If you have spent any time researching self-hosted identity providers, you have probably landed on the same two names over and over: Authentik and Keycloak. Both are open source. Both handle single sign-on, multi-factor authentication, and user management. And both show up in nearly every “self-hosted Auth0 alternative” list published in the last two years.

But they are not interchangeable, and picking the wrong one costs more than a wasted afternoon. Identity providers sit in front of everything else you run. Migrating away from one after your applications, groups, and MFA policies are already wired in is one of those projects nobody wants to own.

This guide breaks down where Authentik and Keycloak actually differ: architecture, protocol support, setup experience, scaling behavior, security history, licensing, and the situations where one clearly beats the other. By the end you should know which one fits your stack, not just which one has more GitHub stars.

Authentik vs Keycloak at a Glance

Keep this table in mind as we go deeper into each row, because the short version hides a lot of nuance that actually matters once you are the one running the thing in production.

What Is Authentik?

Authentik launched in 2020 and has grown into a project with nearly 20,000 GitHub stars, and the growth is not an accident. Its signature feature is the flow system: a visual editor for building authentication journeys instead of hand-writing configuration. Want passwordless login for one group of users and mandatory MFA for another? You can set that up without touching code, since Authentik supports the same protocols as Keycloak but wraps them in a cleaner interface.

That “cleaner interface” reputation shows up again and again in independent write-ups. One review calling Authentik the default recommendation for most greenfield deployments points to the admin UI being years ahead and the memory footprint being smaller compared to the alternative. Another comparison describes Authentik’s advantage as developer ergonomics, noting that passkeys work without configuration gymnastics and social login providers need minimal setup.

Authentik is not just a login screen bolted onto a database, either. It covers the widest protocol surface among self-hosted options, handling OAuth2/OIDC, SAML, LDAP as a server, SCIM, RADIUS, WS-Fed, and Proxy provider outposts for forward auth and outbound provisioning into Microsoft Entra ID and Google Workspace. That last part, the Outpost system, is what lets Authentik sit in front of applications that were never built with OIDC or SAML in mind. Point a reverse proxy at an Outpost, and Authentik decides who gets through.

Recent releases trimmed the operational overhead further. Authentik dropped its Redis dependency entirely starting with the 2025.10 release, so a fresh install now needs a container for the server, a worker, and PostgreSQL. Not nothing, but noticeably lighter than it used to be.

Where the “basic customization” label comes from in some older comparisons is worth a second look too. One head-to-head describes Authentik’s security features as well-suited for smaller-scale environments, prioritizing ease of configuration over deep security customization. That framing was fairer in 2023 than it is now. The flow builder, policy engine, and Outpost model give you plenty of room to get specific, it’s just that the defaults are sane enough that most teams never need to.

What Is Keycloak?

Keycloak has been around since 2014, and it shows in a good way and a slightly exhausting way at the same time. It is one of the most mature open-source identity and access management platforms, developed by Red Hat and widely used in enterprise environments, with a comprehensive feature set covering SSO, identity brokering, and user federation.

That maturity is precisely why large organizations keep choosing it. Keycloak is designed for large and complex projects and provides advanced features for integration, scaling, and security, and its realm-based model was built from the start to isolate tenants, environments, and business units from each other inside a single deployment.

The tradeoff shows up the moment you open the admin console. Configuration requires understanding concepts like realms, clients, and mappers, the learning curve is steep, and the resource footprint is significant. I’ve seen teams block out an entire weekend just to get a production-ready Keycloak instance running the way they want it, and that estimate is not pessimistic. It’s just what the tool asks of you.

What you get in return is depth most self-hosters never max out but enterprises frequently need. Keycloak 26.2 shipped standard token exchange under RFC 8693 as a fully supported feature, and 26.4 added supported DPoP sender-constrained tokens and FAPI 2 Final conformance, alongside fully supported passkeys. If you are building anything that touches open banking standards or has to satisfy a security auditor who knows what FAPI means, this is the row where Keycloak simply has no competition from Authentik.

Keycloak also wins on sizing predictability, which matters more than people expect once you are the one signing off on infrastructure budgets. It is the only platform in this comparison that documents, in writing, how to size it, with figures like one vCPU per 15 password logins per second and one vCPU per 120 client-credential grants per second. Authentik gives you a lighter footprint out of the box, but Keycloak gives you a spreadsheet you can actually plan a rollout around.

Architecture and Technology Stack

The two projects are built on genuinely different foundations, and that difference explains a lot of the behavior above. Both tools share some common technology, including JavaScript, CSS, Bash, TypeScript, JSX, and Python, but Authentik additionally relies on Golang, Rust, and Django while Keycloak leverages C and Java.

In practice, Authentik’s backend is Python and Go, running against PostgreSQL, with a worker process handling background tasks like email and scheduled policy checks. Keycloak runs on the Quarkus framework, which is Java under the hood, giving it access to the JVM’s ecosystem of tuning knobs, but also the JVM’s memory appetite and startup time.

Popularity metrics tell a related but not identical story. Keycloak leads with over 36,000 GitHub stars compared to roughly 24,000 for Authentik, a gap of about 50 percent that reflects Keycloak’s longer history and broader enterprise adoption. Keycloak also shows a larger contributor base, with thousands of forks compared to Authentik’s, though both projects remain very actively maintained, with commits landing within hours of each other on any given day. Stars are not a security guarantee or a feature checklist, but they’re a rough proxy for how many eyes have looked at the code, and how many Stack Overflow answers exist when something breaks at 2am.

Feature and Protocol Comparison

On paper, the overlap between these two is bigger than most comparison charts suggest. Both tools offer comparable feature coverage overall, with authentik supporting slightly more individual features than Keycloak, and both fully covering core authentication and machine-to-machine authentication.

Where they genuinely diverge is protocol depth versus protocol breadth. authentik covers the protocols most apps need out of the box: OIDC, SAML, LDAP, SCIM, RADIUS, and Kerberos, plus its own proxy mode, but it does not have token exchange, DPoP, or any FAPI conformance program. For a homelab or an internal tools stack, that gap changes nothing. For a fintech company or anyone building service-to-service token flows that a compliance auditor will scrutinize, it is a real limitation.

MFA and SSO are table stakes on both sides. Both platforms offer multi-factor authentication and single sign-on, with Keycloak’s advanced configurations making it a strong candidate for industries with strict security requirements like finance or healthcare. Session handling is similarly close: both let admins adjust session idle and max lifespans and offline sessions to keep sessions alive longer, and both let admins view and revoke user and client sessions, sign out all sessions, and configure session lifespans from the console.

The forward-auth question is where the two products stop being close cousins. Keycloak federates against LDAP and Active Directory, brokers external identity providers, and supports self-registration, but it has no forward-auth mode of its own, so putting it in front of an app that cannot speak OIDC means adding something like Traefik with oauth2-proxy in between. Authentik solves this natively through its Outpost system, which is one reason people reach for it when they need to protect a pile of legacy or half-abandoned self-hosted apps without touching their code.

Directory federation is the flip side of that coin. Both platforms use LDAP as a user source, so if your existing users live in an LDAP or Active Directory instance, both can connect to the same directory, but Keycloak’s brokering and multi-realm model has more years of production hardening behind it in exactly this scenario.

Setup, Admin Experience, and Learning Curve

This is the category where most people who have used both tools have a strong opinion, and it usually comes down to which one they set up first.

Authentik’s flow builder is genuinely a different experience from a typical IAM admin panel. Instead of a wall of settings, you drag stages into a sequence: identification, password entry, MFA prompt, consent screen, whatever your use case needs. It reads more like designing a form than configuring enterprise software, and that’s deliberate.

Keycloak asks more of you up front. Its admin console is intimidating, and configuration requires understanding concepts like realms, clients, and mappers before you can do anything useful. Once that model clicks, it is powerful, particularly for multi-tenant setups where isolation between business units genuinely matters. But there’s no getting around the fact that the first week is rougher.

Deployment tooling is close to a wash for either platform on modern infrastructure. Authentik officially supports Docker Compose with community-maintained Helm charts, while Keycloak has an official operator, Helm charts, and Red Hat OpenShift templates. If you already run OpenShift, Keycloak’s tooling will feel like it was built for your environment, because in a sense it was.

Scalability and Performance

Both tools scale. The question is how much you have to think about it while they do.

Keycloak provides the most battle-tested scalability of the two, and it earns that reputation through years of production deployments at companies with millions of users and complex clustering requirements. Keycloak is designed for use in large and complex environments, offering features for scaling and high availability that assume from day one you might be running dozens of realms across multiple regions.

Authentik scales too, just with a different profile. Its lighter runtime and the recent removal of the Redis dependency mean a single-node deployment goes further before you need to think about horizontal scaling. That said, once you’re managing many realms in Keycloak, the resource math does start working against you. Keycloak can become resource-intensive, particularly when managing numerous realms, which could limit its suitability for smaller teams that don’t have dedicated infrastructure staff watching JVM heap usage.

If capacity planning is part of your job description, Keycloak hands you an actual formula instead of a shrug. Its documented sizing guidance covers roughly one vCPU per 15 password logins per second, one vCPU per 120 client-credential grants per second, and similar figures for other flows. Authentik does not publish anything comparably granular, so smaller teams tend to size by testing rather than by spreadsheet.

Security Track Record

Open source does not automatically mean secure, but it does mean the history is visible if you go looking for it.

Keycloak’s CVE count spans more than 50 vulnerabilities across over 10 years, a figure the researchers compiling it describe as comparable to other enterprise IAM solutions given how long it has been in production and how large its attack surface is. More surface, more time, more disclosures, that’s roughly how the math works for any widely deployed platform.

Hardening recommendations differ accordingly. For Authentik, the usual advice is to restrict the admin UI through access control lists, enable posture checks, and turn on encryption at rest for PostgreSQL, while Keycloak hardening tends to focus on JVM tuning, realm isolation checks, auditing SPI extensions, and testing major updates before rolling them out. Neither list is short, and neither platform is “secure by default” in the way a narrower tool like Authelia can claim to be, mostly because both Authentik and Keycloak carry a much bigger feature surface than a forward-auth-only tool ever will.

The practical takeaway is not “pick the one with fewer CVEs.” It’s that whichever you choose, patch cadence and configuration discipline matter more than the brand name on the login page.

Licensing and Pricing

Both projects are free at the core, but the commercial layers built on top look different.

Authentik’s Community Edition is MIT licensed, with a commercial Enterprise Edition available since 2024 priced around $5 per user per month plus a small per-external-user fee, adding things like RADIUS support and dedicated SLAs on top of the free core. The Enterprise edition mainly adds RADIUS support, dedicated support, and a few compliance features, and for most self-hosted stacks handling SSO, MFA, and OIDC or SAML for internal tools, the MIT core covers everything needed at no cost.

Keycloak is Apache 2.0 licensed and has no paid tier of its own, though Red Hat sells commercial support and a productized version, Red Hat Build of Keycloak, for organizations that want a support contract attached. If your company already has a Red Hat relationship, that path is often the path of least resistance.

Compared against fully commercial IAM vendors, the value case for self-hosting either one is strong. Auth0 charges extra for SAML on most plans, and Clerk does not support SAML at all on its Pro tier, while both Authentik and Keycloak speak SAML, OIDC, OAuth2, LDAP, and SCIM out of the box. Owning your identity data also removes a specific kind of business risk. If a hosted IdP vendor changes pricing, gets acquired, or suffers a breach, migrating a large user base with passwords, MFA enrollments, and session state intact becomes a genuine nightmare, and self-hosting sidesteps that scenario entirely, at the cost of owning the operational burden yourself.

Also Read: What is Authentik

When to Choose Authentik

Authentik tends to be the right call when:

• You are protecting a collection of self-hosted apps, some of which do not natively support OIDC or SAML, and want forward auth handled without bolting on a separate proxy stack.
• Your team is small, and a visual flow builder beats hand-editing realm configuration.
• You want passkeys, social login, and conditional MFA working quickly without deep protocol expertise on staff.
• You are running Kubernetes or Docker Compose already and want an identity provider that fits that world without extra ceremony.
• Compliance requirements do not currently include FAPI, DPoP, or formal token exchange.

Authentik leans into configurable flows, proxy mode, and support for older applications, which is exactly the profile of a growing startup or an internal-tools-heavy engineering team.

When to Choose Keycloak

Keycloak tends to win when:

• You need federation against Active Directory or LDAP as an authoritative source, with isolated realms per tenant or business unit.
• Your industry has compliance requirements around token exchange, DPoP, or FAPI 2 conformance.
• You already have infrastructure staff comfortable tuning a JVM and monitoring cluster health.
• You want a documented, formula-based approach to capacity planning before a big rollout.
• Your organization has an existing Red Hat relationship and wants commercial support behind the identity layer.

Keycloak leans into federation, enterprise directory integration, and platform-scale IAM patterns, which is why it remains the default in large, regulated organizations that measure user counts in the hundreds of thousands.

A Note on Authorization, Not Just Authentication

It’s worth separating two things people often lump together: authenticating a user and deciding what that user is allowed to do. Authentik has group- and role-based access rules and configurable policies, while Keycloak has RBAC and resource-based rules with UMA 2.0, and both are genuinely useful. But neither is quite the same as a dedicated policy decision point for high-volume, resource-level authorization checks across applications, APIs, workloads, and service accounts. If your authorization logic is going to get complicated (think per-resource permissions, contextual rules, or checks that span dozens of microservices) it’s worth planning for a separate authorization layer alongside whichever identity provider you pick, rather than trying to cram all of that logic into the IdP’s role system.

Migration Considerations

If you’re moving from one to the other, budget more time than the marketing pages imply. Migration requires a manual export of user data from one system via its REST API and import into the other, and application registrations like OIDC clients and SAML providers must be recreated by hand. There is no one-click path between the two, mostly because their internal data models don’t map cleanly onto each other.

The safer approach is a phased cutover. Plan for a careful, application-by-application transition, running both systems in parallel during the switch rather than flipping every application over in a single weekend. Test MFA enrollment migration specifically. It’s the piece people forget about until users start getting locked out.

Frequently Asked Questions

Is Authentik or Keycloak better for a small team? Authentik is usually the better fit for small teams. Its lighter resource footprint, visual flow builder, and quicker setup mean you spend less time on infrastructure and more time shipping the application the identity provider is supposed to be protecting.

Does Keycloak support passkeys? Yes. Keycloak added fully supported passkey authentication in its 26.x release line, alongside standard token exchange and FAPI 2 Final conformance.

Can Authentik replace a reverse proxy with authentication built in? Largely, yes, through its Outpost system, which handles forward auth for applications that don’t natively speak OIDC or SAML. Keycloak has no equivalent built in and typically needs a companion proxy like Traefik with oauth2-proxy for the same job.

Which one is free to use commercially? Both are free for commercial use at their core. Authentik’s Community Edition is MIT licensed; Keycloak is Apache 2.0 licensed. Authentik has an optional paid Enterprise Edition for extras like RADIUS support and dedicated SLAs; Keycloak’s commercial layer comes through Red Hat support contracts rather than a separate paid edition of the open-source project.

Is Keycloak harder to run than Authentik? Generally, yes, at least at first. Keycloak’s realm, client, and mapper model takes longer to learn, and its JVM footprint asks more of your infrastructure. Authentik’s admin experience and lighter runtime make initial setup and day-to-day administration noticeably faster to pick up.

Do either of these handle authorization, not just login? Both offer role- and policy-based access rules, but neither is built as a dedicated fine-grained authorization engine. Teams with complex, resource-level permission needs often pair either identity provider with a separate authorization layer rather than trying to model everything as IdP roles.

Final Verdict

There isn’t a universally correct answer here, and anyone who tells you there is hasn’t run both in production. Authentik is the pick when you want speed, a friendlier admin experience, and native forward-auth for a mixed bag of self-hosted apps. Keycloak is the pick when you need protocol depth, documented scaling behavior, and the kind of enterprise federation that regulated industries expect.

If you’re still weighing the decision, start smaller than you think you need to. Spin up both in a test environment, wire up one real application to each, and see which admin experience you actually enjoy using at 11pm when something needs a quick fix. That afternoon will tell you more than any comparison table, including this one.

For more breakdowns of identity, cloud, and DevOps tooling like this one, keep exploring the tutorials and guides on CourseDrill.