authentik and the six-dollar front door

Fifty people, one login, every tool they touch. Okta sells you that for six dollars per person per month on its cheapest Starter tier, with a fifteen hundred dollar annual contract minimum sitting underneath it, which puts a fifty-person company at roughly $3,600 a year. Microsoft does it for seven dollars a head on Entra ID P1, so $4,200. Neither number covers what your other vendors charge you for the privilege of plugging in. authentik is the MIT-licensed identity provider that does the same job on an eighteen-dollar server, and the release that went to beta on Monday is the first version of it the OpenID Foundation has formally certified.

That last bit is why this is worth an afternoon rather than a star.

What actually shipped on Monday

authentik has been around long enough to be boring, which in identity software is the highest compliment on offer. It speaks OIDC, SAML, LDAP, SCIM, RADIUS and Kerberos, and it ships a reverse proxy for the applications that speak none of those. 23,300 stars, 1,800 forks, and if you open the commit log today you will find commits from today. Not a museum piece.

The 2026.8 release notes went up as a preview on August 3 alongside the first release candidate. The headline for a small business is not any single feature. It is the line stating that authentik is now OpenID Certified for both provider profiles and logout profiles. Certification is a conformance test, not a security audit, and it does not mean the software is safe. What it means is that when your payroll vendor's support desk asks whether your identity provider is standards compliant, there is now a document with somebody else's name on it. That question has killed more self-hosted SSO projects than any technical problem ever has.

Underneath the certification, the release adds privileged access management, so a person can request temporary access to an application and have that access expire on its own instead of living forever. User switching, so somebody holding an admin account and a normal account can keep both signed in. Scheduled user offboarding, where you set a date and authentik deactivates the account and revokes its sessions and tokens on that date without anybody having to remember. Custom object attributes on users and groups, with validation. Token exchange between trusted providers. The server entrypoint and the proxy outpost were rewritten from Go into Rust, which the maintainers are careful to say changes nothing yet and is groundwork.

Then there are thirty-odd new integration guides, most of them written by contributors, covering HubSpot, n8n, NocoDB, Notion, Plane, ToolJet, Appsmith, Coolify, Directus and Stirling PDF. Read that list again. That is not a list of enterprise software. That is a list of what a competent ops person builds their week out of.

Current stable is 2026.5.6, from July 22. 2026.8 is beta. Run the stable one and read the beta notes.

The bill you are actually replacing

Be precise here, because this is the exact spot where the free-software pitch usually cheats.

What goes away is the identity provider subscription, and only that. Okta Starter at $6 a user gets you single sign-on, multi-factor and a directory. Their Essentials tier, which is the one you get steered toward the moment you say the word "offboarding," is $17 per user per month, or $14 for the stripped-back Core Essentials. At fifty people, Essentials is $10,200 a year. Entra ID P1 at $7 is $4,200, P2 at $10 is $6,000, and the full Entra Suite at $12 is $7,200. Those are the numbers authentik takes to zero.

What does not go away is the SSO tax, and anyone who tells you otherwise is selling something. The wall of shame is a running list of vendors who gate single sign-on behind a higher plan, and the premiums are not shy. Notion goes from $8 a seat to $15. Figma from $12 to $45. GitHub from $4 to $21. Monday.com from $7 to $27. Airtable from $10 to $60. HubSpot Marketing from $15 a user to a $50 monthly floor. n8n goes from $60 a month to $960. You pay every one of those whether the identity provider on the other end of the connection cost you six dollars a head or nothing at all, because the charge sits on their side of the wire.

So swapping Okta for authentik saves you the Okta bill. It does not save you the Figma bill. Anybody building a business case that quietly folds the second number into the first is going to have an uncomfortable meeting in month two.

Which is why the honest version of the case is not "replace Okta." It is narrower, and it is better.

The part with no vendor and no tax on it

Here is where this repo gets genuinely interesting for the reader who has spent the last year building things.

That same ops person who could never get engineering to prioritize anything has quietly shipped three or four internal tools by now. A dashboard. A pricing calculator. A form that writes into the CRM. They work, they live at a URL, and a fair number of them have no login on them whatsoever, or one shared password pinned in a Slack channel, because authentication is the boring part and nobody wanted to build it four separate times.

authentik's proxy provider puts a real login in front of all of them without touching a line of their code. Your reverse proxy asks authentik whether this request is allowed, and authentik hands the application back a set of headers naming the user, their email address and the groups they belong to. The tool you built on a Friday afternoon now knows who is looking at it, and can be told which groups are allowed to. Domain-level forward auth covers everything under one hostname from a single configuration, which is the mode most small setups want.

There is no upcharge on that, because there is no vendor. You are the vendor. The SSO tax exists because a software company worked out that you had nowhere else to go; on something you built yourself, nobody is standing in that position.

It also fixes offboarding for precisely the assets that are worst at it. When somebody leaves, the SaaS accounts get killed because they show up on an invoice and somebody in finance is looking at the invoice. The internal tool with the shared password does not show up anywhere, and it keeps working for the person who left until the day somebody thinks to check.

The honest take

Setup. If you are comfortable in a terminal, the base install is an afternoon. The documented path is a host with two cores and 2GB of memory, a compose file you download, two secrets you generate with openssl, and one docker compose up -d. There is a DigitalOcean one-click image if you would rather skip the terminal entirely, and it works, but be clear on what it hands you: a running authentik sitting at a login screen. It does not hand you a configured identity provider. Every application you connect after that is its own twenty to sixty minutes of reading a guide, creating a provider, pasting metadata into somebody else's admin panel, and discovering that their SAML implementation has opinions. Ten applications is a real week's work, spread across three.

Hosting. The documented minimum runs $18 a month for a two-core, 2GB droplet, and DigitalOcean's own example provisions the 4GB size at $24. Add backups at twenty percent of the droplet, a domain, and a certificate that renews itself. Call it $300 a year with everything. Against $3,600 that is not a close call, and the arithmetic is honestly the least interesting part of this decision.

A month of actually running it. Quieter than you would expect, most months. authentik ships a feature release roughly quarterly with patch releases in between, so there is one upgrade cycle to sit down for, and the upgrade has a rule you cannot skip: the instance and every outpost have to end up on the same version. Beyond that it is the helpdesk work that used to belong to a vendor. Somebody loses the phone with their authenticator on it and needs an admin to reset the enrollment. A contractor needs access to two applications and not the other nine. Small, frequent, and now yours.

What the free tier does not do. The open-source tier is genuinely capable, and the list of what sits behind the $5-per-user Enterprise line is worth reading before you commit, because it is pointed. Google Workspace and Entra ID integrations. Enhanced audit logging for compliance. Client certificate authentication. Exportable CSV reports. Ticket-based support. And the scheduled offboarding that 2026.8 just shipped. Which means the free version is the one where offboarding is a human being remembering to do it. That is a sharp place to put a paywall, because offboarding is the single strongest argument for having single sign-on in the first place. At fifty users, $5 a head is $3,000 a year, and you are suddenly back within shouting distance of Okta Starter. Read that pricing page while you are building the business case, not after.

Then the part nobody writes down. Open the security advisories on the repo. Ten are public, two rated critical and several rated high, published in batches in May and July of this year. The titles do not make for soothing reading: account takeover via SAML NameID comment truncation, XML signature wrapping that allowed authentication as an arbitrary federated user, a stage bypass triggered by an empty POST.

Do not read that as an argument against the software. A project that finds, fixes and publicly documents its own authentication bypasses on a schedule is behaving exactly the way you want your front door to behave, and the closed vendors in this category have had considerably worse years in public. Read it instead as an argument about who does the work. When Okta patches a hole like that, you find out afterward or you never find out at all, and the fix lands while you are asleep. When authentik patches one, somebody at your company has to notice the release, read the notes, and upgrade the instance and every outpost to matching versions. On a deadline. Forever. That is a standing obligation attached to a named person, and it is the real price of the free tier. It has never once appeared on a comparison chart.

Who owns it. Authentik Security Inc., built on work copyrighted to Jens Langhammer, funded the ordinary open-core way with a paid tier on top of an MIT core. If the company disappears tomorrow you keep the code, which is the reassurance people usually reach for. You do not keep the patches. For a login server, the patches are the product.

And the failure mode, which is genuinely unlike anything else this series has covered. A self-hosted project board going down is an irritating morning. A self-hosted chat server going down means everyone uses text messages for a day. The identity provider going down means nobody can get into anything at all, including the admin panel you would need to fix it. So there is a plain test, and it is not about your technical ability. If the login server fell over at six on a Saturday morning, would somebody notice inside an hour, and would that person know what to do? If the answer is no, pay Okta. That is not losing your nerve. That is what the six dollars was always for.

The pitch for self-hosting is usually that you stop renting the software. With identity, that is not quite what is going on. You were never really renting the software. You were renting somebody to be awake when the front door breaks. authentik hands you the door for nothing, and the lock, and the hinges, and three in the morning.