. For apps that need real SSO integration (tokens, claims, groups), this isn't enough.

Authentik: Central Identity Platform

User ──► Authentik (Login, MFA, Flow Engine) ──► Token/Session
                    │
        ┌───────────┼───────────┬──────────────┐
        ▼           ▼           ▼              ▼
   OIDC App    SAML App    LDAP Device    Proxy App

Authentik manages the identity. It is the central point where users are authenticated, authorized, and provisioned. Applications speak directly with Authentik via OIDC, SAML, LDAP, or the application proxy.

Advantage: Every application knows the user, their groups, their roles. Automation via flows and SCIM. Disadvantage: Larger footprint (~250–350 MB RAM including PostgreSQL; no Redis since release 2025.10).

Architecture Comparison

Protocol Support: The Decisive Difference

This is where the comparison becomes clear-cut. In a business, there are never only OIDC-capable applications. There's legacy software that only speaks LDAP. Network devices that need RADIUS. Enterprise SaaS vendors that insist on SAML. And internal tools that don't support any SSO protocol at all.

Authelia's SAML problem: SAML 2.0 has been on the Authelia roadmap for years (GitHub Issue #493) but is not implemented as of April 2026. There is no published timeline. The Authelia team consists of 3 developers working in their spare time. For businesses that need SAML for Microsoft 365, Salesforce, AWS SSO, or other enterprise services, this is a dealbreaker.

Authelia's LDAP problem: Authelia can use LDAP as an authentication backend (e.g., against an existing Active Directory). But it cannot provide an LDAP service. If you want to authenticate a NAS (Synology, QNAP), a firewall (OPNsense, pfSense), or network switches via LDAP, you need an LDAP server – and Authelia can't do that.

MFA and Conditional Access

MFA Methods

Both support the essential MFA methods. Authelia has the advantage of Duo Push integration, while Authentik offers SMS and email as additional factors.

Conditional Access

This is where the tools clearly diverge:

Authelia offers rule-based access policies: allow/deny access based on domain, path, group, and network. Sufficient for simple scenarios.

Authentik offers a full policy engine:

• GeoIP checks: Login from an unusual country? Additional MFA prompt.
• Impossible travel detection: Login from Berlin and 5 minutes later from Tokyo? Block.
• Device posture: Device known and compliant? Access granted.
• Reputation scoring: IP addresses with known abuse patterns are blocked.
• Time-based policies: Access only during business hours.
• Flow engine: All conditions visually modeled, no code required.

For businesses with compliance requirements (NIS2, GDPR, ISO 27001), Authentik's conditional access functionality is a decisive advantage.

User Management and Automation

Authelia: Minimal by Design

Authelia doesn't manage users in the traditional sense. It authenticates against an external backend (LDAP server, local YAML file) and stores sessions. There's no admin dashboard for user management, no group assignment via UI, no self-service features for end users.

Authentik: Full Identity Platform

• Admin dashboard: Users, groups, roles, applications – all manageable via web UI
• Flow engine: Visually model authentication processes (registration, recovery, login, enrollment)
• SCIM provisioning: Automatically sync users from HR systems or external IdPs. Employee leaves the company → access automatically revoked.
• User impersonation: View from a user's perspective as admin – for support and debugging
• Self-service: Users can reset passwords, manage MFA, register devices – without admin intervention
• Event logging: Every action logged – login, logout, policy change, group assignment. Enhanced audit logging (diff view, CSV export, visual analytics) with Authentik Enterprise.

Resource Usage: Lightweight vs. Full-Stack

Docker Footprint Comparison

Authelia is 2–3× more resource-efficient. On a Raspberry Pi or mini PC with 2 GB RAM, that matters. On a server with 8+ GB RAM – meaning any business server – the difference is negligible.

For perspective: A single Chrome tab uses more RAM than the entire Authelia stack. The question "which uses less RAM?" is the wrong question for businesses. The right question is: "which solves my problem?"

Reverse Proxy Integration vs. Application Proxy

Authelia: Forward-Auth Specialist

Authelia integrates natively with:

• Nginx (via auth_request)
• Traefik (via forwardAuth middleware)
• Caddy (via forward_auth plugin)
• HAProxy, Envoy, Skipper

Integration is tight and well-documented. For Docker setups with Traefik, Authelia is up and running in 5 minutes.

Authentik: Three Integration Paths

1. Forward-auth (like Authelia) – via Traefik, Nginx, Caddy
2. Application proxy (outpost) – Authentik provides its own reverse proxy that puts SSO in front of any application
3. Native integration – applications speak OIDC/SAML directly with Authentik

The application proxy is a genuine differentiator: it enables SSO for applications that have zero SSO support – without modifying the application. For businesses with legacy software, this is critical.

Security and Community

Security

Authelia has historically fewer reported security vulnerabilities. This is primarily due to its smaller attack surface: less code, no admin UI, no multi-protocol support. The Go codebase is memory-safe.

Authentik has a broader attack surface due to more features and code. However, the project is professionally maintained by Authentik Security Inc. – with a dedicated security team, regular releases, and a responsible disclosure process.

Community and Development

Authelia has more GitHub stars – a sign of its strong homelab community. Authentik has more contributors and is developed by a company, which guarantees long-term stability and enterprise readiness.

Setup and Operations: YAML vs. Self-Service Portal

Authelia: YAML Configuration

Authelia is configured via a YAML file. Comfortable for developers and self-hosters, but every change requires a file edit and service restart. There's no web UI for configuration.

Authentik: Web UI + Flow Engine

Authentik is configured via a full web dashboard. Flows, policies, providers, and applications are managed graphically. Changes take effect immediately, without restart.

authhost: Managed Authentik Hosting

For those who want to eliminate operations overhead entirely, there's authhost – Managed Authentik Hosting from merkaio:

1. Create account on portal.merkaio.com
2. Deploy instance – choose plan, select region (Germany, Netherlands, USA, Canada, Singapore, Japan, Sydney, or India)
3. Open Authentik dashboard – your dedicated instance is ready
4. Connect applications and onboard users

7 days free trial – own dedicated instance.

Cost Comparison

Authelia: Free, But Operations Overhead

Authelia is free (Apache 2.0). But operations cost:

• Server hosting: ~€20–50/month (VM with PostgreSQL)
• Admin time: 2–4 hours/month for updates, troubleshooting, certificates
• No commercial support for issues

Authentik Self-Hosted: Free or $5/User/Month

The open-source version is free (MIT license). The Enterprise license costs $5/user/month and adds features most SMBs don't need. Operations costs are comparable to Authelia – but with more functionality.

authhost: Flat Rate Without Per-User Fees

All plans: No per-user fees, 8 regions worldwide, 24/7 monitoring, updates and patches included, event logging in all plans.

Cost Comparison: 50 Users, 3 Years

Admin time costs conservatively estimated: 2–4 hours/month × €50/hour.

Decision Guide: When Authelia, When Authentik?

Authelia is the right choice if you:

• Run a homelab or small self-hosting setup with 3–10 applications
• Exclusively use OIDC-capable applications (no SAML, no LDAP needed)
• Need minimal resource usage on a Raspberry Pi or mini PC
• Only need login + MFA in front of a reverse proxy – without centralized user management
• Are comfortable with YAML configuration and don't need enterprise support

Authentik / authhost is the better choice if you:

• Need SAML 2.0 for enterprise SaaS services (Microsoft 365, Salesforce, AWS SSO)
• Need an LDAP server for NAS systems, firewalls, or network devices
• Want SCIM provisioning for automatic on-/offboarding
• Need RADIUS for VPN or WiFi authentication
• Want to deploy an application proxy for legacy apps without SSO support
• Need conditional access with GeoIP, impossible travel, and device posture
• Need centralized user management with flows, policies, and event logging
• Manage more than 20 users and want to minimize operations overhead
• Prefer GDPR-compliant managed hosting in Germany

The Short Formula

Authelia = Auth gateway. It guards the entrance. Authentik = Identity provider. It manages the entire identity.

If you only need an entrance, Authelia is enough. If you need identity management, you need Authentik.

Conclusion

Authelia is an excellent tool for its purpose: a lightweight authentication layer in front of a reverse proxy. For homelabs and small self-hosting setups, it's perfect.

But for businesses – even small ones – Authelia falls short. No SAML means no integration with enterprise SaaS. No LDAP server means no authentication for network devices. No SCIM means manual on-/offboarding. No flow engine means no automation. And a 3-person spare-time project without enterprise support is a risk for business-critical infrastructure.

Authentik offers all of that – as an open-source solution with MIT license. Combined with managed hosting from authhost, businesses get a full identity provider that's ready in minutes, operated at a predictable flat rate, and hosted in certified data centers.

Try it now: Start your own Authentik instance via the merkaio self-service portal – 7 days free.

Recommended reading: Keycloak Alternative for SMBs

Sources

• Authelia – Official Website
• Authelia GitHub Repository (Apache 2.0)
• Authelia Roadmap – SAML 2.0 Planning
• Authelia Roadmap – Overview
• Authentik – Official Website
• Authentik GitHub Repository (MIT)
• Authentik Documentation
• Authentik Features
• Authentik Pricing
• Authentik Version 2026.2 Release Notes
• Cerbos: Authelia vs Authentik 2026
• selfhosting.sh: Authelia vs Authentik Comparison
• House of FOSS: State of Open-Source Identity 2025
• authhost.io – Managed Authentik Hosting