Authelia vs authentik

Authelia and authentik both end the "one password per app" problem, but they attack it from opposite ends. Authelia is a single Go binary that sits beside your reverse proxy and answers one question for every request: is this person allowed through? authentik is a full identity provider — it issues tokens, speaks SAML, keeps its own user directory, and runs a Python, Go, and TypeScript stack with a worker and PostgreSQL behind it. Both give you SSO. Only one of them gives you an IdP, and only one of them fits in 256 MB.

Forward auth vs. a real identity provider

Authelia's model is forward authentication. Your reverse proxy — Traefik, nginx, Caddy — is configured to ask Authelia about each incoming request before serving it. If there's no valid session, Authelia shows its own portal, checks the password and second factor, and sends the visitor back. The app behind the proxy never learns any of this happened; it just receives traffic that has already been vetted, plus headers naming the user. That is why Authelia works in front of software that has no login system worth speaking of, and why it needs almost nothing from the app itself.

authentik does that too — it ships a proxy provider for exactly this case — but forward auth is one feature among many rather than the whole product. Its centre of gravity is being the thing your apps federate with: an OIDC and OAuth2 provider, a SAML identity provider, an LDAP outpost, a user directory with enrollment and recovery flows, and a visual flow builder for assembling login steps. Apps that already know how to do SSO talk to authentik natively and get real identity — group membership, claims, consent — instead of a header.

The footprint gap is not marginal

This is the number that decides most of these matchups. Authelia's realistic floor is 256 MB of RAM for one process, with an optional Redis if you want sessions to survive a restart and a SQLite or Postgres file for state. authentik's floor is 2 GB, and that figure is honest: the official Compose file brings up a server, a background worker, and PostgreSQL, and none of those three are optional. On a small VPS already running the apps you're trying to protect, that difference is the difference between "SSO rides along for free" and "I need a bigger box."

Measured idle at first boot on a fresh instance backs this up directly: Authelia settles at ~30 MB, authentik at ~516 MB — both well under their documented "realistic floor" figures above (which assume real traffic and warmed caches, not an empty box), but the roughly 17x gap between them tracks the one-binary-vs-three-services split exactly.

For homelab vs. for teams

For a homelab, this is rarely a close call. One person, a handful of self-hosted apps behind Traefik or Caddy, and the goal is "stop typing passwords, add a second factor." Authelia's 256 MB (measured ~30 MB idle), one-binary, git-tracked-config model fits that exactly, and there's no admin console to secure because there isn't one.

For a team, the calculus flips. Once more than one person needs to manage who has access to what — onboarding, offboarding, group-based rules, apps that speak OIDC or SAML natively rather than sitting behind a proxy — authentik's user directory, enrollment flows, and web admin UI stop being overhead and start being the actual job. Paying 2 GB (measured ~516 MB idle) and three containers is the cost of that, not a tax on top of it.

Both rate 3 out of 5 to deploy, which surprises people. Authelia is one binary, but its configuration is a YAML file where you hand-write access-control rules, session settings, notifier config, and the exact proxy integration for your particular proxy — a small surface with sharp edges. authentik has more services, but the Compose file starts them for you and everything after that happens in a web UI. Neither is a five-minute install; they're hard in different places.

Configuration: a file you own vs. a UI you click

Authelia is configured in YAML, and that is a genuine feature if you keep your infrastructure in git. Users can live in a flat file with hashed passwords or in an existing LDAP directory; access rules are declarative, versioned, and reviewable. There is no admin console to secure because there is no admin console. The cost is that every change is an edit-and-reload cycle, and rules get fiddly once you're expressing per-group, per-path policies for a dozen services.

authentik's admin interface is the product. Flows — password, MFA, consent, enrollment, external IdP hand-off — are assembled visually, applications are registered through forms, and non-engineers can reasonably be given a scoped admin role. If SSO is something more than one person will operate, that matters more than it sounds.

Licensing and what you actually get free

Authelia is Apache-2.0 with no commercial tier: what you clone is what exists. authentik is MIT at the core but follows an open-core model — the free edition covers OIDC, SAML, LDAP, MFA, flows, the proxy provider, and browser-based RDP/SSH access, while an enterprise tier adds Google Workspace and Entra ID sync, device-trust and compliance features, and support. For a self-hoster, the free edition is not a crippled version; the gated features are the ones a company with a compliance department wants.

Which one belongs on your server

If your list is "gate my six self-hosted services behind one login with TOTP or WebAuthn," Authelia wins on every axis that matters and the argument is not close: less RAM, fewer processes, no database to back up beyond a small state file, and a config you can diff. If your list contains the words SAML, LDAP, or "give the team accounts," Authelia will fight you and authentik will not.

The trap is picking authentik for a job Authelia does, then paying 2 GB and three containers forever to gate three apps. The opposite trap is picking Authelia and discovering six months later that the tool you wanted to add only speaks OIDC — Authelia can be an OIDC provider too, but that is the edge of its scope, not its centre.

Pick authentik if…

• You need a real IdP: OIDC, SAML, and LDAP for apps that speak them.
• You want a user directory with enrollment, recovery, and group claims rather than a YAML file of hashes.
• More than one person will operate SSO, and a web admin UI is worth the extra services.

Pick Authelia if…

• All you need is SSO and MFA in front of a reverse proxy, and the apps behind it don't do logins.
• Footprint decides it — 256 MB and one binary versus 2 GB and three containers.
• You want your access rules in git, declaratively, with no console to secure.

Proxy integration

Both are forward-auth-shaped tools that need a reverse proxy in front of them to actually gate anything — neither runs standalone as your edge server.

Whichever you pick, budget time for the proxy config, not just the auth service — that's usually where a first setup actually gets stuck.

Who should pick neither

If your whole requirement is "let a couple of self-hosted apps use passkey login without a password," both of these are heavier than the job. Authelia still needs a reverse-proxy integration and configuration file; authentik is a full identity provider. Pocket ID is a simple, self-hostable OIDC provider built specifically for passkey-only sign-in on small self-hosted setups — no forward-auth wiring, no flow builder, just an OIDC endpoint your apps log into directly — see Pocket ID vs. Authelia for how it stacks up against Authelia.

Choosing between authentik and Authelia

Start from the other direction and the decision is the same one, restated: does more than one person need to administer identity, and do any of your apps need to speak OIDC, SAML, or LDAP natively? If yes, authentik's directory and protocol depth are worth its 2 GB (measured ~516 MB idle) and three services. If the honest answer is "just me, a proxy, and a login screen," Authelia's 256 MB (measured ~30 MB idle) single binary does the same job for a fraction of the machine.