Why Self-Host Your Identity Provider?

If you manage more than two internal tools — a Grafana dashboard, a wiki, a CI server, maybe a password manager — you already feel the pain of separate logins for each one. Per-user SaaS SSO pricing from Okta or Auth0 starts around $2–$15 per user per month and scales linearly with your team. authentik flips that model: one VPS, one Docker Compose file, unlimited users.

authentik is an open-source identity provider (IdP) and single sign-on (SSO) platform that supports OAuth2/OpenID Connect, SAML, LDAP, RADIUS, and SCIM [S1]. Think of it as your own private Okta: you create users, groups, and application connections, and authentik handles the authentication flow. It supports FIDO2 hardware keys, passkeys, multi-factor authentication, and conditional access policies based on GeoIP and device compliance [S5].

The latest stable release as of this writing is version 2026.5.6, with 2026.8.0 in release candidate stage [S4]. The project has over 23,000 GitHub stars and active commits within hours of this article’s research.

Prerequisites and Server Requirements

Before you start, you need:

  • A Linux server (any distribution with Docker support)
  • At least 2 CPU cores and 2 GB of RAM [S2]
  • Docker Engine and Docker Compose v2 installed
  • A domain name with DNS pointing to your server
  • Ports 9000 (HTTP) and 9443 (HTTPS) available, or ports 80/443 if you configure a reverse proxy

One important note: authentik uses UTC internally for all operations. Do not mount /etc/timezone or /etc/localtime in the containers — this causes authentication failures with both OAuth and SAML flows [S2].

Step 1: Download the Compose File and Generate Secrets

Create a directory for your authentik deployment and download the official compose.yml:

“bash mkdir -p ~/authentik && cd ~/authentik curl -o compose.yml https://raw.githubusercontent.com/goauthentik/authentik/main/docker-compose.yml “

Next, generate the two critical secrets — a PostgreSQL password and an authentik secret key. Use openssl if you don’t have pwgen installed:

“bash PG_PW=$(openssl rand -base64 36 | tr -d '\n') AK_KEY=$(openssl rand -base64 60 | tr -d '\n') echo "PG_PASS=${PG_PW}" >> .env echo "AUTHENTIK_SECRET_KEY=${AK_KEY}" >> .env “

Pitfall: PostgreSQL rejects passwords longer than 99 characters due to a database-level limitation [S2]. The 36-character base64 string above is safe. If you use a different generator, keep the PG password under 99 characters.

For error reporting (optional but useful for debugging):

“bash echo "AUTHENTIK_ERROR_REPORTING__ENABLED=true" >> .env “

Step 2: Configure Ports and Optional SMTP

By default authentik listens on ports 9000 (HTTP) and 9443 (HTTPS) [S2]. If you want to expose on standard web ports instead, add these to your .env:

“bash echo "COMPOSE_PORT_HTTP=80" >> .env echo "COMPOSE_PORT_HTTPS=443" >> .env “

Email configuration is optional but recommended. authentik uses email for password recovery, admin alerts, and new release notifications. Add SMTP credentials to your .env (the compose file reads them automatically): no additional service definition is required because the worker container handles outbound email.

Step 3: Pull Images and Start authentik

With your .env file populated, pull the images and start the stack:

“bash docker compose pull docker compose up -d “

This starts three containers: the authentik server (the web UI and API), the worker (background tasks, outpost management), and PostgreSQL (the database). The worker also mounts the Docker socket by default, which enables automatic deployment of authentik Outposts — the proxy containers that sit in front of your applications [S2].

Security note: Mounting the Docker socket carries inherent risks. For production, consider using a Docker Socket Proxy (like Tecnativa’s docker-socket-proxy) to restrict what the worker can do, or remove the socket mount entirely and manage outposts manually.

Step 4: Complete the Initial Setup

Navigate to http://<your-server-ip>:9000/if/flow/initial-setup/ in your browser. You will be prompted to set a password for the akadmin user — the default administrator account.

Pitfall: The URL must end with a trailing slash. Without it, you get a Not Found error [S3]. If you see that error, also check that all three containers are running with docker compose ps.

After setting the admin password, you land on the authentik admin dashboard. You now have a working identity provider — but it’s protecting nothing yet.

Step 5: Protect Your First Application With OAuth2/OIDC

This is where authentik earns its keep. Every application you add to authentik requires a provider that defines the authentication protocol [S3]. The official documentation uses Grafana as the tutorial example, but the same pattern works for any OAuth2-compatible app.

In the admin interface:

  1. Navigate to Applications → Applications and click New Application.
  2. Give the application a name (e.g., “Grafana”).
  3. Set the Policy engine mode to Any — this means access is granted if any policy passes (or if no policies are bound) [S3].
  4. Under the provider section, select OAuth2/OpenID Connect.
  5. Configure the redirect URL to match what your application expects (for Grafana, this is http://<grafana-url>/login/generic_oauth/callback).
  6. Save the application and provider pair.

authentik generates a client ID and client secret. Use these in your application’s OAuth2 configuration to enable single sign-on. When a user visits your application, they redirect to authentik’s login flow, authenticate once, and are sent back with a valid token.

Validate: Confirm Your Deployment Works

After deploying, verify each component:

“`bash

Check all three containers are running and healthy

docker compose ps

Verify the server responds on the expected port

curl -s -o /dev/null -w “%{http_code}” http://localhost:9000/ “`

The server should return HTTP 200 or a redirect (302) to the login flow. If you get a 502 or connection refused, check:

“`bash

Server logs for startup errors

docker compose logs server –tail 50

Worker logs for database migration failures

docker compose logs worker –tail 50 “`

Test the OAuth2 flow by navigating to your protected application’s URL. You should redirect to the authentik login page, authenticate with your akadmin credentials, and land back in the application authenticated.

Rollback: How to Undo or Recover

If the deployment goes wrong, rollback is straightforward because authentik stores all state in PostgreSQL and the .env file:

“`bash

Stop all containers

docker compose down

Remove the PostgreSQL data volume if you want a clean slate (DESTROY DATA)

docker volume rm authentik_database

Or keep the volume and re-pull an older image tag

Edit compose.yml to point to a specific version tag:

image: ghcr.io/goauthentik/server:2026.5.6

docker compose pull docker compose up -d “`

For version upgrades, authentik recommends pulling the new compose.yml file (which references the latest stable image) and running docker compose up -d again [S6]. The database migrations run automatically. If the upgrade fails, pin the image tag to the previous version and restart.

Tradeoffs: When authentik Is Not the Right Choice

authentik’s Docker Compose deployment is explicitly labeled as suitable for “test setups and small-scale production” [S2]. For high availability, authentik supports Kubernetes deployments with separate server, worker, and Redis cache components. If you need multiple data centers, multi-region failover, or thousands of concurrent users, the Kubernetes path is the production-grade option — but it requires significantly more infrastructure knowledge.

For a single-office team of 5–50 people protecting internal tools, a 2-core VPS running Docker Compose is more than sufficient. You get SSO across all your applications, centralized user management, and no per-user licensing fees. The tradeoff is operational: you own the updates, the backups, and the uptime.

Conclusion: Your Self-Hosted SSO Is Ready

Once authentik is running and protecting one application, the next steps are:

  • Add more applications using the same provider pattern (OAuth2, SAML, or LDAP depending on what the app supports)
  • Create groups and bind them to applications for team-based access control [S3]
  • Configure MFA — add a TOTP or WebAuthn/FIDO2 stage to your login flow for two-factor authentication [S5]
  • Set up a reverse proxy (Caddy, Traefik, or nginx) for TLS termination on ports 80/443
  • Back up PostgreSQL regularly — docker compose exec postgres pg_dump authentik > backup.sql

authentik’s integration documentation covers over 180 applications with step-by-step guides [S3], making it easy to connect everything from Grafana to GitLab to Proxmox to your self-hosted SSO hub.

Sources

  1. [S1] Welcome to authentik — authentik (goauthentik.io) (2026-05-01)
  2. [S2] Docker Compose installation — authentik (goauthentik.io) (2026-05-01)
  3. [S3] First steps: Add your first application and provider — authentik (goauthentik.io) (2026-05-01)
  4. [S4] authentik GitHub repository — GitHub (goauthentik) (2026-08-06)
  5. [S5] authentik Features & Capabilities — authentik (goauthentik.io) (2026-05-01)
  6. [S6] Upgrade authentik — authentik (goauthentik.io) (2026-05-01)