Authelia

Open source alternative to Okta, Microsoft Entra ID, Auth0 and Cisco Duo

29.4K stars
Apache-2.0
Active this week
Last commit today

Last verified Oct 24, 2026

Secure web apps with self-hosted multi-factor authentication and single sign-on. An OpenID Certified reverse proxy companion, licensed Apache-2.0.

Visit website GitHub29.4K Deploy on Hostinger

Read the full breakdownWho it is for, how it works, trade-offs, the quick start and the FAQ

who it's for

Who Authelia is for#

Home lab operators running multiple self-hosted services

If you run Jellyfin, Nextcloud, Grafana, and several other services behind a reverse proxy, Authelia gives you a single login portal and enforces TOTP or WebAuthn across all of them without touching each application's settings.

Skip if:

Your self-hosted stack is a single service. The overhead of configuring Authelia plus a database and Redis is not justified for one application.

Small teams replacing per-user SaaS identity costs

Teams that hit the free-tier limits on Auth0 or Okta and face per-user billing can move to Authelia on their own infrastructure. Apache-2.0 licensing means no seat-based costs, and the OpenID Connect provider functionality covers most application integrations.

Skip if:

Your team lacks the DevOps capacity to maintain the Authelia instance, database, and Redis over time. A managed identity provider carries that operational overhead for you.

Engineers hardening a containerized internal stack

Authelia's forward-auth model fits naturally into an existing reverse proxy setup. The Helm chart covers the Kubernetes path, LDAP integration allows using an existing directory service for users, and Docker images are published for every release.

Skip if:

You need deep SCIM user provisioning, workflow-based access requests, or audit logging at the level of an enterprise IAM product. Authelia covers authentication; it is not a full identity governance platform.

Deployments with data residency or air-gap requirements

Organizations that cannot route authentication events through third-party cloud services (regulatory requirements, internal policy, or air-gapped environments) gain a fully on-premises authentication layer with Authelia under an Apache-2.0 license.

Skip if:

You operate in an environment where a formal compliance certification (SOC 2, FedRAMP) is required from your identity provider. Authelia does not carry these certifications.

the problem

The problem it solves#

Managing authentication across a fleet of self-hosted services is tedious and inconsistent. Each application has its own login flow, its own session management, and varying levels of MFA support. Adding TOTP or hardware key support to each service individually means configuring each one separately, and some apps simply lack built-in second-factor support at all.

The deeper issue is session fragmentation. A user visiting five internal tools needs five separate logins, and an operator enforcing a security policy must do so five separate ways. Commercial identity providers like Okta and Auth0 address this for cloud deployments but require routing authentication through third-party infrastructure at subscription cost. Self-hosted stacks have historically lacked a practical equivalent.

how Authelia solves it

How it solves it#

OpenID Connect 1.0 and OAuth 2.0 Provider

Authelia is an OpenID Certified OpenID Connect 1.0 provider, allowing OIDC-capable applications to delegate authentication to it using standard OAuth 2.0 flows. Any app that supports OIDC integration points to Authelia instead of managing its own authentication stack.

Multiple Second-Factor Methods

Supports TOTP (time-based one-time passwords for authenticator apps), FIDO2/WebAuthn hardware security keys, passkeys, and push notification-based second factors. Users choose the method that fits their setup; access policies can enforce a minimum required factor per domain.

Reverse Proxy Forward Authentication

Authelia integrates as a forward authentication endpoint for reverse proxies. Each incoming request passes through Authelia for session validation before the proxy forwards it to the backend service, so applications require no changes to support centralized authentication.

LDAP and Active Directory Backends

User directories can be backed by LDAP or Active Directory, so Authelia slots into existing enterprise directory structures without requiring a separate user database. Local user files are also supported for smaller deployments without an existing directory service.

Post-Quantum Cryptography Ready

Authelia includes Post-Quantum Cryptography support, listed as a primary feature in the project's repository. This positions it for environments that need to prepare cryptographic infrastructure for future threats to current encryption standards.

Kubernetes and Docker Deployment

Ships as a Docker image (`authelia/authelia` on Docker Hub) with an official Helm chart for Kubernetes via charts.authelia.com. Also available as a .deb package, AUR package, and FreeBSD port for deployments that do not use containers.

strengths · trade-offs

Strengths and trade-offs#

Strengths

Apache-2.0 License with No Per-User CostAuthelia is licensed under Apache-2.0, which permits commercial internal use, modification, and distribution without licensing fees. Unlike Okta or Auth0, which price per monthly active user, there is no ongoing cost beyond the infrastructure you already run.
OpenID Certified with Active DevelopmentThe OpenID Certified badge means Authelia's OpenID Connect implementation has been tested against the official conformance suite. The project has over 29,000 GitHub stars and was last updated in October 2026, indicating a mature and actively maintained codebase.
Authentication Layer Without App ChangesThe forward-auth integration model means Authelia protects applications without requiring changes to those applications. Any service behind the reverse proxy inherits centralized authentication, which makes adding new services to a protected stack straightforward.
Credentials Stay on Your InfrastructureAuthentication events, user sessions, and credentials never leave your servers. For teams with data residency requirements or policies that prevent routing authentication through third-party cloud services, an on-premises authentication layer is the only viable path.

Trade-offs

-Multi-Component Setup RequiredA production Authelia deployment needs a running reverse proxy, a relational database (Postgres or MySQL), and a Redis instance for session storage. This is more moving parts than a single-binary tool, and the initial configuration involves YAML files covering each protected domain and access policy.
-No Managed or Hosted OptionAuthelia is self-hosted only. There is no hosted cloud tier for teams that want the functionality without managing the infrastructure. For organizations that need managed identity with SLA guarantees and on-call support, a commercial provider remains the practical choice.
-Policy Management via YAML at ScaleAccess policies and per-domain rules are defined in a YAML configuration file that grows with the number of protected services. Managing hundreds of rules through YAML requires discipline; there is no graphical policy editor in the open-source version.

versus alternatives

Authelia vs alternatives#

Authelia vs Auth0

Auth0 is a managed authentication service. Both cover single sign-on and multi-factor authentication for web apps, but their deployment models differ entirely: Authelia runs on your infrastructure, Auth0 runs on a managed cloud.

Feature	Authelia	Auth0
License	Apache-2.0	Proprietary
Self-hosting	Yes	No
Managed cloud tier	No	Yes
OpenID Connect	Yes (OpenID Certified)	Yes
Per-user pricing	No	Yes (above free tier)

Authelia is the better choice when data residency matters, when per-user costs become significant at scale, or when your architecture already runs behind a reverse proxy you control. Auth0 is the better choice when you need a managed service with enterprise support, compliance documentation, and no infrastructure to maintain.

Authelia vs Okta

Okta is an enterprise identity platform covering SSO, MFA, and user lifecycle management. Authelia and Okta overlap on SSO and MFA; Okta extends further into provisioning, governance, and HR system integrations that Authelia does not cover.

Feature	Authelia	Okta
License	Apache-2.0	Proprietary
Self-hosting	Yes	No
LDAP support	Yes	Yes
OpenID Connect	Yes (OpenID Certified)	Yes
User lifecycle management	No	Yes

For small and mid-sized teams running a self-hosted stack, Authelia covers the core authentication needs at no licensing cost. Okta is the appropriate choice for enterprises that need automated user provisioning, HR integrations, or a vendor that carries formal compliance certifications such as SOC 2 or FedRAMP.

Authelia vs Cisco Duo

Cisco Duo is a multi-factor authentication service focused on adding a second factor to existing logins, including VPN and on-premises applications. Authelia provides both the authentication portal (first factor) and second-factor enforcement in one self-hosted service.

Duo is the stronger choice when you need to add MFA to systems that Authelia cannot protect via reverse proxy integration, or when your organization already uses Cisco infrastructure. Authelia is the better fit when you want full on-premises control over both the authentication layer and second-factor enforcement under an open-source license.

install · quick start

Quick start#

bash

Deploy using Docker; the official image is `authelia/authelia` on Docker Hub.

```bash
docker run -d \
  --name authelia \
  -p 9091:9091 \
  -v /path/to/config:/config \
  authelia/authelia:latest
```

tech stack · detected from GitHub

What it's built on#

Languages: GoTypeScript
Frameworks: ExpressReact
Infrastructure: DockerKubernetesOAuth 2.0

frequently asked

FAQ#

Is Authelia free to use?

Yes. Authelia is open source under the Apache-2.0 license, which means it is free to run on your own infrastructure for any purpose including commercial internal use. There is no hosted tier, no freemium limit, and no per-user fee. Your only cost is the server you run it on.

What infrastructure does Authelia require?

A production Authelia deployment requires a reverse proxy, a relational database (Postgres or MySQL), and a Redis instance for session management. The Authelia binary or Docker container connects these components. For testing, SQLite and an in-memory session store simplify the initial setup before moving to a production-grade configuration.

Does Authelia support passkeys and WebAuthn?

Yes. Authelia supports FIDO2/WebAuthn including passkeys as a second-factor method. Users can register a hardware security key or a device-based platform authenticator. TOTP for authenticator apps and push notification-based second factors are also available as options.

How does Authelia compare to a managed identity provider like Auth0?

Auth0 is a hosted, managed service with a support contract, compliance certifications, and no infrastructure to operate. Authelia is self-hosted and gives you full data ownership but requires maintaining the server, database, and Redis instance yourself. Authelia is the better choice when data residency or cost at scale drives the decision; Auth0 is the better choice when you need a managed service with zero operational overhead.

Is Authelia production-ready?

Yes. Authelia has been in active development since 2016, holds an OpenID Certified badge for its OpenID Connect implementation, and has over 29,000 GitHub stars with a last push in October 2026. It is used in production by home lab operators and small teams. Large enterprise deployments should evaluate whether Authelia's self-managed model fits their operational capacity.

also worth a look