Keycloak
96 · HealthyIdentity and access management server with SSO, OIDC, SAML and user federation (CNCF).
Open source Auth & identity
authentik
88 · HealthyIdentity provider with flows, SSO across OIDC, SAML, LDAP and a proxy outpost.
Logto
86 · HealthyAuth and identity service for SaaS and AI apps, built on OIDC with organizations and RBAC.
ZITADEL
84 · HealthyMulti-tenant identity platform with event-sourced audit trail and B2B organizations.
Ory Kratos
79 · StableHeadless identity and user-management server with an API-first design.
SuperTokens
74 · StableAuthentication backend with prebuilt UI, sessions and multi-tenancy.
Authelia
71 · StableSingle sign-on and two-factor portal that sits in front of web apps via a reverse proxy.
Directory / Auth & identity / authentik
authentik
Identity provider with flows, SSO across OIDC, SAML, LDAP and a proxy outpost.
Will it still be around?
Health 88/100 · Healthy
Activity, bus factor and issue responsiveness. Breakdown
Can a business use it freely?
Open source (permissive)
MIT (core) + separate license for authentik/enterprise/. Details
Alternative to
Savings proposal
At 25 users, Okta costs about $150 a month and self-hosting authentik about $264, so Okta is cheaper at this size. Self-hosting pays off from 49 users.
List price: Okta Starter Suite, billed annually. SSO alone is $2 per user; most companies add adaptive MFA and lifecycle management ($14 to $17 per user). Minimum contract $1,500 a year. Source, checked 2026-10-07.
Extra cost over 3 years
$5,304
Pays for itself
Not at this size
Extra cost in year one
$2,568
Each month
$150 → $264
Show as a table
| Month | Okta | Self-hosted | Difference |
|---|---|---|---|
| Today | $0 | $1,200 | −$1,200 |
| Month 3 | $450 | $1,992 | −$1,542 |
| Month 6 | $900 | $2,784 | −$1,884 |
| Month 9 | $1,350 | $3,576 | −$2,226 |
| Month 12 | $1,800 | $4,368 | −$2,568 |
| Month 18 | $2,700 | $5,952 | −$3,252 |
| Month 24 | $3,600 | $7,536 | −$3,936 |
| Month 30 | $4,500 | $9,120 | −$4,620 |
| Month 36 | $5,400 | $10,704 | −$5,304 |
Assumptions you can change
Self-hosting authentik usually means an app server, a database and a cache or worker. Hours are for one engineer; the server cost is a typical cloud VPS with backups and grows with the number of people using it.
Not included: paid editions or features of authentik (see What's free?), large data migrations, and compliance work. All amounts in US dollars at list price; your negotiated price may differ.
Health score: 88/100
Activity45% weight
100/100
- Last commit today (100/100).
- 5364 commits in the past 12 months (100/100).
- 50+ releases in the past 12 months (100/100).
Bus factor30% weight
94/100
- Top contributor wrote 30% of the last 44 commits (past 12 months).
- 13 people authored those commits.
Responsiveness25% weight
60/100
- 84% of all issues are closed (757 open, 4045 closed) (90/100).
- 12 of 30 recent issues got a reply or were closed (40/100).
Score v2. How the health score works.
License
MIT (core) + separate license for authentik/enterprise/ · Open source (permissive)
Everything outside authentik/enterprise/ is MIT. Enterprise code needs a paid license; the website/ docs are CC BY-SA 4.0.
OSI-approved license with few conditions beyond keeping the copyright notice.
License text checked 2026-10-07: read it.
What's free?
Enterprise features many open-core projects keep for paid plans.
| Feature | Self-hosted, free? |
|---|---|
| SSO (SAML) | Free |
| SSO (OIDC) | Free |
| SCIM provisioning | Free |
| Audit logs | Unknown |
| Role-based access control | Unknown |
| Multi-tenancy | Unknown |
GitHub metrics
| Stars | 26k | Forks | 2.1k |
|---|---|---|---|
| Last commit | today | Commits, 12 months | 5.4k |
| Releases, 12 months | 50+ | Last release | 20 days ago |
| Contributors | 452 | Active authors | 13 in last 44 commits |
| Open issues | 757 | Closed issues | 4.0k |
Snapshot from 2026-10-08.