authentik 2026.8.0 is a full identity provider
The codebase matches that scope. Our checkout contained 6,363 files, roughly 617,037 lines of source, and 103.9 MB at commit d694c1c. GitHub identifies Python as the primary language, while the repository also contains a pnpm monorepo, web UI, outpost code, documentation, and enterprise components. The README points small installations to Docker Compose and larger ones to an official Helm chart. AWS CloudFormation and a DigitalOcean marketplace image are other supported entry points.
What happened when we ran it
Our harness detected the Node and pnpm workspace and installed 1,602 packages in 28 seconds. That dependency tree occupied 528 MB. It found no root build script or target, so the build step was skipped. It also found no root test script or target, so tests were skipped. We used Node 22 on Debian with 3 CPUs, 8 GB of RAM, no secrets, and an unprivileged container.
Those numbers describe one repository development surface, not an authentik server deployment. We did not boot the application, migrate a database, open an OIDC flow, or test an outpost. The checkout had 25 CI workflow files, a tests directory, and monorepo workspaces, even though the harness could not select root commands for them. A successful 1,602-package install should not be read as proof that the Python core, Rust components, release images, migrations, or protocol integrations work.
Compose is the short path, recovery planning is the real setup
Docker Compose is the README's recommendation for a small or test environment. Helm is the suggested path for larger Kubernetes deployments. Either can make containers appear quickly. The identity work begins after that: generate secrets, configure a public URL and TLS, connect email, define users and groups, select authentication stages, create providers, map claims, and register callback URLs. Every relying application then needs its own tested logout and recovery behavior.
The 528 MB Node workspace is only one part of a system that becomes a login dependency for other services. Back up the database and configuration, document an administrator break-glass route, and keep a way to reach critical infrastructure when SSO is unavailable. Test restore procedures before onboarding the last local admin account. A status page saying the containers are healthy does not prove that SAML metadata, OIDC redirects, LDAP sync, MFA enrollment, or proxy headers work from a user's network.
Release 2026.8.0 deserves a staged upgrade
The latest GitHub release was 2026.8.0, published on August 18, 2026. Its changes cover OAuth2, SAML, SCIM, RADIUS, proxy outposts, task status, session deletion, web forms, documentation, and enterprise features. Identity releases touch data and many protocols, so even a normal update can change behavior outside the admin UI. Pin an exact image tag and read the release documentation rather than following a floating latest tag.
Issue #25445 reports server and worker crash loops while upgrading a Compose installation from 2026.5.6 to 2026.8.0. Issue #25469 reports Microsoft Active Directory synchronization breaking after the same upgrade. Issue #25485 reports proxy outposts marked unhealthy because of a changed executable path. These are user reports, not failures we reproduced. They are specific enough to justify restoring a production backup into staging and testing startup, directory sync, proxy health, and login flows before scheduling downtime.
Protocol breadth is authentik's best reason to choose it
A mixed environment rarely uses one identity protocol. New applications may accept OpenID Connect, enterprise software may require SAML, network devices may speak RADIUS, and old applications may need LDAP or a reverse-proxy header. authentik can centralize those paths around shared users, groups, flows, and policies. Official outposts and deployment guides reduce the custom glue a platform team would otherwise maintain.
GitHub reported 25,156 stars, 1,964 forks, and 1,066 open issues and pull requests combined. The repository was pushed on August 26, 2026, eight days after the latest release. That combination shows current maintenance and a large support surface. The issue count is not 1,066 confirmed bugs because GitHub includes pull requests. It still signals the range of deployments maintainers and operators must handle. Check activity for the exact protocol and deployment method you plan to use.
Licensing has community and enterprise boundaries
The README displays three licenses: MIT for community code, CC BY-SA 4.0 for the website material, and a separate authentik enterprise license for enterprise components. GitHub therefore reports the repository license as unclassified rather than one SPDX identifier. A normal community deployment can still be straightforward, but companies packaging, modifying, or redistributing mixed repository components should identify which directories they use.
Our 6,363-file checkout makes that boundary worth checking during source-based development. The enterprise offering is positioned as an option for organizations replacing commercial identity providers. Evaluate required features against the community edition and enterprise terms before designing flows around them. License review is especially important if a team copies website documentation, builds custom images from the whole monorepo, or depends on enterprise-only directories. Do not infer one license from the badge at the bottom of a multi-license README.
Choose authentik for several protocols, not one password prompt
authentik is a good fit when self-hosting is a firm requirement and the application estate spans OIDC, SAML, LDAP, RADIUS, or proxy authentication. Its current release cadence, official deployment choices, and large community make it a credible platform. The tradeoff is operational ownership of a system that can lock everyone out. Small homelabs can use Compose, but they still need backups and a recovery account.
Our lab could only say that 1,602 pnpm packages installed in 28 seconds; it could not build, test, or start the full product from the root. Treat the release containers and official deployment guide as the evaluation path. Build a staging copy with representative applications, restore a backup into it, test MFA and directory sync, and simulate authentik being unavailable. If that sounds excessive for the problem, Authelia or an application's own login may be the better choice.