Authentik vs Authelia vs Keycloak: Self-Hosted SSO in 2026

A homelab starts with one login. Then it has ten: Grafana, Portainer, Gitea, Nextcloud, a dashboard, and that one admin page nobody has opened since last winter.

At that point, separate passwords are not a security strategy. They are a future support ticket you file against yourself. Self-hosted single sign-on (SSO) fixes that, but only if you choose a tool that matches the problem.

The short answer: use Authentik for the most capable all-round self-hosted SSO, Authelia when you mainly need a clean login wall in front of a reverse proxy, and Keycloak when you are operating an application platform rather than a homelab.

The quick comparison

All three can enforce MFA, centralize identities, and stop you from spraying credentials across services. They are not interchangeable, though.

First, separate two identity jobs

People often call every login product “SSO,” which makes comparisons fuzzy.

The first job is application identity: your app redirects a user to an identity provider, receives an OIDC or SAML response, and creates a session. Nextcloud, Grafana, and many developer tools can do this directly.

The second job is network-side access control: a reverse proxy asks whether a browser is authenticated before it forwards a request to an app. This is useful for older apps that have no SSO support at all.

Authentik and Authelia can do both. Keycloak is excellent at the first job, but it is not the tool I reach for just to put a login screen in front of five internal dashboards.

Authentik: the sensible default

Authentik is the option I recommend when a homelab has grown beyond a weekend experiment. It has a proper UI for users, groups, applications, providers, enrollment flows, and MFA. That matters more than people admit once you come back six months later.

It speaks the protocols that self-hosted software actually asks for: OIDC/OAuth 2.0, SAML, LDAP, and proxy authentication. You can connect a modern app with OIDC, then protect a stubborn old admin interface with an outpost behind your reverse proxy.

The trade-off is moving parts. A typical deployment includes the server, a worker, PostgreSQL, Redis, persistent media, and an outpost for proxy mode. That is still perfectly reasonable on a small VPS, but it is not a one-container toy.

When I would choose Authentik

Choose it when you want one identity home for a mixed stack:

• OIDC for apps such as Grafana or Nextcloud
• Proxy protection for apps that only understand local passwords
• Groups for admins, family, developers, or guests
• TOTP or WebAuthn MFA without a pile of browser extensions
• A UI that another person can use without reading YAML first

My strong opinion: the UI is a feature, not a concession. Identity configuration is security-sensitive. A readable screen that shows which app has which redirect URI is safer than a clever config directory only one person understands.

The gotcha

Do not expose the Authentik admin interface as a casually public service and call the work finished. Use a long admin password, require MFA, keep updates moving, and back up PostgreSQL plus the application secrets. Losing the database is annoying; losing the secret material can turn restore day into a small disaster.

Authelia: the focused front door

Authelia is the leaner choice. Its central idea is straightforward: put it behind Caddy, Traefik, Nginx, or Nginx Proxy Manager, then require authentication before a request reaches an internal app.

That is a great fit for a private dashboard collection. Portainer, Proxmox, Uptime Kuma, Home Assistant, and a dozen small tools can sit behind one consistent login and MFA prompt, even when they do not support OIDC themselves.

Authelia now supports OIDC too, so it is not only a proxy gate. Still, I would choose it because I want its focused access-control model, not because I am trying to replace a full identity platform.

When I would choose Authelia

Pick Authelia if these statements sound like your setup:

• Most services are reached through one reverse proxy
• You have a small number of users
• You prefer declarative configuration and a smaller surface area
• You want two-factor authentication before any internal dashboard loads
• You do not need a complex application catalog or enterprise federation

Pairing it with Lightweight LDAP Directory Access Protocol storage such as LLDAP can make sense when several services need a directory. If your user list is just you and one other person, do not build LDAP because a diagram on the internet looked impressive. A local file or minimal backend can be the correct answer.

The gotcha

Proxy authentication protects the route you configure, not every accidental path to the service. If Docker publishes an app on 0.0.0.0:3000, a user on the same network may bypass your proxy entirely.

Bind private app ports to 127.0.0.1, restrict them with a firewall, or place them on a private Docker network. The authentication layer must be the only door, not the nicest-looking door.

Keycloak: serious power, serious responsibility

Keycloak is a mature identity and access management platform. It handles realms, clients, roles, identity brokering, user federation, social login, SAML, OIDC, and more policy detail than most homelabs will ever need.

That is not a criticism. If you run several custom applications, need to connect to a corporate directory, or have customers rather than household members, Keycloak can be exactly the right foundation.

For a typical self-hosting stack, though, it is easy to overbuy. The admin console exposes a lot because the product solves a lot. A rushed configuration can leave you with powerful features, unclear ownership, and no confidence about which client is allowed to redirect where.

When I would choose Keycloak

Use Keycloak when you need one or more of these:

• Several custom applications with their own roles and clients
• SAML integrations that are not optional
• Identity brokering with an existing external provider
• Directory federation with an established organisation
• A team already comfortable operating Java-based infrastructure and a database

If your actual requirement is “ask for MFA before Portainer opens,” Keycloak is the wrong kind of impressive. A reliable homelab has fewer components to patch, back up, and explain at 23:00.

The gotcha

Treat realms, clients, redirect URIs, and administrator accounts as production configuration from day one. Keep redirect URIs exact, disable development shortcuts, and test an admin recovery path before delegating login to the platform.

Also, plan upgrades. Identity systems are the last service you want to discover is pinned to an old container because nobody practiced the database migration.

What deployment looks like in practice

For a first pass, use Docker Compose and put the identity service behind an HTTPS reverse proxy. Do not make the identity server reachable through random high ports on the public internet.

A deliberately small network layout looks like this:

Internet or private VPN
        |
   reverse proxy :443
        |
   Authentik / Authelia
        |
private Docker network
        |
Grafana, Portainer, Uptime Kuma, and other apps

For Keycloak, applications normally redirect browsers to the Keycloak HTTPS endpoint and validate the returned tokens themselves. The apps still need private networking and normal patching. SSO does not turn an exposed admin panel into a good idea.

Use a real DNS name and HTTPS before configuring clients. Redirect URI mistakes are the most common source of “it logs in, then throws me back to the login page” misery. Wildcard redirects feel convenient but create room for attacks, so register the exact callback URLs each app documents.

A migration plan that does not ruin your weekend

Do not switch everything to SSO in one session. Identity outages have a special talent for locking administrators out of the thing that would fix the identity outage.

1. Deploy the provider and create two admin accounts with MFA.
2. Back it up and prove you can restore it somewhere disposable.
3. Add one low-risk app using OIDC or proxy authentication.
4. Keep that app’s local administrator account until the new login works from a second browser.
5. Add groups and access rules before moving more services.
6. Move critical infrastructure last, with a documented break-glass account.

I would start with Grafana or a personal dashboard, not your hypervisor. Make a mistake where the consequence is a mildly annoying tab refresh, not a drive to the rack with a keyboard.

Security rules worth keeping

SSO can reduce password reuse. It can also create a single high-value target. Treat the identity service accordingly.

• Require MFA for administrators, preferably WebAuthn security keys where practical.
• Use a password manager for recovery codes and emergency local credentials.
• Back up databases, configuration, media, and secrets together.
• Keep service ports private so the reverse proxy or VPN is the enforced path.
• Review groups and stale user accounts every few months.
• Monitor login failures and update notifications.

For remote administration, a private overlay network is usually cleaner than exposing identity and dashboard endpoints to the whole internet. A VPN does not replace application authentication, but it removes a large amount of background noise from the public web.

The verdict

Pick Authentik if you want the best general-purpose self-hosted SSO service. It is the sweet spot for people with a real collection of apps, a few users, and a preference for understandable administration.

Pick Authelia if your main goal is to lock down reverse-proxy routes with a smaller, focused tool. It is excellent when the proxy is the center of your access design.

Pick Keycloak if identity is part of the product you operate, not just the infrastructure you tinker with. Its complexity earns its keep in the right environment. It is unnecessary weight in the wrong one.

Start with one app, MFA, and a tested backup. The glamorous part of SSO is the one-login experience. The useful part is knowing you can still get back in when something breaks.

Related reading:

• Authentik: self-hosted SSO
• Authelia and LLDAP for self-hosted SSO
• Caddy vs Nginx Proxy Manager vs Traefik
• Secure your VPS

Published September 2, 2026. Verify current configuration options against the official Authentik, Authelia, and Keycloak documentation before deploying.