authentik vs Ory Kratos
Both are alternatives to Auth0. Here's how they stack up — verified facts, no spin.
Also searched as Ory Kratos vs authentik — same comparison, one verdict.
authentik and Ory Kratos are closely matched on ownership (85 vs 84) — this one comes down to pricing and to which trade-offs below you can live with.
authentik
A modern, self-hostable identity provider with a flexible visual flow builder.
authentik is a self-hosted identity provider built around a visual 'flow' system that lets you customize login, enrollment, and recovery steps without deep protocol expertise. It supports OIDC, SAML, LDAP, SCIM, and social login, and ships as a straightforward Docker Compose or Helm deployment aimed at teams who want Keycloak-class capability with a friendlier setup experience.
Ory Kratos
A headless, API-only identity server for teams that want to build their own login UI.
Ory Kratos is a headless identity and user-management server — it handles registration, login, MFA, account recovery, and profile management entirely through APIs, with no bundled UI. It's designed for teams who want full control over the login experience and are comfortable building their own frontend against a well-documented identity API.
Side by side
10 points of comparison, every one read from a verified field. Green marks the side that wins a row outright. A dash means we do not hold that fact — never that it is zero.
| authentik | Ory Kratos | |
|---|---|---|
| Sovereignty ScoreOur transparent 0–100 composite for data ownership and exit cost. | 85 | 84 |
| Open source | Yes | Yes |
| Self-hostable | Yes | Yes |
| Local-first data | Yes | Yes |
| License | MIT (core); authentik/enterprise/ subdirectory carries its own separate license for paid enterprise features | Apache-2.0 |
| Pricing | Free / self-host for the core MIT-licensed product; a hosted 'authentik Security' cloud offering and an Enterprise tier (support SLA, extra features under the separate enterprise/ license) are available paid. | Free / self-host under Apache-2.0; Ory Network offers a managed hosted version with a free tier and paid usage-based plans for teams that prefer not to operate it themselves. |
| RAM to run it wellThe figure that actually matters, not the vendor's minimum. | 4 GB | 1–2 GB for Kratos, PostgreSQL and a login UI together. Kratos itself is a single Go binary and keeps no state of its own. |
| Realistic running costWhat the box costs each month if you run it yourself. | $15–25/mo, against Auth0 pricing that climbs steeply past the free tier | $6–12/mo for a small app's login service on a 1–2 GB VPS, plus an SMTP provider for verification and recovery emails |
| Setup timeHonest first-install estimate, not the marketing quickstart. | Half a day for the server, longer per application you integrate | An hour for the quickstart; days to a week for production, because you build or adapt the login UI and write the identity schema |
| Ongoing maintenanceThe part nobody budgets for. | Moderate, and the risk is concentrated: this is the front door to everything behind it. | Back up, read the changelog for breaking changes and run `kratos migrate sql` on every upgrade. Open-source releases have come about twice a year (v25.4.0 in November 2025, v26.2.0 in March 2026), and your UI has to keep up with SDK changes. |
authentik edges it on the Sovereignty Score, but the right pick depends on the trade-offs below.
Weighing both against staying on Auth0? Is Auth0 free? What it actually costs →
authentik
Strengths
- +Genuinely MIT-licensed for the core product — no AGPL copyleft concerns for embedding or forking
- +Visual flow builder makes multi-step login/enrollment/recovery customization far more approachable than editing raw protocol config
- +Good out-of-box support for LDAP and SCIM alongside OIDC/SAML, useful for bridging older enterprise directories
- +Active, fast-moving project with frequent releases
Trade-offs
- −The enterprise/ directory ships under authentik's own separate license, not MIT — some advanced features are gated behind the paid tier even when self-hosting the core
- −Younger and smaller community than Keycloak, so fewer third-party guides and Stack Overflow answers exist for edge cases
- −Flow builder flexibility means misconfiguration is possible; production hardening still requires real identity-ops knowledge
Ory Kratos
Strengths
- +Clean Apache-2.0 license with no enterprise-only carve-out directory, unlike several peers
- +Headless-by-design means zero UI lock-in — build exactly the login experience your product needs
- +Pairs well with companion Ory projects (Hydra for OAuth2/OIDC server, Keto for permissions) for teams that need the full stack
- +Strong documentation and a security-first design philosophy from the Ory team
Trade-offs
- −Headless-only means you must build and maintain your own login/registration UI — meaningfully more upfront engineering work than Auth0's Universal Login or authentik's flow builder
- −Running the full picture (Kratos + Hydra + Keto) for OAuth2/OIDC server capability adds operational complexity beyond a single service
- −Smaller ecosystem of ready-made UI kits/themes compared to Keycloak or authentik
Which one fits you
The trade-offs above, turned into a decision. Find the line that describes your team.
Choose authentik
if a lower exit cost matters more to you than any single feature, and genuinely MIT-licensed for the core product — no AGPL copyleft concerns for embedding or forking.
Choose Ory Kratos
if clean Apache-2.0 license with no enterprise-only carve-out directory, unlike several peers.
Neither, yet
if both carry a real cost you should weigh first — the enterprise/ directory ships under authentik's own separate license, not MIT — some advanced features are gated behind the paid tier even when self-hosting the core, and headless-only means you must build and maintain your own login/registration UI — meaningfully more upfront engineering work than Auth0's Universal Login or authentik's flow builder. If either of those is a dealbreaker for your team, the shortlist is wrong rather than the choice.
What it takes to run these yourself
Real requirements and honest running costs, not the vendor quickstart.
Self-hosting authentik
4 GB RAM · Half a day for the server, longer per application you integrate
$15–25/mo, against Auth0 pricing that climbs steeply past the free tier
Self-hosting Ory Kratos
1–2 GB for Kratos, PostgreSQL and a login UI together. Kratos itself is a single Go binary and keeps no state of its own. RAM · An hour for the quickstart; days to a week for production, because you build or adapt the login UI and write the identity schema
$6–12/mo for a small app's login service on a 1–2 GB VPS, plus an SMTP provider for verification and recovery emails
authentik vs Ory Kratos — common questions
Is authentik a better fit than Ory Kratos for authentication & identity?
It depends on what you are optimising for, and the honest split is this: authentik scores 85 to Ory Kratos's 84 on data ownership and exit cost, so it is the safer choice if you care about being able to leave. Ory Kratos earns its place on a different axis — clean Apache-2.0 license with no enterprise-only carve-out directory, unlike several peers. Neither is a wrong answer for every team; the table above is the actual comparison.
What happens if we want to switch later?
authentik keeps its data local or in open formats, so leaving is an export rather than a negotiation. Ory Kratos is still self-hostable, so the files stay on your server either way — but it is not local-first by design, so check what its export produces before you rely on it.
Can I self-host authentik or Ory Kratos?
Both can be self-hosted. The difference is what it costs you in time rather than whether it is possible — see the setup and maintenance rows above.
Are authentik and Ory Kratos both alternatives to Auth0?
Yes — both appear in our Auth0 comparison, which is why they are worth putting side by side. People usually arrive here already having decided to move off Auth0 and now choosing between the two replacements, which is a narrower and much easier question.
Related alternative guides
Facts verified 2026-07-14. Licenses and pricing change — spotted something out of date? That's a correction we want.