How to Self-Host Authentik
Authentik is an open-source identity provider for single sign-on, multi-factor authentication, and user directories, with OIDC, SAML, and proxy authentication. The notes below were checked against the project site and source repository.
When Authentik is a good fit
Choose Authentik when applications should sign in through one provider you operate, instead of a separate account on each app. You own the directory, the secrets, the upgrades, and the recovery path. Read the current install guide before selecting a version, because the compose layout and required variables change between releases.
Deployment notes
Docker Compose is the documented path for a small deployment. It runs the Authentik server and worker with PostgreSQL and Redis. Set AUTHENTIK_SECRET_KEY to a long random value before the first start, and keep that value with your backups. The default admin bootstrap credentials belong in your own secret store, not in a committed compose file.
Put the UI behind HTTPS. Create a real admin, turn on MFA for that account, and only then point other applications at the provider.
Data and recovery
Back up the PostgreSQL database and the secret key together. The database holds users, sessions, and application configuration. The key is required to read secrets Authentik stored. Redis is a cache and queue; it is not the source of truth.
Write down the restore sequence, required secrets, exposed ports, and every application that depends on this issuer. A scheduled backup is not complete until a clean host can restore it and pass a functional check.
Important limitation
If Authentik is down, every application that trusts it for sign-in is down too. Keep a break-glass admin path that does not depend on the same outage.
Production checklist
- Pin and record the deployed version.
- Persist every documented data and configuration path.
- Terminate TLS at a maintained reverse proxy or trusted tunnel.
- Restrict administrative interfaces and rotate default credentials.
- Monitor uptime, disk space, certificate expiry, and failed jobs.
- Test an off-host backup with a real restore.
