Authelia vs Authentik: Which Self-Hosted SSO Fits Your Stack

Short answer: Choose Authelia if you want a light login and two-factor layer in front of apps behind Traefik, NGINX or Caddy, and your users already live in LDAP or a short YAML file. Choose authentik if you need a full identity provider with SAML, SCIM and a web admin console. The deciding factor is whether any app needs SAML or provisioning.

Authelia and authentik are the two names that come up most in self-hosted single sign-on threads. This comparison is based on each project's documentation, pricing page and published security advisories, all checked September 22, 2026. The non-obvious finding: Authelia still has no SAML provider and no admin dashboard, and both sit on its public roadmap.

Authelia vs authentik at a glance

The table above compares the two on rows drawn from our single sign-on evaluation criteria (protocols, MFA, directory sources, administration, deployment, security record and cost), described on our methodology page. Criteria that do not separate two self-hosted projects, such as a vendor app catalog, are left out.

"Not published" means the project does not state the figure in the documentation we opened. It does not mean the capability is missing.

Choose Authelia if

• Every app you need to protect is a web app served over HTTPS through a supported reverse proxy.
• You already run OpenLDAP, FreeIPA, Active Directory or lldap, or have few enough users to keep in a YAML file.
• Your apps either accept trusted headers or speak OpenID Connect; none of them require SAML.
• You prefer configuration in files and version control over a web admin console.
• You want an Apache 2.0 project with no paid edition to track.

Choose authentik if

• At least one app only supports SAML, or you need to serve LDAP, RADIUS or SCIM to downstream systems.
• You want a built-in user store with a web admin interface for users, groups, tokens and policies.
• You need customizable login and recovery flows rather than a fixed portal.
• You may later want vendor support, Entra ID or Google Workspace integration, or audit features from a paid tier.
• Your host has at least 2 CPU cores and 2 GB of RAM to spare.

Architecture: proxy companion or full identity provider

Authelia and authentik solve different problems, and that difference decides most choices. Authelia describes itself as "a companion of reverse proxies like Traefik" that adds a login portal and authentication functions (Authelia architecture). It connects to the proxy, never to app backends, and only works for sites served over HTTPS.

authentik is a standalone identity provider with three interfaces: a flow interface for customizing login steps, a user interface for app access and an admin interface for users, groups, tokens and policies (authentik docs). It can also act as a forward-auth proxy, so it covers Authelia's main job plus classic IdP work.

Winner: authentik for breadth; Authelia for a narrower, simpler scope. If all you need is a login wall in front of reverse-proxied apps, authentik's extra surface is weight you carry without using.

Protocols and app compatibility

authentik wins clearly on protocol coverage. Its free open source edition lists OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos and proxy support, and it is OpenID Certified for OpenID Connect (authentik pricing).

Authelia supports OpenID Connect 1.0 and trusted-header SSO (Authelia introduction), and its GitHub repository states it is OpenID Certified for the Basic, Implicit, Hybrid, Form Post and Config OP profiles (Authelia on GitHub). A SAML 2.0 provider sits in the "Planning" column of the Authelia roadmap.

Watch out: Some apps offer SAML but not OIDC for SSO. If one of those is on your list, Authelia cannot sign users into it today.

User management and directories

authentik wins for teams without an existing directory. Authelia supports two first-factor backends: LDAP servers such as OpenLDAP, OpenDJ, FreeIPA or Microsoft Active Directory, or a YAML file holding hashed passwords. Its documentation states that "Authelia has no internal registration functionality", so accounts must exist in the backend first (Authelia first factor).

Authelia's roadmap lists both a user dashboard and an administrator control panel and CLI as "Active" work, not yet shipped (Authelia roadmap). Until then, user changes mean editing the YAML file or your LDAP directory.

authentik stores users itself and manages them in its admin interface. Its Enterprise tier adds Google Workspace and Microsoft Entra ID integrations and scheduled user offboarding (authentik pricing).

Two-factor options

Call this a tie on the common methods. Authelia documents one-time passwords, security keys and passkeys, and Duo mobile push, plus identity verification before a user registers a second-factor device and account lockout after repeated failures (Authelia introduction).

authentik handles MFA inside its configurable flows, and its Enterprise tier adds client certificate authentication (mTLS) and a Chrome Enterprise Device Trust connector (authentik pricing). If you need device trust signals, authentik is the only one of the two that lists them.

Deployment, proxies and footprint

Authelia is the lighter choice by design, though neither project publishes a directly comparable resource figure. authentik's Docker Compose guide asks for a host with at least 2 CPU cores and 2 GB of RAM, and the current release series is 2026.8 (authentik Docker Compose install). It also installs on Kubernetes with Helm, AWS CloudFormation and DigitalOcean Marketplace (authentik on GitHub).

Authelia is a Go binary and container. It stores preferences, 2FA secrets and auth logs in SQLite, PostgreSQL or MySQL (Authelia storage), and its minimum host size is not published. Supported proxies are Traefik, Caddy, Envoy, NGINX, NGINX Proxy Manager, SWAG, HAProxy, Skipper, Traefik 1.x, Apache and IIS (Authelia supported proxies).

Admin tip: Authelia's supported-proxies page includes a feature matrix per proxy, so check your proxy's row for Kubernetes and XHR redirect support before you commit.

Pricing compared

Authelia is free under the Apache 2.0 license and publishes no paid edition or support plan. authentik's open source edition is free; Enterprise costs $5 per user per month billed annually, plus $0.02 per external user per month, and Enterprise Plus starts at $20,000 a year (authentik pricing).

Authelia vs authentik annual license cost by user count, list prices checked September 22, 2026. Excludes external users, hosting and staff time.

The price only matters if you need Enterprise features: Entra ID and Google Workspace sync, enhanced audit logging, privileged access management, CSV reports or ticket support. authentik offers ticket-based support only on subscriptions over $1,000 a year, which means roughly 17 or more internal users on Enterprise.

The fine print compared

The authentik split matters for planning. Features such as Entra ID integration, mTLS and enhanced audit logging sit behind the paid license, so a proof of concept on the free edition may not show them (authentik pricing).

Security record compared

Both projects disclose advisories publicly and list patched releases. The table shows a selection: authentik published 24 advisories from January 1 to September 22, 2026, 20 of them rated High or Critical (authentik advisories), against 3 Low or Moderate advisories for Authelia. authentik's larger feature surface (SAML, LDAP, RADIUS, flows) carries more code to secure, so plan to track its releases closely. Authelia's last High-rated advisory on GitHub, an authentication bypass with malformed request URIs on NGINX, dates to May 28, 2021. Neither project publishes an uptime figure, which is expected for self-hosted software.

Switching between Authelia and authentik

Neither project documents a migration tool in the pages we opened. The practical path is short either way, because Authelia holds little state of its own: users live in LDAP or a YAML file, so moving to authentik means pointing authentik at the same LDAP directory or importing users, then re-registering second factors.

What does not migrate: 2FA device registrations, OIDC client definitions, access control rules and proxy middleware configuration. Each has to be rebuilt, and every app's OIDC client ID and secret updated. Moving from authentik to Authelia also means dropping any SAML, SCIM, RADIUS or LDAP-provider integrations, since Authelia does not offer them.

Which to pick for your scenario

When neither fits

If you need a larger, standards-heavy IdP with a long enterprise track record, Keycloak is the usual third option in self-hosted threads; if you would rather not host anything, start from the single sign-on software hub and compare managed providers.

Bottom line

If every app you protect sits behind a reverse proxy and speaks OIDC or trusted headers, run Authelia against your existing LDAP and keep the stack small. If any app needs SAML, or you need provisioning, a user console or a paid support path, authentik is the one that covers it. The verdict flips toward authentik the day a SAML-only app lands on your list.

To score both against your own requirements, use the SSO shortlist builder.