Authelia vs authentik

Last reviewed Aug 24, 2026 · 611 words

The confusion between these two comes from both answering "how do I stop exposing twelve login pages to the internet?" — but they answer it at different altitudes. Authelia is a gate: a companion your reverse proxy consults before letting a request through, adding a login portal and 2FA in front of apps that never learn authentication exists. authentik is an identity provider: a system your applications integrate with, speaking OAuth2/OIDC, SAML, and LDAP, with user lifecycle, custom enrollment flows, and a policy engine. The gate weighs 128 MB; the platform wants a gigabyte plus Postgres and Redis. Neither number is wrong — they're doing different jobs.

Where Authelia shines

If your goal is "one login and a TOTP prompt before Jellyfin, Sonarr, and the dashboard", Authelia is the proportionate tool. It's a single Go binary configured entirely in YAML — which means your whole auth setup lives in git, reviewable and reproducible — wired into Caddy, Traefik, or Nginx as forward-auth. Access control rules are fine-grained (per-domain, per-path, per-group, per-network) and it does the modern factors: TOTP, WebAuthn/passkeys, push via Duo. Its cost is exactly its config file: the YAML is extensive, the reverse-proxy integration must be done precisely, and error messages assume you read documentation. It historically stayed lean by not being an OIDC provider; that's changed — OIDC provider support has matured over recent releases — but authentik remains far ahead on protocol breadth and admin tooling.

Where authentik earns its weight

The moment your requirements include "Nextcloud, Grafana, and Immich should each log in via SSO natively", "invite users with an enrollment flow", "sync from LDAP", or "this app only speaks SAML", you've left forward-auth territory. authentik centralises all of it: a web admin UI instead of YAML, per-app providers, group-based policies, MFA, and — usefully — its own proxy outposts, so it can also gate dumb apps the way Authelia does. That last point matters: authentik is a superset in capability. What you pay is operational: a Python/Django stack with Postgres and Redis, ~1 GB RAM in practice, a learning curve measured in evenings (flows and stages are powerful and initially bewildering), and one more critical service whose upgrades you read notes for. When your identity layer is down, everything is down — weight that accordingly, per threat modeling for normal people.

The homelab reality check

Most homelabs genuinely need the gate, not the platform. A dozen self-hosted apps behind one portal with passkeys is Authelia working at exactly its design point. The platform starts paying when user count grows past the household, when apps' native SSO support would otherwise go unused, or when you're rehearsing skills for work — authentik is the closest self-hosted analogue to Okta-style IdP work. The full walkthrough of both, including the proxy wiring, is in SSO with Authentik and Authelia.

Decision table

What I'd do

Start with Authelia in front of everything private; it's an afternoon, and passkeys-plus-YAML-in-git is a wonderful steady state. Migrate to authentik when you catch yourself wishing apps knew who was logged in — that's the signal you need an identity provider, not a better gate. Running Authelia forever is a fine ending too; plenty of mature homelabs never need more.