Authentik vs Authelia: Adding Single Sign-On (SSO) and 2FA to Self-Hosted Apps

There is a point where self-hosting stops being mostly about getting apps online and starts becoming about deciding how people should reach them.

At first, separate logins feel fine.
Then you add a few more services.
Then a dashboard.
Then something administrative.
Then something exposed only internally but still important enough that “just use the app’s built-in login” starts sounding lazy instead of practical.

That is usually where SSO and 2FA stop being nice ideas and start feeling like overdue structure.

And in homelab circles, two names keep appearing at exactly that moment: Authentik and Authelia.

Both can help.
But they do not feel the same once you actually understand how they think.

The real choice is not just features, but control model

From the official documentation, Authentik presents itself through providers, flows, stages, and outposts. Its docs describe providers such as OIDC/OAuth2, LDAP, SAML, and a proxy provider, while flows and stages define how login and verification steps are built and customized. Outposts then act as the component that connects Authentik to applications it protects.

Authelia’s documentation, on the other hand, presents the system through reverse-proxy integrations, proxy authorization endpoints, access-control rules, OIDC provider configuration, and second-factor configuration. Its docs spend a lot of time on how proxies integrate with it and how requests are evaluated by policy.

That distinction matters.

My read from the sources is this:

• Authentik feels like an identity platform with application connectors and customizable authentication flows.
• Authelia feels like an authentication and authorization layer that works especially naturally beside a reverse proxy.

Both descriptions are favorable.
They just point to different center-of-gravity choices.

Authentik is broader when the app mix is broader

The official Authentik provider docs are very explicit that common providers include OIDC/OAuth2, LDAP, SAML, and a generic proxy provider. Its OAuth2 documentation says Authentik can act as an OpenID Provider, and its proxy-provider documentation says it can protect apps that do not support native protocols such as OIDC, SAML, or LDAP.

That combination is a big deal in a homelab.

It means Authentik is not limited to one style of protection. Some applications can integrate natively with OIDC. Others can sit behind a proxy provider. Others can fit different provider models as your stack grows.

Then there is the flow system. Authentik’s flow and stage documentation shows that authentication is assembled from stages, with different verification or logic steps bound into a flow. Its authenticator stages also document TOTP and WebAuthn enrollment and validation paths.

That creates a clear impression: Authentik wants you to shape identity behavior deliberately.

That is powerful, but it also means you are choosing a more model-rich system from day one.

Authelia feels strongest when your reverse proxy is already the center of the house

Authelia’s official docs make a different impression. The proxy integration documentation is front and center, and the proxy-authorization reference explains how reverse proxies use authorization endpoints to protect applications. The access-control docs then show how rules can be matched by domain, path, subject, network, method, and more.

That gives Authelia a very recognizable homelab feel.

If your environment already revolves around something like NGINX, Traefik, Caddy, or another reverse proxy, Authelia looks less like a separate universe and more like a policy brain attached to the front door you already have.

Its documentation also clearly supports OIDC provider functionality, so this is not just a single-purpose “login screen in front of apps” story. But compared with Authentik, the docs keep pulling your attention back toward integrations, access rules, and protected applications at the proxy boundary.

That tends to make Authelia feel conceptually narrower, but often pleasantly so.

SSO is easier to understand when you separate native integration from protected access

I think this is where people get confused.

There are really two different needs hiding inside “I want SSO”:

• applications that support a native identity protocol like OIDC;
• applications that do not, and must be protected externally.

Authentik clearly supports both stories from its official provider documentation. Its OAuth2 provider supports OIDC, and its proxy provider supports either full proxying or forward-auth modes via outposts.

Authelia also supports both stories, but the language of its documentation makes the reverse-proxy side more central. Its OIDC provider documentation explains that apps can use Authelia as an OpenID Connect provider, while the proxy-authorization and proxy-integration documentation focuses on how protected applications are gated at the reverse proxy.

So the practical question is not “Which one does SSO?”
Both do.

The better question is:

“Do I want my identity layer to feel primarily like an IdP platform, or primarily like an authorization layer woven through my proxy?”

That answer changes everything.

2FA is available in both, but the surrounding experience is different

The official docs show that both projects handle modern second factors well.

Authentik documents dedicated TOTP and WebAuthn setup stages, and its authenticator validation docs show how those stages can be combined inside flows. That makes MFA feel like part of a larger flow-building toolkit.

Authelia’s documentation for TOTP and WebAuthn is also clear. Its TOTP configuration explains the RFC6238 basis and tuning options, and its WebAuthn configuration includes passkey login behavior and how it interacts with one-factor versus multi-factor requirements.

So the difference is not that one has “real 2FA” and the other does not.
The difference is how that 2FA is operationalized.

From the docs, Authentik seems to invite you to think in terms of stages and user journeys.
Authelia seems to invite you to think in terms of policy and enforcement conditions.

That is not a small distinction. It affects how complicated the system feels when you come back to it three months later.

Where Authentik seems more flexible, it may also ask more from you

This is an inference from the official docs, not a benchmark.

Because Authentik documents providers, flows, stages, outposts, and multiple integration patterns, it appears to offer a broader and more customizable identity model. For a homelab that expects to grow across many types of applications and authentication patterns, that can be a real strength.

But flexibility also creates surface area.

If you are the kind of person who enjoys composing authentication logic carefully, Authentik may feel empowering.
If you mainly want a secure, understandable access layer for a reverse-proxy-centric stack, that same model may feel heavier than necessary.

That does not make it worse.
It just makes the operating model more consequential.

Where Authelia seems simpler, it is often because the problem scope is being held tighter

This is my other main inference from the docs.

Authelia keeps bringing the conversation back to proxy integrations, access control, and authentication policy. Even when it documents OIDC provider capabilities and modern second-factor methods, the overall mental model stays close to protected applications at the gateway edge.

That can be extremely attractive in a homelab.

Especially if your environment already looks like this:

• a reverse proxy already fronts most apps;
• access is mostly domain and path based;
• you want stronger auth and cleaner policy;
• you do not necessarily want to design custom authentication journeys.

In that kind of setup, Authelia can feel like a very natural layer rather than a whole identity ecosystem you must first learn to inhabit.

So which one would I choose?

If I wanted the broader identity toolbox, native protocol variety, customizable authentication flows, and room to evolve into a more full-featured identity platform, I would lean toward Authentik.

If I wanted the cleanest path to protecting self-hosted apps through an existing reverse proxy, with strong policy control and solid 2FA options, I would lean toward Authelia.

That is not a verdict about which is objectively better.
It is about which one better matches the shape of the homelab.

To put it more plainly:

• choose Authentik if you want identity to be a richer platform in your stack;
• choose Authelia if you want access control to feel sharp, deliberate, and close to the proxy edge.

What I would avoid before deploying either

I would not introduce either platform without first being clear about three things:

1. which apps support native OIDC and which need proxy-based protection;
2. where the reverse proxy truly sits in the request path;
3. how much complexity I actually want in the authentication layer.

That last point matters more than people admit.

An SSO platform that feels too complicated to maintain will quietly become a stress source, even if it is technically excellent. A simpler system that matches the real topology of your homelab is often the better security choice because you will actually keep it healthy.

Verification note: Commands, terminology, and support details in this guide were cross-checked against authentik’s official documentation and Authelia’s official introduction.

For broader context, continue with Installing Proxmox VE for the First Time: A Practical Guide and The First Homelab Mistakes I Would Never Repeat.

Conclusion

Authentik and Authelia both solve the same broad homelab problem: bringing consistent authentication, SSO, and stronger second-factor protection to self-hosted apps. But the official documentation shows that they solve it from different centers. Authentik is organized around providers, flows, stages, and outposts, which gives it a broad and highly configurable identity model. Authelia is organized around reverse-proxy authorization, access-control rules, OIDC provider capability, and configurable second factors, which gives it a very clear edge-gateway posture.

That is why I would not choose between them by feature-count alone. I would choose based on which mental model I want to operate long term. In a homelab, the best identity layer is not the one with the biggest promise. It is the one you will still understand clearly after six months of adding apps.

FAQ

Is Authentik better only if I need OIDC, SAML, LDAP, and proxy protection together?

Not only then, but that is where its broader provider model clearly stands out in the official documentation. If your app mix is diverse or likely to become more diverse, that wider model may matter a lot.

Is Authelia only for reverse-proxy login walls?

No. Its official documentation also includes OIDC provider capabilities and modern second-factor methods like TOTP and WebAuthn. But the overall operating model still feels especially natural when a reverse proxy is already central to your self-hosted setup.