Keycloak vs authentik: Self-Hosted SSO Compared (2026)

This comparison is for a small IT team, MSP or homelab admin who wants free, self-hosted single sign-on and is choosing between Keycloak and authentik. The short answer: pick Keycloak if your apps speak OpenID Connect, OAuth 2.0 or SAML, you want a long-established standards server with LDAP and Active Directory federation, and you are comfortable running a Java service with a production database. Pick authentik if you also want LDAP, RADIUS and a reverse proxy for older apps without SSO from the same product, plus browser-based RDP and SSH access, and you prefer a Docker Compose install backed only by PostgreSQL. Both are free and open source for self-hosting.

The facts below come from the projects’ own websites, documentation and GitHub repositories, checked on 27 October 2026. Not tested yet: we have not deployed either product ourselves, so this is a documentation-based comparison, not a benchmark. Try both in a lab with one real application before you move users.

At a glance

What Keycloak does well

Keycloak is an identity and access management server built around realms, clients and standard protocols. Its feature list covers single sign-on and single sign-out, identity brokering to other OIDC or SAML 2.0 providers, social logins, user federation with LDAP and Active Directory, an admin console, an account console where users manage their password, two-factor authentication and sessions, and fine-grained authorization services beyond simple roles.

The strength is breadth of protocol support and maturity. Most commercial and open source web apps that support “generic OIDC” or SAML work with Keycloak, and its database support is wide: PostgreSQL 14 to 18, MySQL 8.0 and 8.4, MariaDB LTS lines, Microsoft SQL Server 2019 and 2022, and Oracle. Teams that already run SQL Server or MySQL do not need a new database engine.

Version 26.8.0 promoted the SCIM API from preview to supported, so other systems can create and update users and groups in a realm through a standard interface. The same release lists a stateless multi-cluster mode without an external cache and reduced memory usage.

For a first look, the official getting-started guide runs Keycloak in development mode on localhost only:

docker run -p 127.0.0.1:8080:8080 
  -e KC_BOOTSTRAP_ADMIN_USERNAME=admin 
  -e KC_BOOTSTRAP_ADMIN_PASSWORD=admin 
  quay.io/keycloak/keycloak:26.8.1 start-dev

That container uses the built-in dev-file database and a throwaway admin password. Before production the documentation tells you to switch to a supported database such as PostgreSQL, configure TLS with your own certificates, set the public hostname, put a reverse proxy in front and run the start command instead of start-dev.

What authentik does well

authentik is an identity provider that bundles several jobs into one product. Its open source tier lists OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos and a proxy provider, web-based RDP and SSH access, OAuth 2.0 token exchange, multi-account switching and custom attributes on users and groups.

The practical difference is the provider list. If you have a legacy intranet app with no SSO support, authentik’s proxy provider can sit in front of it and require a login. Network gear and VPNs that only understand RADIUS, or old apps that only bind to LDAP, can authenticate against authentik directly. These providers run in outposts: small services that connect back to the authentik API and can be deployed automatically through the Docker or Kubernetes integration, or by hand. The server also has an embedded outpost for proxy providers.

Since release 2025.10 authentik needs only a server, a worker and PostgreSQL; caching, the embedded outpost and WebSockets moved from Redis to PostgreSQL. The release notes warn of roughly 50% more PostgreSQL connections, so size the database accordingly. The documented Docker Compose install is short:

wget https://docs.goauthentik.io/compose.yml
echo "PG_PASS=$(openssl rand -base64 36 | tr -d 'n')" >> .env
echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60 | tr -d 'n')" >> .env
docker compose pull
docker compose up -d

Then open port 9000 on the host and set the password for the default akadmin user in the initial setup flow. The guide also recommends configuring global email settings so password recovery and notifications work.

Where the free tiers differ

Keycloak is released under Apache-2.0 as a whole, and its feature list is not split into tiers. authentik splits features. The following are listed only in its Enterprise tier: privileged access management, Google Workspace and Microsoft Entra ID integrations, client certificate (mTLS) authentication, password history checks, enhanced audit logging, scheduled user offboarding, exportable CSV reports and Windows local device login. If you need to push accounts into Entra ID or Google Workspace from authentik, budget for Enterprise or use another sync method.

Which one fits which team

1. You mostly connect modern web apps over OIDC or SAML to Active Directory. Either works. Keycloak is the more conservative choice, with a wider database list and the CNCF behind it.
2. You also need RADIUS for Wi-Fi or VPN, LDAP for old apps, or a login wall for apps without SSO. authentik covers these in the free tier, so you run one product instead of several.
3. Your database team only runs SQL Server, MySQL or Oracle. Keycloak supports them; authentik needs PostgreSQL.
4. You want browser-based RDP or SSH to internal hosts behind SSO. authentik’s RAC provider does this in the free tier; we found no equivalent in Keycloak’s feature list.
5. You expect heavy login traffic. Keycloak publishes a sizing guide (for example 1 vCPU per 15 password logins per second as a starting point). Load-test either product with your own numbers.

Whichever you choose, send login and admin events to a SIEM. If you run Wazuh, forward the identity provider’s logs there so failed logins and admin changes are kept outside the IdP itself.

Limitations

• We have not installed or load-tested either product. Memory and CPU figures above are the projects’ own documented starting points.
• Keycloak’s dev mode has insecure defaults (local database, simple admin password). Never expose a start-dev instance to a network.
• Keycloak’s feature list does not include RADIUS, an LDAP server endpoint or an application proxy; plan separate tools for those.
• Several authentik features that larger companies expect, such as Entra ID and Google Workspace sync and enhanced audit logging, are Enterprise-only.
• Both products become a single point of failure for every app behind them. Plan backups of the database and a tested restore, and keep a local admin route into critical systems.

For directories, password management and access reviews around your SSO server, see the hub Identity and Access Management Tools. Help desk and asset tools that you may connect to SSO are covered in IT Asset Management and Help Desk Tools for Small IT Teams.

FAQ

Keycloak or authentik: which is better?

Neither in general. Keycloak is the established, standards-focused server with the widest database support. authentik adds LDAP, RADIUS, a proxy provider and web-based RDP/SSH in its free tier. Pick by the protocols your apps and devices need.

Is authentik free?

The open source tier is free and covers OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos and the proxy provider. Features such as privileged access management and Entra ID or Google Workspace integration are in the Enterprise tier, which is shareware (conditionally free).

Does authentik still need Redis?

No. Since release 2025.10 authentik runs on PostgreSQL alone, and the Docker Compose upgrade removes the old Redis container.

How does Keycloak compare with authentik on resource usage?

The authentik Docker Compose guide asks for at least 2 CPU cores and 2 GB of RAM. Keycloak’s sizing guide uses about 1250 MB of RAM per pod as a base request, with CPU scaled by login rate. Real usage depends on your users and traffic, so measure in a lab.

Does Keycloak support SCIM?

Yes. The SCIM API for managing users and groups in a realm was a preview feature in 26.7 and became supported in 26.8.0.

What about Authelia and Zitadel?

They are other self-hosted identity options that often appear in the same searches. We have not compared them here; check their official documentation for the protocols you need.

Last updated: 27 October 2026 · AdminHub Plus editorial team. Licence, version and platform details are checked against each developer's official documentation.