Authelia vs Authentik

Both solve single sign-on for self-hosted apps, but they sit at different points on the scale. Authelia is designed to ride alongside a reverse proxy. The proxy intercepts a request, asks Authelia whether the user is allowed, and Authelia returns yes or no after handling login and any second factor. This forward-auth pattern is simple and adds a login wall in front of apps that have no auth of their own.

Authentik is a full identity provider. Apps delegate authentication to it over standard protocols, and Authentik owns the users, the login flows, the multi-factor policies, and the admin experience. It can do forward auth too, but its reason to exist is being the central identity system that everything else trusts, the way an enterprise would run Keycloak or Okta.

Authelia's appeal is its small footprint and config-as-code model. You define users, access rules, and two-factor policy in YAML, commit it to your repo, and run a single lightweight service. It pairs naturally with Traefik, Nginx, or Caddy, and the documentation centers on those integrations. For a homelab that wants to put a login and TOTP in front of a few internal tools, it is hard to beat on simplicity and resource use.

The tradeoffs follow from that design. There is no rich admin UI; you edit files. User management through flat files is fine for a handful of accounts but does not scale to many users without an LDAP backend. And while Authelia provides an OpenID Connect provider, its center of gravity is forward auth in front of a proxy, not being a full protocol hub for dozens of apps.

Authentik gives you the full identity stack with a polished web interface. It speaks OIDC and SAML so apps can integrate the standard way, offers an LDAP outpost for legacy software, and has a flexible flow engine for building custom login, enrollment, and recovery sequences. If you want users to log in once and reach many apps, manage accounts from a dashboard, and apply MFA policies centrally, this is the tool.

That power costs resources and concepts. A typical Authentik deployment runs the server, a worker, PostgreSQL, and Redis, so it is several containers rather than one small binary. The flow-and-policy model is flexible but takes time to learn. For protecting two or three apps it is overkill; for being the front door to your whole self-hosted estate it is exactly right.

On a small box this difference is real. Authelia runs comfortably alongside everything else and barely registers. Authentik's multi-container stack, with a database and Redis, wants more memory and is more to keep updated and backed up. If you are running on a single mini PC already crowded with services, that weight matters.

Backups differ accordingly. Authelia's state is mostly its YAML plus a small database for sessions and a user file, which is trivial to back up and version. Authentik holds its configuration and users in PostgreSQL, so protecting it means backing up that database properly, the same care you would give any stateful service.

Choose Authelia if your goal is to put authentication and two-factor in front of apps that sit behind a reverse proxy, you like config in files, and you want the smallest possible footprint. It is the pragmatic homelab default for proxy-level protection.

Choose Authentik if you want a central identity provider that many apps authenticate against using OIDC or SAML, you need an admin UI and richer user management, or you require LDAP for older software. It is the better long-term home if SSO across a growing set of services is the actual goal, and you can spare the resources to run it well.