authentik

What it is

authentik is a self-hostable Identity Provider (IdP) that speaks the protocols you actually need in production: SAML, OAuth2/OIDC, LDAP, SCIM, RADIUS, and proxy-based auth for apps that don't support any of those natively. It positions itself as a Keycloak alternative with a friendlier UI and a stronger focus on flows — a visual/config-driven system for building custom auth sequences (MFA enrollment, conditional access, password recovery) without forking code.

Category-wise it sits in Provisioning: think user lifecycle, SSO brokering, and access policy enforcement across your app fleet, not just "login screen."

Who builds it and why

563 contributors and a Python codebase under active development — last commit July 2026, so this isn't abandoned or coasting. The contributor count suggests a real community beyond a single vendor's engineers, though authentik is also commercially backed (Authentik Security, the company) which funds core development and offers a hosted/enterprise tier. This is the standard open-core model: the OSS project drives adoption, the company monetizes support and hosting.

CNCF maturity: not publicly available — authentik is not a CNCF project, so don't expect that governance signal here.

Production readiness signal

22,185 GitHub stars and 563 contributors is a healthy signal for an identity project — auth infrastructure attracts scrutiny, and this level of engagement suggests real-world battle-testing, not a weekend project. Releases are frequent and calendar-versioned (2026.5.3 format), which tells you the team ships on a schedule rather than sporadically.

The gap: no CNCF maturity data and no founding date given, so you can't easily benchmark its lifecycle against, say, Keycloak's decade-plus track record. Identity providers are the kind of infra where you want to see incident history, CVE response time, and upgrade-path stability documented — none of that is in the data provided here. Check authentik's own security advisories and changelog before trusting it with your crown jewels.

One flag worth raising directly: the license shows as NOASSERTION in repo metadata, meaning GitHub's license detection didn't resolve a clear SPDX identifier from the repo, despite authentik being marketed as open-source. Verify the actual LICENSE file yourself before you build compliance assumptions on top of it.

Who should use this

• Teams that need a single IdP to unify SSO across a mix of legacy (LDAP, RADIUS) and modern (OIDC, SAML) apps without running three different systems.
• Platform teams who want visual flow-builder control over auth UX (custom MFA prompts, conditional branching) without maintaining a Keycloak fork or Spring Security custom code.
• Orgs already running Python-heavy infra who want a stack they can debug and patch in-house.
• Anyone tired of paying per-seat SaaS IdP pricing (Okta, Auth0) for straightforward SSO needs.

Who should NOT use this

• Enterprises requiring FedRAMP/StateRAMP or similar compliance-audited IdPs — authentik doesn't have the certification trail that Okta or Ping Identity carry.
• Teams with zero identity engineering capacity — self-hosting an IdP means you own patching, uptime, and incident response for the single most security-critical piece of your stack. If you can't staff that, use a managed SaaS IdP instead.
• Orgs needing guaranteed enterprise SLAs and legal indemnification without going through authentik's paid tier — vanilla OSS gives you community support only.
• Anyone who hasn't nailed down the actual license terms — given the NOASSERTION flag, legal should sign off before deployment in a commercial product.

Alternatives

• Keycloak — more mature, CNCF-adjacent (Red Hat backed), heavier Java footprint, steeper learning curve but a longer enterprise track record.
• Okta / Auth0 — fully managed SaaS IdP, zero infra burden, but per-seat pricing scales expensively and you lose self-hosting control.
• Zitadel — newer Go-based IdP, similar open-core model, worth evaluating if you want a lighter runtime than Python/Keycloak.

Pricing

Core authentik is open source and free to self-host — no seat limits on the community edition. Authentik Security offers a paid enterprise tier (support SLAs, additional features, hosted option); exact pricing is not publicly available in the data provided — check their site directly for current tiers.