#17 in Identity & Access ManagementUpdated 2026-08

authentik

by Authentik · Self-hosted open source identity provider for single sign-on

45.9 — BenchRank score out of 100

Homepage
Pricing page

Visit website See full Identity & Access Management ranking

Overview

authentik is a self-hosted, open source identity provider covering authentication, enrolment and self-service for applications. It supports OIDC, SAML2, LDAP, SCIM, RADIUS and Kerberos, plus an application proxy and web-based RDP/SSH access. Deployment uses Kubernetes, Terraform or Docker Compose, and flows can be customised through templates, policies and APIs.

Best for: Teams that want to self-host single sign-on and keep identity data off third-party services.
Pricing: Open source tier is free; Enterprise is $5 per user per month plus $0.02 per external user, billed annually; Enterprise Plus starts at $20,000 annually.
Runs on: Self-hosted

Strengths and trade-offs

Strengths

Self-hosted OIDC, SAML2, LDAP, SCIM, RADIUS and Kerberos
Free open source tier covering B2B and B2C use cases
Deploys with Kubernetes, Terraform or Docker Compose
Web-based RDP/SSH access and application proxy included

Trade-offs

Open source tier has no support, only a community Discord
Google Workspace and Entra ID integrations are Enterprise-only
Enterprise is billed annually; no monthly billing option shown
FIPS compliance requires Enterprise Plus, from $20k a year

Pricing

Published plans from authentik’s own pricing page, in USD. Usage charges and add-ons may apply on top.

authentik pricing tiers, monthly and annual rates in USD
Plan	Monthly	Annual (per month)	Includes
Open Source	—	—	OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos and Proxy OpenID Certified for OpenID Connect Web-based RDP/SSH access; B2B and B2C use cases Community Discord only, no support
Enterprise	—per user per month, billed annually	$5	Everything in Open Source, plus Google Workspace and Entra ID integrations Client certificate authentication (mTLS) and Radius EAP-TLS Enhanced audit logging, password history checks, CSV reports Ticket-based support for subscriptions over $1k; $0.02 per external user per month
Enterprise Plus	Contact sales	—	Everything in Enterprise, plus invoice billing Dedicated support with SLAs and volume discounts Multi-instance deployment support FIPS compliance for FedRAMP requirements

How this score is made up

Each dimension is scored out of 100 and combined into the headline score using fixed weights.

MCP support: 0 out of 100
API quality: 10 out of 100
Documentation: 60 out of 100
Agent friendliness: 70 out of 100
Pricing transparency: 85 out of 100
Changelog: 100 out of 100
Marketing site structure: 55 out of 100
Operational trust: 35 out of 100

Measured, but not part of the score

Useful to know, but not a mark for or against the product — so these do not affect the ranking.

Openness: 55 out of 100
Maintenance: 100 out of 100

This doesn’t look right — report a problem with authentik’s score

Alternatives in Identity & Access Management

Ranked 1
75.9 — BenchRank score out of 100
Ory
Ory · API-first identity and access management, self-hosted or managed
Best for: Engineering teams wanting API-first identity and access management they can self-host or buy as SaaS
Ranked 2
73.8 — BenchRank score out of 100
Logto
Logto · Open-source auth infrastructure with SSO, RBAC and multi-tenancy
Best for: Developers adding auth, enterprise SSO and multi-tenancy to SaaS or AI apps without building it
Ranked 3
73.1 — BenchRank score out of 100
Hexclave
Hexclave · Open-source auth, payments, email and analytics building blocks
Best for: Startups wanting auth, payments, emails and analytics as one open-source, self-hostable platform.