authentik vs Keycloak

Choose authentik if…

• Self-hosters and IT teams who want one identity provider for web apps, LDAP and VPNs
• Covers OIDC, SAML, LDAP, RADIUS and proxy auth in one tool
• Visual flows and Python policies for custom logic

Choose Keycloak if…

• Organisations that want standards-based SSO on their own infrastructure at no licence cost
• You need Linux, macOS and Windows, which authentik doesn't list
• Free and open source under Apache 2.0
• Supports OIDC, OAuth 2.0 and SAML with LDAP and AD federation

What is authentik?

authentik is an open-source identity provider written in Python and Go that you run yourself, usually with Docker Compose or Kubernetes. It acts as an OIDC and SAML provider for modern apps, an LDAP and RADIUS server for older systems and network gear, and a proxy that adds login in front of apps with no authentication of their own. Flows and stages let you design enrolment, login and recovery steps in the admin UI, and policies written in Python allow detailed conditions. It is a favourite in homelab and self-hosting circles as a more approachable alternative to Keycloak, and it is increasingly used by companies too. The open-source edition is free with community support; the Enterprise edition adds features such as remote access, device trust connectors and support, priced per internal user and per external user. Expect to spend some time learning its flow model before it feels natural.

What is Keycloak?

Keycloak is a free, open-source identity server originally started at Red Hat and now a Cloud Native Computing Foundation project. You run it yourself, as a container on Docker or Kubernetes or as a plain Java distribution, and point applications at it over OpenID Connect, OAuth 2.0 or SAML 2.0. It provides single sign-on and sign-out, a login and account console, social login, identity brokering to other providers, user federation with LDAP and Active Directory, fine-grained authorization services, and an admin console for managing realms, clients and users. Because it is standards-based and mature, it is a common choice inside enterprises, governments and universities, and many commercial products embed it. The cost is operational: you handle databases, upgrades, clustering and theme customisation, and the admin UI and configuration model take time to learn. Commercial support is available through Red Hat's build of Keycloak.