authentik vs Ory Kratos
Both are alternatives to Auth0. Here's how they stack up — verified facts, no spin.
authentik
A modern, self-hostable identity provider with a flexible visual flow builder.
authentik is a self-hosted identity provider built around a visual 'flow' system that lets you customize login, enrollment, and recovery steps without deep protocol expertise. It supports OIDC, SAML, LDAP, SCIM, and social login, and ships as a straightforward Docker Compose or Helm deployment aimed at teams who want Keycloak-class capability with a friendlier setup experience.
Ory Kratos
A headless, API-only identity server for teams that want to build their own login UI.
Ory Kratos is a headless identity and user-management server — it handles registration, login, MFA, account recovery, and profile management entirely through APIs, with no bundled UI. It's designed for teams who want full control over the login experience and are comfortable building their own frontend against a well-documented identity API.
Side by side
| authentik | Ory Kratos | |
|---|---|---|
| Sovereignty Score | 85 | 84 |
| Open source | Yes | Yes |
| Self-hostable | Yes | Yes |
| Local-first | Yes | Yes |
| License | MIT (core); authentik/enterprise/ subdirectory carries its own separate license for paid enterprise features | Apache-2.0 |
| Pricing | Free / self-host for the core MIT-licensed product; a hosted 'authentik Security' cloud offering and an Enterprise tier (support SLA, extra features under the separate enterprise/ license) are available paid. | Free / self-host under Apache-2.0; Ory Network offers a managed hosted version with a free tier and paid usage-based plans for teams that prefer not to operate it themselves. |
authentik edges it on the Sovereignty Score, but the right pick depends on the trade-offs below.
authentik
Strengths
- +Genuinely MIT-licensed for the core product — no AGPL copyleft concerns for embedding or forking
- +Visual flow builder makes multi-step login/enrollment/recovery customization far more approachable than editing raw protocol config
- +Good out-of-box support for LDAP and SCIM alongside OIDC/SAML, useful for bridging older enterprise directories
- +Active, fast-moving project with frequent releases
Trade-offs
- −The enterprise/ directory ships under authentik's own separate license, not MIT — some advanced features are gated behind the paid tier even when self-hosting the core
- −Younger and smaller community than Keycloak, so fewer third-party guides and Stack Overflow answers exist for edge cases
- −Flow builder flexibility means misconfiguration is possible; production hardening still requires real identity-ops knowledge
Ory Kratos
Strengths
- +Clean Apache-2.0 license with no enterprise-only carve-out directory, unlike several peers
- +Headless-by-design means zero UI lock-in — build exactly the login experience your product needs
- +Pairs well with companion Ory projects (Hydra for OAuth2/OIDC server, Keto for permissions) for teams that need the full stack
- +Strong documentation and a security-first design philosophy from the Ory team
Trade-offs
- −Headless-only means you must build and maintain your own login/registration UI — meaningfully more upfront engineering work than Auth0's Universal Login or authentik's flow builder
- −Running the full picture (Kratos + Hydra + Keto) for OAuth2/OIDC server capability adds operational complexity beyond a single service
- −Smaller ecosystem of ready-made UI kits/themes compared to Keycloak or authentik
Facts verified 2026-07-14. Licenses and pricing change — spotted something out of date? That's a correction we want.