Quick answer

Authelia is not just a forward-auth gateway anymore — it has shipped an OpenID-Certified OIDC provider since 2021, though it is officially still an open beta with no single-logout. Authentik is the fuller identity provider and no longer needs Redis. Pick Authelia for a tiny declarative footprint, Authentik for breadth and a GUI.

By LK Wood IV · Published 2026-07-23 · Updated 2026-08-24 · ~11 min read · St. Louis County, MO

TL;DR · The whole SERP is arguing about a stale fact

  • "Authelia is only forward-auth" is wrong. Authelia has shipped an OpenID Connect provider since v4.29.0 (May 2021) and is OpenID Certified to five profiles. Apps that speak OIDC can use it directly.
  • But it is still an open beta. Authelia's own roadmap says so, with General Availability not yet started and no single-logout. Certified and beta are both true — every other guide picks one and drops the other.
  • Authentik no longer needs Redis — removed entirely in 2025.10. The current compose file is three services: PostgreSQL, server, worker. Every guide still listing Redis is out of date.
  • Ignore the quoted RAM figures. The 30MB-to-1GB spread across other guides comes with no config, no version and no method on any of them. Authelia on a SQLite file is one container, which plausibly explains the low end — but only Authentik publishes a documented minimum (2 CPU / 2GB, for its Compose install). Authelia publishes none.
  • Authentik's free tier is complete for a homelab. OIDC, SAML, LDAP, SCIM, RADIUS are all open source; Enterprise gates provisioning and compliance, not the protocols.

Versions verified against the GitHub release APIs on 2026-08-22: Authelia v4.39.20, Authentik 2026.8.0. The OIDC beta status is on Authelia's live roadmap; re-check it before you build, because that is the one fact most likely to change.

Comparison diagram of Authelia versus Authentik as self-hosted single sign-on. Authelia on the left: one declarative YAML config, runs as a single container against a SQLite file with no separate database, an OpenID-Certified OIDC provider that is still an open beta with no single sign-out, tiny idle memory. Authentik on the right: a web GUI, a three-service stack of PostgreSQL plus server plus worker with no Redis since release 2025.10, a documented minimum of 2 CPU cores and 2GB of RAM, the widest protocol coverage including served LDAP and RADIUS, with directory provisioning and compliance features gated behind a paid Enterprise tier.

The short version

Every article ranking for this comparison repeats the same personality sketch: Authelia is the light, simple one; Authentik is the heavy, powerful one. That sketch is not wrong, but it is built on top of a fact that stopped being true five years ago, and the whole search result has been copying it forward ever since.

The stale fact is this: Authelia is described as a forward-auth gateway that cannot be a real identity provider. One of the pages currently ranking states flatly that Authelia cannot issue OAuth2 or OIDC tokens at all. It can, it has since 2021, and it is certified. So the useful version of this comparison starts by getting that straight, because it changes who each tool is actually for.

The correction: Authelia is an OIDC provider — and still a beta

Authelia’s documentation says it plainly: “Authelia can act as an [OpenID Connect 1.0] Provider as part of an open beta” (OIDC introduction). This is not a forward-auth trick with headers — it is the real thing. Applications that implement the OIDC relying-party role “can use Authelia as an [OpenID Connect 1.0] Provider similar to how you may use social media or development platforms for login” (provider config).

It is also independently verified. Authelia “is [OpenID Certified™] to the Basic OP / Implicit OP / Hybrid OP / Form Post OP / Config OP profiles” (OIDC introduction). That certification is why the pages calling Authelia “not a real IdP” are simply wrong.

Here is the part no page on the first page of Google states, and it is the whole story: certified and beta are true at the same time. Authelia’s roadmap is explicit — “we have decided to implement [OAuth 2.0] and [OpenID Connect 1.0] as a beta feature. While it’s relatively stable there may inevitably be the occasional breaking change,” and the endpoints “are not enabled by default” (OIDC roadmap). The provider first shipped in v4.29.0, which the GitHub release API dates to 2021-05-05 (release). The roadmap tracks it through numbered beta stages, with General Availability defined as a future stage that “will signify official stability guarantees” and has no version attached yet.

So one set of articles tells you Authelia can’t do OIDC (false), and another tells you it’s certified and therefore production-ready (an overstatement). The accurate statement is the paradox: Authelia’s OIDC provider is OpenID Certified and officially still an open beta, off by default, with occasional breaking changes possible.

The two facts stop fighting once you know what certification actually measures. OpenID Certification tests protocol conformance — that an implementation correctly speaks the spec’s profiles. It says nothing about a project’s own stability commitments, which is what a beta label governs. Authelia’s provider conforms to the specification and carries no stability guarantee, at the same time, without contradiction. That is why quoting only the certification or only the beta tag both mislead.

If you run a handful of apps, can absorb an occasional breaking change at upgrade time, and do not need centralized sign-out, that trade is usually fine. If you need a stability guarantee in writing, it is not there yet.

The clearest gap in Authelia’s provider: single logout

The beta status carries three separate costs — the provider is off until you configure it, breaking changes are possible at upgrade time, and one capability is missing outright. The missing capability is the most concrete of the three, and the sharpest reason to pick Authentik instead. Authelia’s OIDC support chart marks RP-Initiated Logout, Session Management, Front-Channel Logout and Back-Channel Logout all as unsupported (OIDC introduction), and the roadmap places them in a later beta stage that has not started.

In practice: logging out of one application does not sign you out of the others. Each app’s session lives until it expires on its own. For a home setup with a handful of trusted users who close their own browser sessions, that is usually acceptable; if you share access with people who will not, or you need a revoked account to lose access everywhere immediately, it is not. For anything where a real single sign-out matters, it is a genuine limitation, and Authentik’s provider implements front-channel and back-channel logout (Authentik logout docs) where Authelia’s does not. None of the six ranking comparisons we reviewed on 2026-07-21 mentions it — it is the highest-value operational detail on the page.

Authentik: the fuller provider that quietly dropped Redis

Authentik is the broader tool, and its documented architecture is simpler than its reputation. A standard deployment is the server container (which bundles the Core plus an embedded outpost), the worker container, and PostgreSQL (architecture). The current official Docker Compose file defines exactly three services — postgresql, server and worker — plus one volume, and pins the 2026.5.6 image (compose file).

Note what is missing: Redis. Authentik removed it entirely. Caching, the embedded outpost session store and WebSockets all moved to PostgreSQL in release 2025.10, after background tasks moved there in 2025.8 (2025.10 release notes). This matters for the comparison because nearly every third-party writeup — and any AI summary trained before late 2025 — still lists Redis as a hard Authentik dependency. It is not one anymore. The documented trade is roughly 50% more PostgreSQL connections, and a 2026.5 change to a Rust-based worker cut about 200MB of memory per worker container on top of that (2026.5 release notes).

The current stable release is 2026.8.0, published 2026-08-18 (release API). Two upgrade hazards are worth knowing before you commit: Authentik does not support downgrades, and major-version upgrades must be done sequentially — you cannot jump an old install straight to current. Outpost containers, if you run separate ones, must match the server version exactly (upgrade docs).

Footprint: the number everyone quotes and nobody explains

The resource figures across the ranking pages are a mess — Authelia is quoted anywhere from sub-30MB to over 1GB of idle RAM, a tenfold spread for the same product, with no page reconciling it. Before trusting any of them, note what none of those pages provide: not one publishes a config file, a docker stats output, a version, or even whether the figure is idle or under load. They are unsourced numbers.

What we can state from primary docs is the mechanism that most likely explains the spread. Authelia can use SQLite as a file-based embedded backend that needs no separate database server (storage docs). Configured that way it is a single container with a single config file. The same storage doc is candid that SQLite leaves Authelia stateful and steers production and high-availability deployments to PostgreSQL, so the one-container shape is a small-deployment convenience, not a recommended ceiling. Point it at LDAP and other services and the container count and memory climb. So a 30MB figure and a 300MB figure can plausibly both be honest — different deployments rather than different measurements of one thing. We cannot prove that mapping for any specific published figure, because none of them disclose their configuration. Treat the range as a range, and measure your own.

The documented-requirements comparison is cleaner, and it cuts one way: Authentik publishes a minimum and Authelia publishes none. Authentik’s install docs state “2 CPU cores” and “2 GB of RAM” for the Docker Compose deployment (install docs) — scoped to that install path rather than a global floor, and cited by not one ranking page. Authelia’s docs carry no hardware requirements page at all, so its low numbers are community reports, not specification. If you are sizing the machine, our mini PC picks for a home server apply; on a Pi-class board Authentik’s documented 2GB is the constraint to plan around.

What actually costs money in Authentik

Authentik has a paid Enterprise tier, and the ranking pages that mention it name at most a feature or two, leaving a vague impression that “the good stuff is paywalled.” The docs are specific, so we can be too.

The Open Source (free) tier covers OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos and the Proxy/forward-auth outpost, plus browser-based RDP and SSH via RAC — the only listed exclusion is vendor support (pricing). Enterprise, at a documented “$5 / user / month” billed annually, gates ten features on its own published list — enhanced audit logging, viewing and exporting logs, Google Workspace and Microsoft Entra ID provisioning, embedding external OAuth/SAML sources, Chrome Enterprise Device Trust, the Shared Signals Framework, password-history compliance checks, and mTLS client certificates (enterprise features, pricing). Three further gates are announced in release notes rather than on that list, and this is worth knowing because their own provider pages carry no Enterprise badge: WS-Federation (2026.2), SCIM OAuth-token authentication (SCIM provider) and RADIUS EAP-TLS (2025.10). A couple of details cut the other way: base RADIUS with PAP is free (only EAP-TLS is Enterprise), base SCIM with a static token is free (only OAuth-token mode is Enterprise), and the served LDAP directory carries no Enterprise marker at all.

The takeaway for a homelab reader: the free tier is complete. Every authentication protocol you would want is open source. What you pay for is outbound provisioning into corporate directories and a set of compliance features — the things a business needs and a home lab does not.

What the community actually says

Across the r/selfhosted threads on this matchup (community sentiment, not verified fact, read via a mirror on 2026-07-21), the split is consistent and it is not about capability. The most-cited decider is configuration style: Authelia’s single declarative YAML file versus Authentik’s clicked-together GUI. People who ran both tend to land on one honest line — Authentik is more capable, Authelia is easier.

Resource use is the most repeated concrete complaint, and it runs one direction: Authentik’s multi-container stack near 1GB idle versus an Authelia instance a small fraction of that. Two migration patterns show up. People leave Authentik for Authelia to cut resource use and shrink the attack surface, often pairing Authelia with LLDAP for a single-file backup story. People leave Authelia for Authentik when they tire of hand-editing config and want a GUI, per-user self-service password reset (which Authelia plus LLDAP does not offer end users), and a maintained app-integration catalog.

One migration gotcha deserves a callout because vendor docs gloss it: OIDC apps key each account to the issuer plus the identity provider’s opaque sub claim, so switching IdPs changes every user’s sub and can strand existing app-side accounts. There is no clean user-export path between the two; the durable answer people land on is to put users in an external LDAP so the IdP only does authentication and the next migration is painless. If you are choosing now, choosing an external directory early is the move that saves you later.

Run Authelia if / run Authentik if

Run Authelia if a light single-container deployment covers your needs, you prefer one declarative config file you can version-control and back up as a single artifact, and your apps either sit behind a reverse proxy for forward-auth or speak OIDC natively. Accept the trade: the OIDC provider is a certified beta, and there is no single sign-out yet. (If footprint is the only thing you care about, note that the community increasingly points at even lighter single-purpose tools like Pocket ID or Tinyauth — neither is a full IdP, but neither pretends to be.) If you already run a reverse proxy, our Caddy vs Nginx Proxy Manager vs Traefik comparison covers the layer Authelia’s forward-auth sits behind.

Run Authentik if you want a web GUI over YAML, the widest protocol coverage — including a served LDAP directory and RADIUS, not just LDAP as a login backend — self-service password reset for non-technical users, or working single logout. Budget 2GB of RAM for it, and if you are standing it up, our Authentik SSO setup guide walks the deployment end to end.

Whichever you pick, an auth server is the front door to everything else you self-host, so it belongs in your backup rotation from day one — encrypted offsite copies via restic are the minimum bar, and a self-hosted password manager like Vaultwarden pairs naturally with either behind SSO. One more input to the decision: not every app will talk to your new identity provider for free. A growing list of self-hostable apps paywalls native OIDC or SAML — PLANKA joined them in August 2026 — and the self-hosted SSO tax tracker records who charges, what it costs, and where SSO stays free.

What competing guides skip (our angle)

Four things almost never make it into other comparisons, and they are the four that actually decide it.

First, the certified-and-beta paradox. The SERP is split between pages saying Authelia can’t do OIDC (false) and pages calling it production-ready (incomplete). The accurate statement is both: OpenID Certified and officially an open beta, off by default. Stating only half misroutes readers in both directions.

Second, the single-logout gap. Authelia’s provider does not implement RP-initiated or channel logout yet, so signing out of one app leaves the others signed in. It is the clearest capability reason to choose Authentik, and no ranking page names it.

Third, Authentik dropped Redis. Removed in 2025.10; the current stack is three services. Every guide still listing Redis is describing a 2025-and-earlier Authentik.

Fourth, the resource figures on this SERP are unsourced. Not one of the six ranking pages discloses a config, a version, or an idle-versus-load distinction behind its RAM numbers, which is why the same product is quoted across a tenfold range. The documented comparison is the one worth having: Authentik states 2 CPU and 2GB for its Compose install, Authelia publishes no hardware requirements at all, and no ranking page reports either fact.

Sources

Frequently asked questions

Is Authelia an identity provider or just a forward-auth gateway?
Both. Authelia started as a forward-auth companion for reverse proxies, but it has shipped an OpenID Connect 1.0 Provider since v4.29.0 in May 2021, and that provider is OpenID Certified to five profiles. Apps that speak OIDC natively can use Authelia directly as their identity provider. The catch is maturity: Authelia’s own docs and roadmap still label the OIDC provider an open beta, with the General Availability stage not yet started. It works and is certified, but the project reserves the right to make occasional breaking changes, and it is off by default until you configure it.
Does Authentik still require Redis?
No. Authentik removed Redis entirely in release 2025.10, moving caching, the embedded outpost session store and WebSockets to PostgreSQL, after moving background tasks there in 2025.8. The current official Docker Compose file defines exactly three services — PostgreSQL, server and worker — with no Redis container. Almost every third-party comparison still lists Redis as a requirement, and any AI answer trained before late 2025 will repeat that. It is out of date. The documented side effect of the removal is roughly 50% more PostgreSQL connections.
How much RAM does each one use?
Treat every published figure with suspicion, including the ones in other comparisons. Authelia is quoted anywhere from about 30MB to over 1GB across different articles, and not one of those pages discloses its configuration, version, or whether the number is idle or under load. What is documented: Authentik’s install docs state 2 CPU cores and 2GB of RAM for the Docker Compose deployment, while Authelia publishes no hardware requirements at all. Authelia can run as one container against a SQLite file, which plausibly explains the low end. Measure your own deployment.
Which Authentik features cost money?
The core protocols are all free: Authentik’s Open Source tier covers OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos and the reverse-proxy outpost, plus browser-based RDP and SSH. Enterprise, at a documented 5 dollars per user per month, gates directory provisioning to Google Workspace and Microsoft Entra ID, the Shared Signals Framework, WS-Federation, SCIM OAuth-token auth, password-history policy, mTLS and, most practically, vendor support. For a homelab, the free tier is genuinely complete; the paid gates are provisioning and compliance features a business reaches for, not a home user.
Can Authelia do single sign-out?
Not through its OIDC provider yet. Authelia’s support chart marks RP-Initiated Logout, Session Management, and both Front-Channel and Back-Channel Logout as unsupported, and its roadmap places them in a later beta stage that has not started. In practice that means logging out of one app does not propagate a logout to the others. For a homelab this is often acceptable, but if centralized single sign-out is a hard requirement, it is a real reason to choose Authentik, whose provider implements front-channel and back-channel logout. None of the ranking comparisons we reviewed mentions this gap.
Which should I self-host, Authelia or Authentik?
Run Authelia if a light single-container deployment covers your needs, you prefer one declarative YAML config you can back up as a single file, and your apps either sit behind a reverse proxy or speak OIDC. Run Authentik if you want a web GUI, the widest protocol coverage including a served LDAP directory and RADIUS, working single logout, or per-user self-service password reset. The community one-liner is fair: Authentik is more capable, Authelia is easier. Both are free for everything a homelab needs.

Evidence ledger

Last updated
Methodology
This homelab guide was written and edited by Lowell K. Wood IV in St. Louis County, MO. Specs and prices verified against vendor and project documentation current on the date above. Full editorial standard: methodology.
Update log
  • 2026-08-25 — Last reviewed and updated.
Corrections
Spotted an error or a stale number? Email hello@techfuelhq.com. Confirmed corrections are added to the update log above.

About the author

Written by Lowell K. Wood IV, who builds and runs TechFuelHQ from St. Louis, Missouri.