authentik vs Tinyauth

authentik and Tinyauth both put a login screen in front of your self-hosted apps, but they're not really competing for the same job. authentik is a full identity provider — a user directory, SAML and LDAP for apps that speak them, and a visual flow builder for assembling login logic. Tinyauth is the tiniest thing that could plausibly be called an auth server: a single small Go container that adds a login screen, OAuth sign-in, and access rules in front of Traefik, Nginx, or Caddy, and since v5 doubles as an OpenID Certified OIDC provider. One of these is a platform. The other is a gate.

A directory and a flow builder vs. a gate with no memory

authentik's job is to be identity for the apps that federate with it: OIDC, OAuth2, SAML, and LDAP for apps that speak those protocols, plus a proxy provider for the ones that don't. It keeps a real user directory — enrollment, recovery, groups, claims — and its flow builder lets you compose multi-step login logic (password, then MFA, then consent) visually rather than by editing config.

Tinyauth has no directory at all. Users come from an environment variable you set at deploy time, or from an upstream OAuth provider you configure it to trust — there's no enrollment flow, no self-service password reset, no concept of groups. Its native mode is forward auth: your reverse proxy asks Tinyauth whether a request is authenticated before serving it, the same pattern Authelia uses. Since v5 it's also grown into an OpenID Certified (Basic OP) OIDC provider, which means apps that speak OIDC can log into Tinyauth directly rather than sitting behind the proxy — but that's a second mode bolted onto a tool whose whole design is built around being small, not a signal that it's becoming a directory-backed IdP. The project itself warns that its configuration surface changes fairly often between releases, which is the kind of thing you tolerate from a tool this size and wouldn't from one meant to be your identity system of record.

Footprint

The gap here is close to the widest in this whole category. authentik's official Compose stack — server, worker, PostgreSQL, Redis — carries a documented floor of 2 GB. Tinyauth is one container with a documented floor of 256 MB, an eighth of authentik's number on paper.

Measured idle at first boot stretches the gap further still: a fresh authentik instance settles at ~516 MB, Tinyauth at ~8 MB — roughly a 64x difference, and both figures sit comfortably under their documented minimums since neither carries real traffic yet. For a job that's genuinely just "put a login screen in front of these three apps," that's the entire argument in one number: Tinyauth barely registers on a VPS's resource budget, where authentik's Compose stack is a deliberate allocation.

Licensing

authentik is MIT at the core, following an open-core model — a free edition that already covers SSO, MFA, LDAP, SAML, OIDC, and the proxy provider, with an enterprise tier layering on remote access, risk detection, and support. Tinyauth is AGPL-3.0, a real consideration if you plan to modify it and offer it as a network service to people outside your organization — the license would then require publishing your changes. For a self-hoster running it as-is in front of personal or internal apps, that clause rarely matters in practice, but it's worth naming plainly rather than glossing over, since AGPL is a genuine selection criterion for some teams.

Proxy integration

Tinyauth is forward-auth-shaped at its core — it needs a reverse proxy in front of it to gate anything in its native mode, the same as Authelia. authentik's proxy provider covers the same pattern as one feature among several, rather than the whole product.

Whichever direction you're leaning, budget time for the proxy configuration itself, not just the auth container — that's usually where a first setup gets stuck, regardless of which tool is behind it.

For homelab vs. for teams

For a homelab, Tinyauth is close to the platonic ideal of "just gate my stuff." One container, a handful of environment variables, a measured ~8 MB idle footprint, and a 2 out of 5 difficulty rating that mostly reflects getting the proxy integration right rather than Tinyauth itself. There's no admin console to secure and no directory to back up beyond your proxy config.

For a team, or for any setup where more than one person needs to manage who has access to what, Tinyauth's lack of a directory stops being a simplicity and starts being a gap. Onboarding a new person means editing an environment variable and redeploying, not clicking through a self-service enrollment flow. authentik's 3 out of 5 difficulty and 2 GB Compose stack buy you a real user directory, group-based rules, and a web UI more than one administrator can operate.

Who should pick neither

If your requirement is passkey-only sign-in and nothing else — no forward auth, no directory, just OIDC login via passkeys — neither of these is quite the right shape. Pocket ID is built specifically for that case; see authentik vs. Pocket ID. And if what you actually want is a forward-auth gate with more configuration depth than Tinyauth offers — declarative, git-tracked access rules, for example — Authelia sits between the two; see Authelia vs. authentik for that comparison.

Choosing between Tinyauth and authentik

Reversed, the question is the same one: does anything you're protecting need SAML, LDAP, or a real user directory with enrollment and groups, or does more than one person need to administer access? If yes to either, Tinyauth's scope stops early and authentik is the tool built to go further. If the honest answer is "one person, a proxy, and a login screen for a handful of apps," Tinyauth's measured ~8 MB single container does that job without asking for a Compose stack in return — and Authelia offers more configuration depth in the same weight class. Everyone else — anyone whose apps federate, whose users churn, or whose requirements will grow past a forward-auth gate — should default to authentik and treat the 516 MB as the cost of not migrating identity providers later.

Running either on a VPS

Tinyauth's footprint is small enough that it will never be the reason you need a bigger instance — a single container this light rides along on whatever else the box is running. authentik needs more deliberate sizing: budget for its full Compose stack (server, worker, Postgres, Redis) rather than the bare documented minimum, and back up the Postgres volume, since it holds every user, credential, and flow you've configured. Both fit comfortably on any of the VPS options here; the step-by-step install guides are linked below.