Alternatives to authentik

Self-hosted identity provider for single sign-on and application access control. The listings below can replace it for an important use case. Each note says what changes if you switch.

Replacements

Listings that take over the same core job as authentik.

  • Keycloak

    A self-hosted identity and access management server that adds single sign-on and login to applications.

    FreeOpen sourceSelf-hosted

    Keycloak is an Apache-2.0 identity server offering OpenID Connect, SAML 2.0 brokering and LDAP or Active Directory connections, without a paid enterprise edition, but with real setup effort.

  • Zitadel

    An open-source identity and access management platform with SSO, MFA and a hosted login page.

    FreemiumOpen sourceWebSelf-hosted

    Zitadel is a freemium, API-first identity platform with SDKs, multi-tenancy and a customisable hosted login page, aimed at developers building identity into their own applications.

  • Authelia

    Self-hosted single sign-on and two-factor portal for reverse proxies.

    FreeOpen sourceLinuxWebSelf-hosted

    Authelia is a lighter SSO and two-factor portal placed in front of a reverse proxy, configured through a large YAML file rather than a flow builder, and fully Apache-2.0 licensed.

  • Pocket ID

    Small OpenID Connect provider that signs users in with passkeys only.

    FreeOpen sourceWebSelf-hosted

    Pocket ID is a much simpler OpenID Connect provider using passkeys only, with no LDAP, SAML or password fallback, suited to a handful of applications.

  • Casdoor

    A self-hosted identity and access management server with single sign-on, MFA and a web interface.

    FreeOpen sourceWebSelf-hosted

    Casdoor supports OAuth, OIDC, SAML, CAS, LDAP and SCIM with WebAuthn and TOTP MFA and a web management UI.

  • Pomerium

    An identity-aware reverse proxy that gives secure access to internal applications without a VPN.

    FreemiumOpen sourceSelf-hosted

    Pomerium is an identity-aware reverse proxy for access to internal apps, working with any OIDC identity provider.

Similar software

Related functionality, not a direct replacement.