Managed Authentik Hosting — production-ready from $15 a month
Identity provider with SSO, MFA, and user management via SAML, OIDC, and LDAP. Deployed on your own dedicated instance in AWS, Azure, or GCP, kept patched, backed up, and monitored by ManageStacks — standard Authentik, no lock-in.
Authentik is a self-hosted identity provider that unifies SSO, MFA, user lifecycle management, and application access under one platform. ManageStacks deploys Authentik with PostgreSQL, Redis, and managed TLS pre-configured.
What does Authentik do, and why do teams deploy it?
Authentik is an open-source identity provider and access management platform that serves as an alternative to Auth0 and Okta. It supports SAML 2.0, OpenID Connect, OAuth2, LDAP, SCIM, and forward-auth proxy protocols, enabling SSO across web applications, internal tools, and legacy systems from a single identity source.
The platform provides a visual flow designer for building authentication and enrollment workflows without code. Flows can include MFA (TOTP, WebAuthn/FIDO2, SMS, Duo), conditional access policies, user self-service registration, password recovery, and account linking from social providers. Authentik also supports SCIM provisioning for automated user lifecycle management across downstream applications.
ManageStacks deploys Authentik with PostgreSQL for the identity store, Redis for session and cache management, and managed TLS. Protect every application behind enterprise-grade SSO and MFA — without the per-user pricing of cloud identity platforms or the operational burden of running your own LDAP directory.
- SSO via SAML 2.0, OpenID Connect, OAuth2, and LDAP
- MFA with TOTP, WebAuthn/FIDO2, SMS, and Duo
- Visual flow designer for authentication and enrollment workflows
- SCIM provisioning for automated user lifecycle management
- Forward-auth proxy for legacy applications without native SSO
- User self-service portal for profile, MFA, and password management
Identity provider with SSO, MFA, and user management via SAML, OIDC, and LDAP
Authentik as a self-hosted alternative to Auth0 and Okta
Instead of paying per-seat fees to a SaaS vendor, teams self-host Authentik to keep full control of their data and infrastructure. ManageStacks removes the operational overhead — you get the cost and privacy benefits of open source with the reliability of a managed platform.
What does managed Authentik hosting cost?
Flat per-app pricing, in your chosen AWS, Azure, or GCP region. No per-user pricing — a busy deployment costs the same as a quiet one.
Starter
Staging and internal tools. Dedicated instance, TLS, daily backups, managed upgrades.
Standard
Production workloads. Adds monitoring, staging environment, region choice, priority support.
Business
High-traffic and compliance workloads. Adds a high-availability replica and same-day support.
24×7 SRE retainer
Round-the-clock on-call across every hosted application, for teams that need a pager answered at 3am.
When is self-hosting Authentik the right answer instead?
“Managed hosting is not always the correct call.”
Self-host when a platform team already runs the infrastructure and on-call rotation to operate Authentik at genuinely low marginal cost. Self-host when compliance requires an air-gapped or on-premises deployment that no hosted option can satisfy. And self-host when the deployment depends on heavy customisation with a fast internal build-deploy loop, because an internal release process will beat any managed change process.
For everyone else — teams whose engineers have better things to do than shepherd upgrades — managed hosting is cheaper than the hours it replaces.
Which cloud should Authentik run on — AWS, Azure or GCP?
For most workloads, the choice of cloud matters less than proximity: run Authentik in the same cloud and region as the applications and data it talks to, because every request between them adds a round trip. The underlying compute performs equivalently across AWS, Azure, and GCP.
In practice, an existing cloud footprint decides it. All plans support all three clouds, and moving regions later is a scheduled migration, not a rebuild.
Deepest managed-service catalog, default when there's no existing footprint
Best fit for teams already on Microsoft 365 or Entra ID
Strongest for data/analytics-adjacent workloads
Every plan supports AWS, Azure, and GCP — region choice included.
Common questions about Authentik on ManageStacks
What is Authentik on ManageStacks used for?
Authentik is a self-hosted identity provider for SSO, MFA, and user management. ManageStacks deploys it so you can secure all your applications with enterprise-grade authentication without per-user cloud identity pricing.
Can Authentik replace Auth0 or Okta?
Yes. Authentik supports SAML, OIDC, OAuth2, LDAP, and SCIM — the same protocols Auth0 and Okta use. It provides a visual flow designer, MFA, conditional access, and user self-service. You eliminate per-user pricing while keeping your identity data on your own infrastructure.
Does Authentik support LDAP on ManageStacks?
Yes. Authentik includes a built-in LDAP outpost that exposes your user directory over LDAP, enabling integration with legacy applications that only support LDAP authentication. ManageStacks configures the LDAP outpost alongside the main identity provider.
How does Authentik handle MFA on ManageStacks?
Authentik supports TOTP (authenticator apps), WebAuthn/FIDO2 (hardware keys), SMS, and Duo as MFA methods. You can enforce MFA per application, per group, or based on conditional access policies through the visual flow designer.
Can Authentik protect applications that don't support SSO natively?
Yes. Authentik's forward-auth proxy sits in front of any web application and handles authentication at the reverse-proxy level. Applications without native SAML or OIDC support get SSO protection without code changes.
Other devtools tools on ManageStacks
Run Authentik without carrying the pager
Subscribe through your AWS, Azure, or GCP marketplace. We handle provisioning, SSL, monitoring, backups, updates, and security. From $15/mo.