Authelia vs authentik
Pick authentik when you need a real identity provider — OIDC, SAML, and LDAP for the apps that speak them, a built-in user directory, and a web admin UI more than one person can operate. Pick Authelia when all you want is SSO and MFA in front of a handful of self-hosted apps behind your reverse proxy: one Go binary, 256 MB, and access rules you keep in git.
Side by side
Authelia and authentik both end the "one password per app" problem, but they attack it from opposite ends. Authelia is a single Go binary that sits beside your reverse proxy and answers one question for every request: is this person allowed through? authentik is a full identity provider — it issues tokens, speaks SAML, keeps its own user directory, and runs a Python, Go, and TypeScript stack with a worker and PostgreSQL behind it. Both give you SSO. Only one of them gives you an IdP, and only one of them fits in 256 MB.
Forward auth vs. a real identity provider
Authelia's model is forward authentication. Your reverse proxy — Traefik, nginx, Caddy — is configured to ask Authelia about each incoming request before serving it. If there's no valid session, Authelia shows its own portal, checks the password and second factor, and sends the visitor back. The app behind the proxy never learns any of this happened; it just receives traffic that has already been vetted, plus headers naming the user. That is why Authelia works in front of software that has no login system worth speaking of, and why it needs almost nothing from the app itself.
authentik does that too — it ships a proxy provider for exactly this case — but forward auth is one feature among many rather than the whole product. Its centre of gravity is being the thing your apps federate with: an OIDC and OAuth2 provider, a SAML identity provider, an LDAP outpost, a user directory with enrollment and recovery flows, and a visual flow builder for assembling login steps. Apps that already know how to do SSO talk to authentik natively and get real identity — group membership, claims, consent — instead of a header.
The footprint gap is not marginal
This is the number that decides most of these matchups. Authelia's realistic floor is 256 MB of RAM for one process, with an optional Redis if you want sessions to survive a restart and a SQLite or Postgres file for state. authentik's floor is 2 GB, and that figure is honest: the official Compose file brings up a server, a background worker, and PostgreSQL, and none of those three are optional. On a small VPS already running the apps you're trying to protect, that difference is the difference between "SSO rides along for free" and "I need a bigger box."
Both rate 3 out of 5 to deploy, which surprises people. Authelia is one binary, but its configuration is a YAML file where you hand-write access-control rules, session settings, notifier config, and the exact proxy integration for your particular proxy — a small surface with sharp edges. authentik has more services, but the Compose file starts them for you and everything after that happens in a web UI. Neither is a five-minute install; they're hard in different places.
Configuration: a file you own vs. a UI you click
Authelia is configured in YAML, and that is a genuine feature if you keep your infrastructure in git. Users can live in a flat file with hashed passwords or in an existing LDAP directory; access rules are declarative, versioned, and reviewable. There is no admin console to secure because there is no admin console. The cost is that every change is an edit-and-reload cycle, and rules get fiddly once you're expressing per-group, per-path policies for a dozen services.
authentik's admin interface is the product. Flows — password, MFA, consent, enrollment, external IdP hand-off — are assembled visually, applications are registered through forms, and non-engineers can reasonably be given a scoped admin role. If SSO is something more than one person will operate, that matters more than it sounds.
Licensing and what you actually get free
Authelia is Apache-2.0 with no commercial tier: what you clone is what exists. authentik is MIT at the core but follows an open-core model — the free edition covers OIDC, SAML, LDAP, MFA, flows, and the proxy provider, while an enterprise tier adds remote access, risk detection, and support. For a self-hoster, the free edition is not a crippled version; the gated features are the ones a company with a compliance department wants.
Which one belongs on your server
If your list is "gate my six self-hosted services behind one login with TOTP or WebAuthn," Authelia wins on every axis that matters and the argument is not close: less RAM, fewer processes, no database to back up beyond a small state file, and a config you can diff. If your list contains the words SAML, LDAP, or "give the team accounts," Authelia will fight you and authentik will not.
The trap is picking authentik for a job Authelia does, then paying 2 GB and three containers forever to gate three apps. The opposite trap is picking Authelia and discovering six months later that the tool you wanted to add only speaks OIDC — Authelia can be an OIDC provider too, but that is the edge of its scope, not its centre.
Pick authentik if…
- You need a real IdP: OIDC, SAML, and LDAP for apps that speak them.
- You want a user directory with enrollment, recovery, and group claims rather than a YAML file of hashes.
- More than one person will operate SSO, and a web admin UI is worth the extra services.
Pick Authelia if…
- All you need is SSO and MFA in front of a reverse proxy, and the apps behind it don't do logins.
- Footprint decides it — 256 MB and one binary versus 2 GB and three containers.
- You want your access rules in git, declaratively, with no console to secure.
Common questions
Authelia vs authentik — which should I pick?
Pick authentik if you need an identity provider your apps federate with — OIDC, SAML, LDAP, a user directory, and an admin UI. Pick Authelia if you only need to put a login and a second factor in front of apps behind your reverse proxy: it does that in a single Go binary at 256 MB, where authentik needs 2 GB and three services.
Can Authelia replace an identity provider?
Only partly. Authelia authenticates requests at the reverse proxy and can also act as an OIDC provider, but it has no SAML support and its user store is a flat file or an existing LDAP directory. If an app needs SAML, or you want to manage accounts, groups, and enrollment centrally, that is authentik's job.
Which is lighter to run?
Authelia, decisively. It runs as one process with a 256 MB floor, optionally alongside Redis for persistent sessions. authentik's official Compose stack starts a server, a background worker, and PostgreSQL, and its realistic floor is 2 GB — enough to change which VPS you need.