Keycloak vs Authentik

Keycloak and Authentik are open-source identity providers you run yourself. Keycloak, an Apache 2.0 project in CNCF incubation, covers single sign-on over OpenID Connect, OAuth 2.0 and SAML 2.0, LDAP and Active Directory federation, and fine-grained authorisation. Authentik, developed by the US company Authentik Security Inc., adds configurable flows, a proxy for applications without login support, and a paid Enterprise tier.

Editor Sebastiaan Smits

Published Last reviewed How we review

Choose Keycloak if

you want a foundation-hosted project that is free under Apache 2.0, LDAP or Active Directory federation, fine-grained authorisation policies, a Kubernetes operator, and the option of Red Hat's commercially supported build.

Read the Keycloak review

Choose Authentik if

you must protect applications that have no login of their own, want login and enrolment as configurable flows, or want RADIUS, Kerberos and web-based RDP and SSH access in the free edition.

Read the Authentik review

Keycloak and Authentik side by side

 KeycloakAuthentik
Company Keycloak (CNCF project, Red Hat originated) Authentik Security Inc.
Headquarters London, United Kingdom Pennsylvania, United States
Jurisdiction Self-hosted; project governance is international Self-hosted; vendor is a US company (Delaware corporation)
Where the data sits Wherever you deploy it Wherever you deploy it
Pricing Free and open source Free and open source / Enterprise $5 per user per month, billed annually
Entry-level list price (vendor site, checked 30 September 2026) Free (open source, Apache 2.0); a supported build is sold separately by Red Hat Enterprise: $5 per user per month, billed annually ($0.02 per external user per month)
Free tier or trial Free Free
Certifications and checks GDPR (you remain the controller) GDPR
Source code Open source (Apache 2.0) Open source (MIT (outside the enterprise directory))
Usually replaces Auth0, Okta Okta, OneLogin
Position in our Identity Management guide #1 of 8 #4 of 8

Both are listed in our European Identity Management guide. The table is built from the same directory data as those entries, except the list price, which is quoted from each vendor's own pricing page (see Sources below); how we check it is described in the editorial process.

Where Keycloak and Authentik differ

Across the five points below, Keycloak has the edge on 1 point, Authentik on 2 points and 2 are a tie. A count like that is a summary, not a verdict: the point that matters to you may be the one the other product wins.

Depth of authorisation

Keycloak documents fine-grained authorisation services for cases where role-based access is not enough, with permissions for all your services managed from its admin console. Authentik builds authentication and authorisation from flows, stages and policies, and its paid tiers add privileged access management and device trust. For a centrally managed permission model spanning many services, Keycloak's dedicated authorisation services are the more direct fit.

Edge: Keycloak

Applications without their own login

Authentik's proxy provider protects applications that do not support OIDC, SAML or LDAP, either proxying traffic itself or answering forward-auth checks from nginx, Traefik, Caddy and other reverse proxies. Keycloak's documented model is standards-based: OpenID Connect, OAuth 2.0 and SAML 2.0, plus identity brokering. For an estate that includes older tools with no login integration, Authentik has the built-in answer.

Edge: Authentik

Protocols in the free edition

Authentik's open-source edition lists OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos and proxy support, plus web-based RDP and SSH access, and it is OpenID Certified. Keycloak lists OpenID Connect, OAuth 2.0 and SAML 2.0, brokering to other OIDC or SAML providers, and social login. Where network devices or remote desktops must sit behind the same identity provider, Authentik's own list is broader.

Edge: Authentik

Directory federation

Keycloak has built-in support for connecting existing LDAP or Active Directory servers, and lets you write your own provider for users held elsewhere, such as a relational database. Authentik documents Active Directory as an LDAP source with synchronisation and optional password writeback, and FreeIPA as well. Both can keep an existing directory as the source of truth instead of migrating users.

No clear winner on this point.

Licence, price and backing

Keycloak is Apache 2.0 and free to use; commercial support comes from Red Hat, which sells the Red Hat build of Keycloak. Authentik's code is MIT outside its enterprise directory, with Enterprise at $5 per user a month billed annually, $0.02 per external user, and Enterprise Plus from $20k a year. Authentik states that it will not move open-source features into the paid tier.

No clear winner on this point.

When neither Keycloak nor Authentik fits

Both leave you running the identity system. A small team wanting a managed service can look at Signward, listed from EUR 3 per user a month with identity data kept in the EU, and developers building passwordless login can look at Hanko, which supports passkeys.

Keycloak vs Authentik: questions

Both offer container-based deployment. Authentik provides templates for Docker Compose, Kubernetes and Terraform and a one-click AWS CloudFormation option. Keycloak ships a Quarkus-based distribution, container images and an operator for Kubernetes and OpenShift. With either you patch, back up and scale the service yourself, since Authentik offers no hosted version.

Yes, both. Keycloak has built-in federation with existing LDAP and Active Directory servers, so the directory stays the source of truth. Authentik connects to Active Directory as an LDAP source, synchronises its objects and can write password changes back; its documentation lists the service account permissions required.

Wherever you deploy them: both are self-hosted, and Authentik states that it does not currently offer a hosted version. Keycloak is a Cloud Native Computing Foundation incubation project. Authentik is developed by Authentik Security Inc., a Delaware corporation with principal offices in Pennsylvania.

For Keycloak, commercial support comes through Red Hat's build of Keycloak, which replaces Red Hat Single Sign-On. Authentik offers support only within Enterprise subscriptions, with ticket-based support above $1k a year and dedicated SLAs on Enterprise Plus; free users rely on GitHub and Discord.

Sources

Facts, prices and plan details on this page were checked on the vendors' own websites on . Prices and plans change; the vendor's current page is authoritative.

More head-to-head comparisons

Against the US incumbents