authentik

authentik is a self-hosted identity provider that handles sign-in, single sign-on and multi-factor authentication for your applications. It is open source, so teams can read the code and keep their user data on servers they control.

authentik sits in front of your applications and decides who can sign in and what they can reach. It supports OAuth and OIDC single sign-on, and you can customize each login step with templates, infrastructure as code and an API. An application proxy can add sign-in to apps that have no login of their own. Deployment works with Docker Compose, Kubernetes and Terraform.

• Single sign-on over OAuth and OIDC
• MFA and passkey sign-in with WebAuthn
• Conditional access policies
• Application proxy for apps without login
• Scheduled user offboarding

IT and security teams that want identity to stay inside their own infrastructure. It also suits developers running internal tools, and companies that need one setup covering both business users and public customers.

authentik is open source and can be self-hosted. The site says core features do not cost extra, and enterprise support is offered as a separate option. Running it yourself means you are responsible for servers, backups and updates, so plan for that time when you deploy.