---
title: "authentik Docker Compose and one-click hosting"
description: "authentik is an open-source identity provider for SSO with OpenID Connect, SAML, LDAP and passkeys. An Okta alternative you self-host in one click."
---

[← All templates](https://pethost.dev/templates/) · [Passwords and sign-in](https://pethost.dev/templates/security/)

# Deploy authentik in one click

An identity provider for single sign-on to your apps: OpenID Connect, SAML, LDAP, MFA and passkeys

A self-hosted alternative to Okta, Auth0, and Keycloak.

[Deploy on Pethost](https://console.pethost.dev/?template=authentik)

## What is authentik?

authentik is an open-source identity provider: one sign-in, with its own users, groups and multi-factor authentication, for every app you run. It speaks OAuth2 and OpenID Connect, SAML, LDAP, RADIUS and SCIM, and its proxy provider puts a sign-in in front of apps that have none. Sign-in is built from flows and stages in the admin interface, so enrollment, recovery, MFA with TOTP, WebAuthn passkeys or Duo, and sign-in with GitHub, Google, Apple or Discord are settings rather than code.

People self-host authentik to give their own apps single sign-on, as companies do with Okta or Microsoft Entra ID, without paying per user. This template runs authentik’s server, its worker and PostgreSQL, and sets the administrator’s email and password from the fields; authentik has needed no Redis since 2025.10. The catch: LDAP and RADIUS each need an outpost, a container of its own, and a few features, such as the Google Workspace and Entra ID integrations, are in the paid Enterprise edition.

## Hosting authentik on Pethost

1. You sign in to Pethost with a passkey, GitHub or Google. No machine yet? You pick a plan, and the link waits until it is ready.
2. New project opens at authentik. You fill in what it asks for and click Create project: **Email**, **Admin password**.
3. In a minute or two authentik is live at its own address with HTTPS. Its secrets are made at random, and its data is in the nightly backup.
4. It is a project like any other: you or your agent can change it, roll it back or restore it.

## Questions about authentik

**Is authentik free?**

Yes. authentik’s open-source edition is free under the MIT license and includes OpenID Connect, SAML, LDAP, RADIUS, SCIM and the proxy provider. The Enterprise edition starts at $5 per user a month, billed yearly.

**authentik or Keycloak?**

Both are open-source identity providers with OpenID Connect and SAML. authentik builds sign-in from flows in its admin interface, and its own comparison marks LDAP, GeoIP and RDP, SSH and VNC access in the browser as what it has and Keycloak does not, with SCIM and RADIUS in Keycloak only through extensions.

**Does authentik support passkeys?**

Yes. Its WebAuthn stage registers passkeys and security keys, as a second factor or for passwordless sign-in, and the sign-in form offers passkey autofill since authentik 2025.12.

**How do I connect an app to authentik with OpenID Connect?**

In the Admin interface, open Applications → Applications, click New Application, choose OAuth2/OpenID Connect and give the app’s redirect URI. The app then takes the client ID, the client secret and the issuer, https://<your address>/application/o/<slug>/, where it finds the rest.

**Can authentik be an LDAP server?**

Yes, through an LDAP provider and an LDAP outpost, the container ghcr.io/goauthentik/ldap, which serves authentik’s users and groups to apps that only speak LDAP. It is added to compose.yaml with the outpost’s token from authentik.

**How much memory and disk does authentik need?**

authentik takes about 750 MB of memory at rest with PostgreSQL and around 1 GB while it starts; its database grows slowly with events and sessions. On Pethost the Starter plan is enough for it, with room for other apps beside it.

## authentik Docker Compose file

The template is this compose.yaml and the variables written into the project’s .env as it is created. Pethost runs the file as it is written.

**Containers:** server (ghcr.io/goauthentik/server:2026.8), worker (ghcr.io/goauthentik/server:2026.8), postgresql (postgres:16-alpine).

**Volumes, in the nightly backup:** data, certs, templates, database.

```
x-authentik: &authentik
  image: ghcr.io/goauthentik/server:2026.8
  restart: unless-stopped
  depends_on:
    postgresql:
      condition: service_healthy
  shm_size: 512mb
  # Any of authentik's settings can be added to .env, such as AUTHENTIK_EMAIL__HOST and the
  # others that send its email.
  env_file: .env

services:
  server:
    <<: *authentik
    command: server
    environment: &environment
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_POSTGRESQL__USER: authentik
      AUTHENTIK_POSTGRESQL__PASSWORD: ${POSTGRES_PASSWORD}
      AUTHENTIK_SECRET_KEY: ${SECRET_KEY}
    volumes:
      - data:/data
      - templates:/templates

  # The worker runs the background tasks, and at its first start it gives the administrator,
  # akadmin, the email and password given, so authentik's initial setup is never offered.
  worker:
    <<: *authentik
    command: worker
    environment:
      <<: *environment
      AUTHENTIK_BOOTSTRAP_EMAIL: ${ADMIN_EMAIL}
      AUTHENTIK_BOOTSTRAP_PASSWORD: ${ADMIN_PASSWORD}
    volumes:
      - data:/data
      - certs:/certs
      - templates:/templates

  postgresql:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: authentik
      POSTGRES_USER: authentik
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    volumes:
      - database:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -U authentik -d authentik"]
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 30s

volumes:
  data:
  certs:
  templates:
  database:
```

[compose.yaml](https://pethost.dev/templates/authentik/compose.yaml)[See it on GitHub](https://github.com/pethost-dev/templates/tree/main/authentik)

## [More in Passwords and sign-in](https://pethost.dev/templates/security/)

- [**Vaultwarden**A password manager server for the Bitwarden apps](https://pethost.dev/templates/vaultwarden/)
- [**Authorizer**Sign-in for your own apps, with OAuth 2 and OpenID Connect](https://pethost.dev/templates/authorizer/)
- [**Password Pusher**Share passwords and secrets by links that expire](https://pethost.dev/templates/password-pusher/)
- [**FusionAuth**Customer identity and access management: sign-in, registration, single sign-on and MFA for your apps](https://pethost.dev/templates/fusionauth/)
- [**Keycloak**Open-source identity and access management: single sign-on for your apps with OpenID Connect and SAML](https://pethost.dev/templates/keycloak/)

Pethost · Stephan Gomer · NIP 1133096755

Pethost

- [Templates](https://pethost.dev/templates/)
- [About](https://pethost.dev/about/)
- [Docs](https://pethost.dev/docs/)
- [Blog](https://pethost.dev/blog/)
- [API](https://pethost.dev/docs/api/)
- [CLI](https://pethost.dev/docs/cli/)
- [Plugin](https://github.com/pethost-dev/plugin)
- [Terms](https://pethost.dev/terms/)
- [Privacy](https://pethost.dev/privacy/)
- [Refunds](https://pethost.dev/refunds/)
- [support@pethost.dev](mailto:support@pethost.dev)

Databases

- [Postgres](https://pethost.dev/postgres/)

Comparisons

- [Coolify vs Dokploy vs CapRover vs Dokku](https://pethost.dev/blog/coolify-vs-dokploy-vs-caprover-vs-dokku/)
- [Coolify Cloud vs Dokploy Cloud](https://pethost.dev/blog/coolify-cloud-vs-dokploy-cloud/)
- [Railway vs Render vs Fly.io pricing](https://pethost.dev/blog/railway-vs-render-vs-fly-io-pricing/)
- [Managed Docker Compose hosting](https://pethost.dev/blog/managed-docker-compose-hosting/)

Alternatives

- [Railway alternatives](https://pethost.dev/blog/railway-alternatives/)
- [Heroku alternatives](https://pethost.dev/blog/heroku-alternatives/)
- [Dokploy alternatives](https://pethost.dev/blog/dokploy-alternatives/)
- [Coolify alternatives](https://pethost.dev/blog/coolify-alternatives/)
- [Render alternatives](https://pethost.dev/blog/render-alternatives/)
- [Sliplane alternatives](https://pethost.dev/blog/sliplane-alternatives/)