"Authentik vs Keycloak" is a search we can answer honestly because we run both. Neither is the wrong choice, which is rare in a head-to-head, most "vs" comparisons have a clear loser by paragraph three. This one doesn't. What you actually need depends on whether you value maturity and ecosystem size, or a more modern flow-based setup experience.
Both are open source, both self-host for free, and both are legitimate self hosted IdP options for replacing Auth0 or Okta once the per-user pricing stops making sense. The differences that matter are in the architecture, the admin experience, and exactly what's free versus what sits behind an enterprise tier.
Quick answer
Jump to a section
How to choose between Authentik and Keycloak
Skip the protocol-by-protocol spec chase, both support the standards you need. Three questions actually settle it:
- Do you want the most battle-tested option, or the most modern one? Keycloak has been in production since 2014 with Red Hat's backing behind it. Authentik is younger, but its admin experience feels considerably more current.
- How much do you want configured visually versus via config files? Authentik's flow-based system lets you build custom login, enrollment, and MFA sequences as a visual pipeline. Keycloak leans on its realm and client configuration screens, powerful but more traditional.
- Do you need a built-in reverse proxy or RADIUS support? Authentik ships an application proxy and RADIUS outpost in its free tier. Keycloak focuses purely on SSO and identity brokering, you'll pair it with your own reverse proxy if you need one.
Authentik: the modern, flow-based identity provider
Authentik is built as a Django app behind a Go reverse proxy, with Dramatiq handling background jobs and PostgreSQL as the datastore. What sets it apart is the flow engine, authentication sequences (login, enrollment, password reset, custom MFA steps) are configured as visual pipelines rather than buried in config files. For anyone who has fought Keycloak's authentication flow XML in the past, this is the feature that sells people on switching.
Key features
- Flow-based visual pipelines for login, enrollment, and MFA sequences
- Protocol support: OAuth2/OIDC, SAML, LDAP, RADIUS, SCIM, WS-Federation
- Built-in application proxy and Remote Access Component for RDP, SSH, and VNC
- Group- and role-based access rules with a modern TypeScript admin UI
- A REST API covering over 1,100 endpoints for automation
Pros
- Genuinely modern admin UI, easier for a new team member to pick up
- Broader protocol and proxy support in the free, MIT-licensed core
- Flow builder makes custom auth journeys far less painful to configure
Cons
- Smaller community than Keycloak, fewer Stack Overflow answers when something breaks
- Remote access (RAC) and AI-based risk detection sit behind a paid enterprise tier
- Younger project, less of a track record at very large enterprise scale
Keycloak: the mature, standards-first identity provider
Keycloak has been solving SSO since 2014, originally built by Red Hat and now developed as an independent open source project (Red Hat still ships a supported downstream distribution with an SLA). Keycloak 26.7, released July 2026, added a SCIM API in preview and simplified multi-cluster high availability without needing an external cache layer, a sign the project is still actively closing gaps rather than coasting on its age.
Key features
- Single sign-on, identity brokering, and user federation out of the box
- Fine-grained authorization built in, not an add-on
- Realm-based multi-tenancy for isolating separate applications or customers
- SCIM API in preview as of 26.7, plus HAProxy and Traefik reverse-proxy blueprints
- Over a decade of production deployments across every industry
Pros
- The entire project is Apache 2.0, no enterprise gate on the open source edition itself
- Massive community, documentation, and existing troubleshooting knowledge
- Realm model scales cleanly across many applications and tenants
Cons
- Admin console feels more dated next to Authentik's UI
- No built-in reverse proxy or RADIUS, you're adding your own tooling around it
- Custom authentication flows require more config-file work than Authentik's visual builder
Licensing: what's actually free in each
This is where people get tripped up, because both projects have a paid tier and it's easy to assume the free version is a stripped-down demo. It isn't, for either of them.
Keycloak is Apache 2.0 top to bottom. There is no separate "Keycloak Enterprise" feature-gated edition of the open source project, the paid option is Red Hat's supported build, which is the same software plus an SLA and support contract. If you don't need a support contract, the free version is the full product.
Authentik's core, SSO, MFA, LDAP, SAML, OIDC, the application proxy, flows, blueprints, and SCIM, is MIT licensed with no license checks at runtime. The paid enterprise tier adds Remote Access (RDP/SSH/VNC through the browser), AI-based risk detection, advanced audit logging, and a support SLA, priced per user. Most self-hosted deployments never touch the enterprise tier at all.
Deploying Authentik vs Keycloak: what the server actually needs
Both run comfortably on a single VPS for small-to-mid deployments, but the stacks underneath are different enough to matter for sizing. Authentik ships as a multi-container Docker Compose stack: the Django server, a Go-based proxy, Redis for caching, and PostgreSQL for storage. Plan for at least 2GB of RAM for a small team, more once you add the Remote Access Component or start running heavier flow-based MFA sequences.
Keycloak runs as a single Java process on the JVM, backed by its own PostgreSQL database. That single-process model is simpler to reason about but comes with a Java memory footprint, budget 2GB minimum and expect to tune JVM heap settings as usage grows, the same way you would for any Java service. Neither tool needs Kubernetes for a standard deployment, plain Docker or Docker Compose covers the vast majority of real-world setups.
Authentik vs Keycloak: feature comparison
| Feature | Authentik | Keycloak |
|---|---|---|
| License | MIT (core) | Apache 2.0 |
| First released | 2018 | 2014 |
| OIDC / OAuth2 | Yes | Yes |
| SAML | Yes | Yes |
| LDAP | Yes | Yes, via user federation |
| RADIUS | Built in | Not built in |
| Built-in reverse proxy | Yes (application proxy) | No |
| Visual auth flow builder | Yes | No, config-based flows |
| Multi-tenancy model | Groups and roles | Realms |
| Admin UI | Modern, TypeScript-based | Traditional, functional |
| Enterprise-only features | Remote access, AI risk detection | None (paid tier is support/SLA only) |
| Community size | Smaller, growing | Large, decade-plus |
Why we deploy both for clients
We don't push one over the other by default, because the honest answer genuinely depends on the client. Teams already standardized on Red Hat or Java infrastructure land on Keycloak without much debate, it fits the ecosystem they already have. Teams starting fresh, or ones that want SSO wired up alongside a reverse proxy and RADIUS without extra tooling, tend to prefer Authentik once they see the flow builder in action.
If you're also wiring up single sign-on for Jitsi Meet specifically, our guide to Jitsi's authentication methods covers how JWT and OIDC-based login fit into either IdP.
Where I'd start
Want the safest, most documented option with the largest community to lean on when something breaks: Keycloak. Our Keycloak developer guide covers the full AWS deployment.
Want a more modern admin experience and you're building custom login or enrollment flows: Authentik. Start with our Authentik developer guide or the single-click AWS setup if you want it running today.
If you're still not sure, that's a fine place to be, both are excellent and neither is a mistake. Pick the one whose admin UI you'd rather stare at every day, because you will.
Frequently Asked Questions
Authentik vs Keycloak: which is better for self-hosting?
Both self-host cleanly and both cost nothing to run at the software level. Keycloak is the more battle-tested, standards-purist choice with Red Hat's history behind it. Authentik has the more modern admin UI and a broader built-in feature set (proxy, RADIUS, flows) without needing an enterprise tier.
Keycloak vs Authentik: which has better documentation?
Keycloak, by a clear margin. It's been around since 2014 and has over a decade of Stack Overflow threads, blog posts, and official Red Hat documentation. Authentik's docs are solid but the community is younger and smaller.
What is a good open source identity provider comparison for a small team?
If your team already runs Java or Red Hat infrastructure, Keycloak fits naturally. If you want a more modern UI and flexible auth flows without touching enterprise pricing, Authentik's free tier covers more ground out of the box.
What is the best self hosted IdP in 2026?
There isn't a single answer, both are excellent. Keycloak wins on maturity and ecosystem size. Authentik wins on UI polish and built-in protocol breadth (SAML, OIDC, LDAP, RADIUS, SCIM, and a reverse proxy, all in the free edition).
Is Keycloak or Authentik easier to set up?
Authentik's guided setup and flow-based configuration make the first SSO integration faster to get right. Keycloak's admin console is more traditional and has more screens to learn, though its realm-based model scales well once you know it.
Are Authentik and Keycloak really free to self-host?
Yes. Keycloak is Apache 2.0 licensed with no enterprise gate on the open source project itself. Authentik's core (SSO, MFA, SAML, OIDC, LDAP, flows) is MIT licensed and free; only a separate enterprise tier with remote access and AI risk detection is paid.
Launch Keycloak on AWS in Minutes
Launch a pre-configured Keycloak server on AWS, ready to use as your self-hosted Auth0 alternative with SSO already wired up.
Get Keycloak on AWS Marketplace
