Add single sign-on, multi-factor authentication and user self-service to your apps with Authentik, running from a pre-configured AMI in your own AWS account.
Authentik is an open-source identity provider with an MIT-licensed core. It handles sign-up, login, recovery and MFA for your applications, and its visual flow builder lets you shape each authentication step without code.
OAuth2, OpenID Connect, SAML, LDAP and RADIUS.
Design login, sign-up and recovery flows in the admin UI.
Multiple second-factor methods, including WebAuthn.
Add SSO in front of apps that have no login of their own.
Manage users, groups and applications in the browser.
Let users sign in with other identity providers.
The AMI ships Authentik ready for its first-run setup, with SSL handled at launch.
Subscribe on AWS Marketplace and launch the CloudFormation stack with your domain. Allow 5-10 minutes.
Create a DNS record in your Route 53 hosted zone with the PublicIp from the stack outputs.
Open the DashboardUrl, enter your details with a strong password and click Let's start.
Add an application and provider for each app, then set up MFA and your login flows.
An AMI on AWS Marketplace, launched into your own AWS account with a CloudFormation stack.
Launch on AWS | Authentik | Keycloak | Authelia | |
|---|---|---|---|
| Licence | MIT (core) | Apache 2.0 | Apache 2.0 |
| Category | Full identity provider | Full identity provider | Forward-auth middleware |
| Admin UI | Modern web console | Traditional web console | None, YAML configuration |
| SAML, LDAP, RADIUS | All three | SAML and LDAP | None |
| Visual flow builder | Yes | No, config-based flows | No |
Authentik's paid enterprise tier adds features such as remote access; the core is free. Read Authentik vs Keycloak →
An open-source identity provider for managing authentication and authorisation, supporting OAuth2, SAML and OpenID Connect.
The core, including SSO, MFA, SAML, OIDC, LDAP and flows, is MIT-licensed and free. A separate enterprise tier is paid. On AWS you pay for the instance and any Meetrix software fee shown on the listing.
Yes. You set it in the CloudFormation template, and SSL is configured automatically when the domain is hosted on Route 53.
Automatic SSL may fail. SSH into the server and generate the certificate manually with the included script.
Open the DashboardUrl from the stack outputs and complete the setup form. Every later account is created from the admin panel.
Keycloak is older and more battle-tested; Authentik has a more modern UI and more built in, such as RADIUS and an application proxy.
t3.small is the recommended starting point.
Back up your server data, remove the old stack and launch the new version from AWS Marketplace.
Features, protocols and licensing, compared.
A full identity provider against forward-auth middleware.
Stateless nodes, PostgreSQL sizing and shared storage.
We build and run self-hosted identity infrastructure every day, from SSO integrations to high availability. Tell us what you need.
Contact us