[{"data":1,"prerenderedAt":85},["ShallowReactive",2],{"seo-verification":3,"marketplace-app-en-authentik":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"slug":7,"name":8,"description":9,"phase":10,"docsUrl":11,"logo":12,"github":12,"tagline":13,"longDescription":14,"features":15,"useCases":23,"steps":33,"faq":49,"specs":68,"compatibleOs":76,"relatedApps":77,"relatedPosts":78,"category":79},"authentik","Authentik","Open-source self-hosted identity platform: manage users, SSO, OIDC\u002FSAML, passkeys and custom authentication flows — an Auth0 and Okta alternative on your VPS.",1,"https:\u002F\u002Fservorbit.com\u002Fblog\u002Fself-host-authentik-vps",null,"Self-hosted Auth0 alternative — full IdP with OIDC, SAML, LDAP, passkeys and a visual flow editor.","Authentik is a full-stack, open-source Identity Provider (IdP) built in Python\u002FGo (Apache 2.0, ~22 k GitHub stars, v2026.5). It gives you everything a modern identity platform needs: user management with a self-serve portal, OIDC\u002FOAuth2, SAML 2.0, LDAP proxy, RADIUS, passkeys\u002FWebAuthn, and a unique visual flow editor that lets you design any authentication journey without writing code.\n\nDeployed on a ServOrbit VPS, Authentik replaces cloud-hosted services like Auth0, Okta and Azure AD for small teams and developers who want full sovereignty over their user data. The stack is intentionally lean: since v2025.10 it runs without Redis — just a PostgreSQL 16 database alongside two lightweight Python containers (server and worker). The admin console lets you create applications, define OIDC\u002FSAML integrations, manage groups and permissions, and monitor every login event from one place.\n\nWith Authentik as your IdP, you can wire up Single Sign-On across your entire self-hosted stack — Gitea, Nextcloud, Mattermost, Grafana, Docmost — using OIDC in a few clicks. One login, one user directory, all your apps.",[16,17,18,19,20,21,22],"OIDC\u002FOAuth2 provider — add SSO to any OIDC-compatible app in your stack with a single integration","SAML 2.0 IdP — integrate enterprise SaaS apps that require SAML without a paid identity vendor","LDAP proxy — expose your user directory via LDAP so legacy apps can authenticate against Authentik","Passkeys & WebAuthn — offer Touch ID, Face ID and FIDO2 hardware keys as second factor","Visual flow editor — design multi-step auth flows (MFA prompts, email verification, captcha) with a drag-and-drop canvas","Self-serve user portal — users manage their own password, MFA devices and social connections","Lean stack — PostgreSQL 16 + server + worker, no Redis since v2025.10, under 512 MB RAM at idle",[24,27,30],{"title":25,"body":26},"Centralise logins across a self-hosted stack","Configure Authentik as an OIDC provider once and connect Gitea, Nextcloud, Mattermost, Docmost and Grafana. Users log in once and are automatically authenticated in every connected app. Revoke access for a departing team member in one place — no app-by-app cleanup.",{"title":28,"body":29},"Replace Auth0 or Okta in a SaaS product","Embed Authentik as the IdP behind your product's login flow using OIDC. You control the user database, the token lifetimes and the MFA policies. No per-MAU pricing, no vendor lock-in, no data leaving your infrastructure.",{"title":31,"body":32},"Add SSO and MFA to internal tools","Put Authentik in front of Grafana dashboards, Dockge admin panels or any internal web app. Define access policies per group, enforce passkey MFA for sensitive tools, and get a full audit log of every login and token event.",[34,37,40,43,46],{"title":35,"body":36},"Order a ServOrbit VPS","A 2 GB RAM VPS on Ubuntu 24.04 is the recommended minimum. Authentik's server and worker idle under 400 MB, but PostgreSQL adds another 200 MB and the admin UI can spike during heavy use. A domain name is required — OIDC callbacks and session cookies need HTTPS with a valid FQDN.",{"title":38,"body":39},"Point your subdomain","Create an A record pointing your chosen subdomain (e.g. `auth.yourdomain.com`) to the VPS IP. The ServOrbit reverse proxy handles TLS automatically with Let's Encrypt via DNS-01.",{"title":41,"body":42},"Deploy Authentik from the marketplace","Select Authentik in the ServOrbit Marketplace. The provisioning job deploys the Compose stack (PostgreSQL 16 + server + worker), generates the secret key and admin password, and starts the service. The admin console is available at `https:\u002F\u002Fauth.yourdomain.com\u002Fif\u002Fadmin\u002F` within 60–90 seconds.",{"title":44,"body":45},"Log in and create your first application","Sign in as `akadmin` with the password set during deployment. Go to **Applications → Providers** and create an OIDC provider for your first app (Gitea, Nextcloud, etc.). Copy the Client ID and Secret to the app's OAuth settings, set the redirect URI, and save. SSO is live.",{"title":47,"body":48},"Enrol MFA and invite users","In **Directory → Users**, create accounts for your team or configure an LDAP\u002FSCIM import. Under **Flows → Enrollment**, design your MFA flow: add a WebAuthn stage for passkeys or a TOTP stage for authenticator apps. Users complete enrolment through the self-serve portal on their first login.",[50,53,56,59,62,65],{"q":51,"a":52},"What is the difference between Authentik and Authelia?","Authelia is a lightweight forward-auth proxy that sits in front of your apps and adds MFA without touching them — it has no user management console and stores sessions in Redis. Authentik is a full Identity Provider with its own user directory, admin console, OIDC\u002FSAML\u002FLDAP support and a visual flow editor. Use Authelia to quickly add MFA to existing apps; use Authentik when you need a proper IdP with user lifecycle management and SSO.",{"q":54,"a":55},"How much RAM does Authentik need?","The server and worker containers together idle around 300–400 MB. PostgreSQL 16 adds ~150 MB. A 1 GB VPS is the absolute minimum; 2 GB is recommended for a smooth admin experience and moderate user load. Authentik dropped its Redis dependency in v2025.10, so no extra memory is needed for a cache layer.",{"q":57,"a":58},"Does Authentik require a domain name?","Yes. OIDC callbacks, SAML assertions and session cookies all require HTTPS with a valid, publicly resolvable FQDN. ServOrbit provisions a TLS certificate via Let's Encrypt automatically as long as your domain's DNS A record points to the VPS.",{"q":60,"a":61},"Which apps can I connect to Authentik via SSO?","Any app that supports OIDC\u002FOAuth2 or SAML 2.0. Common examples from the ServOrbit marketplace: Gitea, Nextcloud, Mattermost, Docmost, Grafana, Dockge and Metabase. Authentik ships pre-built integrations for dozens of popular apps and lets you create custom OIDC\u002FSAML providers for any other app.",{"q":63,"a":64},"Can I import existing users from LDAP or a CSV?","Yes. Authentik supports LDAP source sync — pull users from an existing Active Directory or OpenLDAP with scheduled synchronisation. For CSV imports, use the REST API or the admin-console bulk-import tool. Users can also self-register via customisable enrollment flows.",{"q":66,"a":67},"Is Authentik suitable for a small team or a single developer?","Absolutely. Authentik is widely used on personal homelabs and small teams of 2–20 users. The Community Edition (Apache 2.0) is fully featured for these use cases. The Enterprise edition adds RBAC, support SLA and advanced features for larger organisations, but it is entirely optional.",{"ram":69,"cpu":70,"stack":71,"port":75},"1 GB (2 GB recommended)","1 vCPU",[72,73,74],"Docker","Python","PostgreSQL 16","9000",[],[],[],{"key":80,"slug":81,"name":82,"objective":83,"icon":80,"color":84},"security","cybersecurity","Cybersecurity & Bastion","Harden infrastructure security.","text-red-400 bg-red-500\u002F10",1785714049592]