Authentik shipped version 2026.8.3 on September 17, 2026, establishing the open-source identity provider as a prominent alternative to Keycloak in self-hosted environments.
Why Authentik Is Displacing Keycloak in Self-Hosted Stacks
The core architectural difference centers on database dependencies and configuration models. Since releasing version 2025.10, Authentik dropped its Redis dependency entirely. This reduction cuts a standard self-hosted identity stack down from four containers to three, simplifying deployment for system administrators.
While Keycloak relies on a Java-heavy realm model and authenticator bindings, Authentik utilizes a flow-based configuration model. Administrators build login, enrollment, and password-reset sequences as visual flows composed of interchangeable stages. This visual logic enables complex edge cases—such as enforcing password resets specifically for users lacking multi-factor authentication—without custom code.
Understanding Flows, Stages, and Outposts
Three primary concepts govern an Authentik deployment. A flow represents a named sequence that a user traverses, such as the default authentication or enrollment flows. A stage constitutes a single step inside that sequence, encompassing identification, password entry, authenticator challenges, consent screens, or user-write operations during signup.
Outposts function as lightweight proxy agents capable of protecting applications that lack native OpenID Connect (OIDC) or SAML support. This capability mirrors features found in Authelia but pairs them with Authentik’s extensive policy engine.
The platform distributes under an MIT-style open-source license through Authentik Security Inc., offering core protocols, unlimited users, multi-factor authentication, and policy engines without licensing fees.
Deployment and System Requirements for Version 2026.8.3
Deploying Authentik 2026.8.3 requires a blank Linux host configured with Docker Engine and Compose v2. Administrators download the official Compose template, generate secure environment secrets, and launch the container stack. The initial deployment initializes PostgreSQL as the primary database handling both transactional data and caching operations previously assigned to Redis.
Post-installation configuration involves completing the setup wizard, establishing the primary administrative account, and connecting either built-in directories or external identity sources. Production environments typically position Authentik behind a reverse proxy utilizing Transport Layer Security (TLS) alongside integrated WebAuthn and TOTP multi-factor authentication.
Frequently Asked Questions
Why did Authentik remove its Redis dependency?
Authentik removed Redis starting with version 2025.10 to streamline self-hosted deployments by folding caching, background tasks, and WebSocket handling directly into PostgreSQL, reducing the required container count from four to three.
How does Authentik handle applications without native OIDC support?
Authentik uses lightweight proxy agents called outposts to protect applications that do not natively speak authentication protocols like OIDC or SAML.
What licensing model does Authentik use?
Authentik ships under an MIT-style open-source license provided by Authentik Security Inc., including core protocols, unlimited users, and multi-factor authentication at no cost.
Keep reading