{"slug": "authentik", "name": "Authentik", "category": "security", "category_name": "Security and passwords", "description": "", "recommenders": 6, "commenters": 9, "warners": 0, "score": 5.917, "rising": -1.96, "first": "2025-11-13", "latest": "2026-08-01", "why": "I would check out Authentik before commiting to any idP.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 7, "neutral": 4, "compare": 0, "warn": 0}, "spark": [3, 1, 0, 0, 1, 0, 1, 0, 0, 1, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "I would check out Authentik before commiting to any idP.", "kind": "", "icon": true, "domain": "goauthentik.io", "github_repo": null, "official_url": "https://goauthentik.io", "pricing": "", "aliases": ["Authentik", "authentik"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 786120851, "item_id": 49132553, "url": "https://news.ycombinator.com/item?id=49132553", "by": "pelasaco", "date": "2026-08-01", "version": null, "stance": "recommend", "quote": "I deploy it in Kubernetes + Authentik and I am pretty happy with the results.", "excerpt": "said that, i manage a matrix instance in my company for more than 500 users, and everything works just fine. I like their device authorization models, their stack is easy to maintain and update. Everything works flawless. I used to maintain rocket chat in the same order of magnitude and it was a mess. I deploy it in Kubernetes + Authentik and I am pretty happy with the results. Long live to Matrix/Element!", "context": "", "use_case": "authentication for Matrix", "switched_from": "", "story": "A Week in Matrix"}, {"id": 768347507, "item_id": 48021719, "url": "https://news.ycombinator.com/item?id=48021719", "by": "dizhn", "date": "2026-05-05", "version": null, "stance": "recommend", "quote": "or use Authentik's embedded proxy", "excerpt": "My containers run in dedicated \"docker host\" VMs. And I never expose ports on 0.0.0.0, just the private internal IP. Most (all) of my docker hosts do not have a public IP anyway. I use wireguard to access them myself. If they need to be public I reverse proxy with caddy from my web server (or use Authentik's embedded proxy). These servers have access to the same private LAN which could be hardened without having the ", "context": "", "use_case": "Embedded reverse proxy", "switched_from": "", "story": "Should I Run Plain Docker Compose in Production in 2026?"}, {"id": 759376032, "item_id": 47461002, "url": "https://news.ycombinator.com/item?id=47461002", "by": "Howietje", "date": "2026-03-20", "version": null, "stance": "recommend", "quote": "Check out authentik or keycloak?", "excerpt": "Explore alternative scenarios with pros and cons? Check out authentik or keycloak?", "context": "", "use_case": "", "switched_from": "", "story": "Full Disclosure: A Third (and Fourth) Azure Sign-In Log Bypass Found"}, {"id": 742404257, "item_id": 46400266, "url": "https://news.ycombinator.com/item?id=46400266", "by": "ffsm8", "date": "2025-12-27", "version": null, "stance": "recommend", "quote": "I personally use it, as it's so easy to run and integrate with social auth", "excerpt": "There are a lot other identity providers around you can pick from, I merely mentioned it as I personally use it, as it's so easy to run and integrate with social auth - and comes with features such as simple password-less auth. The forward auth/proxy auth is not a keycloak feature, it's a proxy feature, which just need some identity provider. If you look for the mentioned term via Google or AI/llm you will find multi", "context": "", "use_case": "Identity provider", "switched_from": "", "story": "Exe.dev/"}, {"id": 736053776, "item_id": 46003361, "url": "https://news.ycombinator.com/item?id=46003361", "by": "dizhn", "date": "2025-11-21", "version": null, "stance": "recommend", "quote": "It's pretty easy to self host.", "excerpt": "https://goauthentik.io/#comparison They have an enterprise version now (mostly for support and bleeding edge features that later make it into the open source product.) It's pretty easy to self host. I have been doing it for a small site for years and I couldn't even get any other open source solution to work. They are mostly huge with less features.", "context": "Self-hosts it for a small site", "use_case": "Self-hosted SSO", "switched_from": "", "story": "Okta's NextJS-0auth troubles"}]}], "caveats": [], "who": [{"by": "tawman", "context": "Linux user for 30 years", "url": "https://news.ycombinator.com/item?id=46595490", "date": "2026-01-12"}, {"by": "dizhn", "context": "Self-hosts it for a small site", "url": "https://news.ycombinator.com/item?id=46003361", "date": "2025-11-21"}], "tags": [], "use_cases": ["identity provider", "authentication for matrix", "embedded reverse proxy", "endpoint device agent", "self-hosted authentication", "self-hosted sso"], "compared": [{"slug": "ory-kratos", "name": "Ory Kratos", "co": 1, "switched_from": 1, "switched_to": 0}, {"slug": "caddy", "name": "Caddy", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "keycloak", "name": "Keycloak", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [{"id": 761673776, "item_id": 47604611, "url": "https://news.ycombinator.com/item?id=47604611", "by": "fheisler", "date": "2026-04-01", "version": null, "stance": "recommend", "quote": "an open source identity provider with 1M+ unique installations", "excerpt": "Authentik Security | Security Engineer | US | REMOTE (anywhere) | Full-time Authentik Security (https://goauthentik.io) is the company behind authentik (https://github.com/goauthentik/authentik), an open source identity provider with 1M+ unique installations. Help us replace Okta/Auth0, Ping Identity, and Microsoft Entra with modern, secure identity for all! We are a small remote team, looking to scale up with experi", "context": "", "use_case": "", "switched_from": "", "story": "Ask HN: Who is hiring? (April 2026)"}, {"id": 736073488, "item_id": 46004593, "url": "https://news.ycombinator.com/item?id=46004593", "by": "fheisler", "date": "2025-11-21", "version": null, "stance": "recommend", "quote": "Cloudflare moved to us a couple years back", "excerpt": "Thanks for the mention! (Authentik Security CEO here.) We've become something of Okta migration experts at this point... Cloudflare moved to us a couple years back after they had to be the ones to let Okta know it'd been breached yet again. [1] [1] https://blog.cloudflare.com/how-cloudflare-mitigated-yet-another-okta-compromise/", "context": "Authentik Security CEO", "use_case": "identity provider / SSO", "switched_from": "Okta", "story": "Okta's NextJS-0auth troubles"}], "threads": [{"url": "https://news.ycombinator.com/item?id=45963350", "title": "Okta's NextJS-0auth troubles", "mentions": 3}, {"url": "https://news.ycombinator.com/item?id=45915114", "title": "Kratos - Cloud native Auth0 open-source alternative (self-hosted)", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=49130295", "title": "A Week in Matrix", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48121266", "title": "Why I'm leaving GitHub for Forgejo", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47962032", "title": "Should I Run Plain Docker Compose in Production in 2026?", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47885012", "title": "Dear friend, you have built a Kubernetes (2024)", "mentions": 1}], "sentiment_by_month": {"2025-11": {"recommend": 3}, "2025-12": {"recommend": 1}, "2026-01": {"neutral": 1}, "2026-02": {}, "2026-03": {"recommend": 1}, "2026-04": {"neutral": 2}, "2026-05": {"recommend": 1, "neutral": 1}, "2026-06": {}, "2026-07": {}, "2026-08": {"recommend": 1}, "2026-09": {}, "2026-10": {}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 786120851, "item_id": 49132553, "url": "https://news.ycombinator.com/item?id=49132553", "by": "pelasaco", "date": "2026-08-01", "version": null, "stance": "recommend", "quote": "I deploy it in Kubernetes + Authentik and I am pretty happy with the results.", "excerpt": "said that, i manage a matrix instance in my company for more than 500 users, and everything works just fine. I like their device authorization models, their stack is easy to maintain and update. Everything works flawless. I used to maintain rocket chat in the same order of magnitude and it was a mess. I deploy it in Kubernetes + Authentik and I am pretty happy with the results. Long live to Matrix/Element!", "context": "", "use_case": "authentication for Matrix", "switched_from": "", "story": "A Week in Matrix"}, {"id": 769947540, "item_id": 48121721, "url": "https://news.ycombinator.com/item?id=48121721", "by": "eblume", "date": "2026-05-13", "version": null, "stance": "neutral", "quote": "I have authentik (only available on the tailnet) as an IdP", "excerpt": "Yup, I\u2019ve done this. I use a fly.io proxy that runs nginx, fail2ban, and that forwards to my tailnet where Caddy resolves to the actual instance. It\u2019s critical that you disable local registration - I have authentik (only available on the tailnet) as an IdP but you can also just disable reg after making your own account of course. I also have a robots.txt that disables some stuff like all the individual rendered git c", "context": "", "use_case": "Identity provider", "switched_from": "", "story": "Why I'm leaving GitHub for Forgejo"}, {"id": 768347507, "item_id": 48021719, "url": "https://news.ycombinator.com/item?id=48021719", "by": "dizhn", "date": "2026-05-05", "version": null, "stance": "recommend", "quote": "or use Authentik's embedded proxy", "excerpt": "My containers run in dedicated \"docker host\" VMs. And I never expose ports on 0.0.0.0, just the private internal IP. Most (all) of my docker hosts do not have a public IP anyway. I use wireguard to access them myself. If they need to be public I reverse proxy with caddy from my web server (or use Authentik's embedded proxy). These servers have access to the same private LAN which could be hardened without having the ", "context": "", "use_case": "Embedded reverse proxy", "switched_from": "", "story": "Should I Run Plain Docker Compose in Production in 2026?"}, {"id": 766641410, "item_id": 47915088, "url": "https://news.ycombinator.com/item?id=47915088", "by": "subhobroto", "date": "2026-04-26", "version": null, "stance": "neutral", "quote": "I use it with Authentik as the IdP.", "excerpt": "I have a suspicion you're using Headscale? If so, I urge you to consider Ionscale. I use it with Authentik as the IdP. Personally commiting to using Tailscale as a core foundation of my infrastructure and Ionscale is my hedge against getting Hashicorped. > Service discovery is basically just Docker's internal DNS. Caddy-docker-proxy can use it to find healthy upstreams Do you have a writeup of this somewhere? I'm una", "context": "", "use_case": "", "switched_from": "", "story": "Dear friend, you have built a Kubernetes (2024)"}, {"id": 762574192, "item_id": 47660887, "url": "https://news.ycombinator.com/item?id=47660887", "by": "dizhn", "date": "2026-04-06", "version": null, "stance": "neutral", "quote": "since it's an agent running on the target, possibilities will be quite extensive", "excerpt": "My understanding is since it's an agent running on the target, possibilities will be quite extensive. But it is relatively new and there is no stable release of it yet. https://docs.goauthentik.io/endpoint-devices/authentik-agent/", "context": "", "use_case": "endpoint device agent", "switched_from": "", "story": "SSH certificates: the better SSH experience"}, {"id": 759376032, "item_id": 47461002, "url": "https://news.ycombinator.com/item?id=47461002", "by": "Howietje", "date": "2026-03-20", "version": null, "stance": "recommend", "quote": "Check out authentik or keycloak?", "excerpt": "Explore alternative scenarios with pros and cons? Check out authentik or keycloak?", "context": "", "use_case": "", "switched_from": "", "story": "Full Disclosure: A Third (and Fourth) Azure Sign-In Log Bypass Found"}, {"id": 745527842, "item_id": 46595490, "url": "https://news.ycombinator.com/item?id=46595490", "by": "tawman", "date": "2026-01-12", "version": null, "stance": "neutral", "quote": "", "excerpt": "I do the same thing on my Hostinger VPS with Claude even though I have been using Linux 30 years. Just removes the friction and time. I version control the DevOps with git, and even had Claude setup automated backups to my Google Drive via cron. workdir/ \u251c\u2500\u2500 README.md \u251c\u2500\u2500 CLAUDE.md # Claude Code instructions \u251c\u2500\u2500 BACKUP.md # Backup documentation \u251c\u2500\u2500 .gitignore \u251c\u2500\u2500 traefik/ \u2502 \u251c\u2500\u2500 docker-compose.yml \u2502 \u2514\u2500\u2500 config/ \u2502 \u2514\u2500\u2500 ", "context": "Linux user for 30 years", "use_case": "self-hosted authentication", "switched_from": "", "story": "2026 is the Year of Self-hosting"}, {"id": 742404257, "item_id": 46400266, "url": "https://news.ycombinator.com/item?id=46400266", "by": "ffsm8", "date": "2025-12-27", "version": null, "stance": "recommend", "quote": "I personally use it, as it's so easy to run and integrate with social auth", "excerpt": "There are a lot other identity providers around you can pick from, I merely mentioned it as I personally use it, as it's so easy to run and integrate with social auth - and comes with features such as simple password-less auth. The forward auth/proxy auth is not a keycloak feature, it's a proxy feature, which just need some identity provider. If you look for the mentioned term via Google or AI/llm you will find multi", "context": "", "use_case": "Identity provider", "switched_from": "", "story": "Exe.dev/"}, {"id": 736053776, "item_id": 46003361, "url": "https://news.ycombinator.com/item?id=46003361", "by": "dizhn", "date": "2025-11-21", "version": null, "stance": "recommend", "quote": "It's pretty easy to self host.", "excerpt": "https://goauthentik.io/#comparison They have an enterprise version now (mostly for support and bleeding edge features that later make it into the open source product.) It's pretty easy to self host. I have been doing it for a small site for years and I couldn't even get any other open source solution to work. They are mostly huge with less features.", "context": "Self-hosts it for a small site", "use_case": "Self-hosted SSO", "switched_from": "", "story": "Okta's NextJS-0auth troubles"}, {"id": 735984465, "item_id": 45999029, "url": "https://news.ycombinator.com/item?id=45999029", "by": "lq9AJ8yrfs", "date": "2025-11-20", "version": null, "stance": "recommend", "quote": "I use Authentik for SSO in my homelab, fwiw.", "excerpt": "Among the reasons to leave my last job was a CISO and his minion who insisted spending $50k+ on Okta for their b2b customer and employee authentication was a bulletproof move. When I brought it up, they said they didn't have anyone smart enough to host an identity solution. They didn't have anyone smart enough to use Okta either. I had caught multiple dealbreakers-for-me such dubious / conflicting config settings res", "context": "", "use_case": "homelab SSO", "switched_from": "", "story": "Okta's NextJS-0auth troubles"}, {"id": 734729361, "item_id": 45920585, "url": "https://news.ycombinator.com/item?id=45920585", "by": "trollbridge", "date": "2025-11-13", "version": null, "stance": "recommend", "quote": "We switched to Authentik because of this.", "excerpt": "Exactly our experience (poor documentation). We switched to Authentik because of this.", "context": "", "use_case": "", "switched_from": "Ory Kratos", "story": "Kratos - Cloud native Auth0 open-source alternative (self-hosted)"}, {"id": 734700560, "item_id": 45918785, "url": "https://news.ycombinator.com/item?id=45918785", "by": "dizhn", "date": "2025-11-13", "version": null, "stance": "recommend", "quote": "I would check out Authentik before commiting to any idP.", "excerpt": "It might be poor taste to hijack another product's post but I would check out Authentik before commiting to any idP. It recently started to have enterprise only features lately but its licence ensures they are added to the open source product after a set time period. Super nice developer too.", "context": "", "use_case": "identity provider", "switched_from": "", "story": "Kratos - Cloud native Auth0 open-source alternative (self-hosted)"}]}