Most "Authentik alternatives" lists mix four different kinds of software. Authentik, Keycloak and ZITADEL are identity providers: they own users, credentials and the login itself. Authelia and Pocket ID are narrower providers. Auth.js and Better Auth are code libraries. Cloudflare Access is a gateway that sits in front of applications and asks an identity provider who the user is. Picking well starts with picking the category.
Key Takeaways
- Compare like with like. — Authentik, Keycloak and ZITADEL are identity providers. Authelia is an access proxy with an OIDC provider. Pocket ID is a passkey-only OIDC provider. Auth.js and Better Auth are libraries inside one app. Cloudflare Access is a gateway that consumes an identity provider.
- Cloudflare Access is not the identity provider. — Access decides who reaches an app. It still needs a source of identity: its built-in email code, a social or corporate login, or a generic OIDC or SAML provider you run.
- SAML narrows the field. — Only Keycloak and Authentik are confirmed SAML identity providers in their own docs. Authelia states it does not support SAML 2.0.
- Our pick for a small team already on Cloudflare Access: Authentik. — It covers OIDC, SAML, passkey-only login and an admin UI in one MIT-licensed core. Pocket ID is the lighter choice if passkeys for staff are the only requirement. Keycloak is the choice when governance and enterprise federation outweigh footprint.
Four categories, not eight competitors
An identity provider is the system of record for who someone is. It runs the login, stores passwords or passkeys, federates with Google or a customer's SAML directory, and hands applications a signed answer over OIDC or SAML. A gateway such as Cloudflare Access enforces who may reach an application, and delegates the "who are you" question to a provider. A library adds login to one codebase.
The categories combine rather than compete. A common pattern for a small company is Cloudflare Access in front of internal tools, with one self-hosted identity provider behind it supplying passkey login and a single user directory. That is the setup this comparison is written against.
Side-by-side comparison
Columns in order: Authentik, Keycloak, ZITADEL, Authelia, Pocket ID, Better Auth, Auth.js, Cloudflare Access. "Not confirmed" means the vendor's own documentation did not state it when we checked on 2 October 2026.
| Feature | Authentik | Keycloak | ZITADEL | Authelia | Pocket ID | Better Auth | Auth.js | CF Access |
|---|---|---|---|---|---|---|---|---|
| What it is | ||||||||
| Category | Identity provider | Identity provider | Identity provider | Access proxy + OIDC | Passkey OIDC provider | App library | App library | Access gateway |
| License | MIT core + Enterprise | Apache-2.0 (CNCF) | AGPL-3.0 + exceptions | Apache-2.0 | BSD-2-Clause | MIT | Maintenance mode | Proprietary SaaS |
| Protocols and login | ||||||||
| OIDC provider | | | | Certified | Certified | Plugin | | Consumes OIDC |
| SAML identity provider | | | Not confirmed | | Not documented | Plugin, unverified | | Consumes SAML |
| Passkeys as primary login | WebAuthn stage | Per flow | | Docs disagree | Only method | Plugin | Unverified | Via your IdP |
| Running it | ||||||||
| Storage | PostgreSQL + Redis | External DB | PostgreSQL 14+ | Not verified | SQLite or Postgres | Your app's DB | Your app's DB | None (hosted) |
| Can be the IdP behind Cloudflare Access | | | | | | Only via plugin | | Is the gateway |
Authentik: the broad self-hosted identity provider
Authentik's open-source edition covers OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos and a proxy provider, and the project is OpenID Certified. Its configurable flows are the main differentiator: enrollment, recovery and login are built from stages, and the 2026.8 WebAuthn stage supports passkey-only login with browser autofill. The latest release at the time of writing was 2026.8.3 (17 September 2026).
The cost is footprint. Authentik needs PostgreSQL and Redis and runs as several containers. The core is MIT; an Enterprise tier adds features such as Google Workspace and Entra integrations and more audit logging, priced at $5 per internal user per month. Verdict: the best single-box fit when one team needs OIDC, SAML and passkeys from the same system.
Keycloak: the governance-safe default
Keycloak is a CNCF incubating project under Apache-2.0, which makes it the lowest continuity risk of the group. Its server administration guide documents OIDC and SAML, identity brokering to external OIDC and SAML providers, social login, LDAP and Active Directory federation, and WebAuthn and passkey authentication configured per flow. Release 26.8.0 shipped on 1 October 2026 and added a SCIM API.
It is a Java service with an external database, and its admin console assumes someone who already speaks realms, clients and flows. Verdict: choose it when enterprise federation and vendor neutrality matter more than a small footprint.
ZITADEL: modern, multi-tenant, AGPL
ZITADEL is written in Go with a PostgreSQL 14+ backend and is offered both self-hosted and as a hosted service from the company behind it. Its documentation lists SSO, MFA, passkeys, OIDC and SCIM, plus brokering to Google, GitHub, generic OIDC, SAML and LDAP with just-in-time provisioning. We could not confirm from its docs that it acts as a SAML identity provider for downstream applications. Latest release: v4.19.4 (1 October 2026).
The license is AGPL-3.0 with Apache and MIT exceptions for some directories. Verdict: strong for multi-tenant products; for internal staff login, check the license with counsel and confirm SAML support before committing.
Authelia: an access proxy, not a full provider
Authelia describes itself as a 2FA and SSO authentication server that extends a reverse proxy, with fine-grained rules by domain, user, group, path, method and network. It includes an OpenID Certified OIDC provider, but its OIDC documentation lists SAML 2.0, dynamic client registration and front- or back-channel logout as unsupported. Its GitHub page lists passwordless passkeys, while its OIDC page does not mention them, so we treat passkey-only login there as unconfirmed.
Verdict: the right tool for forward-auth in front of self-hosted apps on one reverse proxy. Behind Cloudflare Access it largely duplicates the gateway's job.
Pocket ID: passkeys and nothing else
Pocket ID is an OpenID Certified OIDC provider that only allows passkeys: there are no passwords to phish or reset. It runs on SQLite or PostgreSQL, supports group-based app access, LDAP sync, SCIM and an audit log, and is BSD-2-Clause licensed. Release v2.17.0 shipped on 1 October 2026.
Its own docs did not show SAML or upstream social login, and account recovery for a lost device needs a defined admin process. Verdict: the lightest credible identity provider behind Cloudflare Access, as long as every user can hold a passkey.
Better Auth and Auth.js: login inside one app
Better Auth is an MIT-licensed TypeScript framework with plugins for two-factor, passkeys, multi-tenancy and SSO; v1.7.7 shipped on 30 September 2026. Auth.js now states on its own site that it is part of Better Auth. Both store users in the application's database.
Verdict: use a library for a customer-facing product that needs its own sign-up. Do not use one to unify staff login across internal tools; that is an identity provider's job.
Cloudflare Access: the gateway in front
Cloudflare Access supports social and corporate providers, generic OIDC, generic SAML and a built-in one-time email PIN, and Cloudflare's integration docs recommend OIDC over SAML. Because the provider behind it speaks standard protocols, the lock-in sits in Access policies, not in user identities: a team can swap the identity provider without re-enrolling at the gateway. Cloudflare's plans page did not show usable seat limits or prices when we checked, so confirm current Zero Trust pricing in the dashboard.
Our recommendation
For a small company that already protects internal tools with Cloudflare Access, keep Access as the gateway and add one identity provider behind it over OIDC. Authentik is our pick: it is the only option here with confirmed OIDC, SAML and passkey-only login together in an MIT core, and its flows cover enrollment and recovery without custom code. Run it as a pilot first, alongside the existing email-code login, and test recovery before anyone relies on passkeys.
Two conditions change the answer. If staff login with passkeys is the whole requirement, Pocket ID does it with far less to operate. If the deciding factor is long-term governance or deep enterprise federation, Keycloak is the safer bet.
For scored data on the self-hostable options, including Ory Kratos, Logto, SuperTokens and Hanko, see our open-source auth tools ranking.
What we could not verify
Vendor documentation does not publish comparable memory figures, so this page makes no RAM claims. Passkey-only login in Authelia, ZITADEL's SAML identity-provider role, Pocket ID's recovery flow and the maturity of Better Auth's identity-provider plugin were not confirmed in primary sources on 2 October 2026. Cloudflare Zero Trust seat limits and pricing should be read from Cloudflare directly.
Sources
All accessed 2 October 2026.
- Authentik documentation, WebAuthn authenticator stage (2026.8), pricing, GitHub
- Keycloak server administration guide, GitHub
- ZITADEL GitHub, identity brokering docs
- Authelia introduction, OpenID Connect integration
- Pocket ID documentation, GitHub
- Better Auth documentation, Auth.js
- Cloudflare One identity provider integration
Frequently asked questions
What is the best alternative to Authentik?
It depends on which part of Authentik you need. For a full identity provider with SAML and long-term governance, Keycloak (Apache-2.0, a CNCF incubating project). For a modern Go-based identity provider with a hosted option, ZITADEL, accepting its AGPL-3.0 license. For passkey-only login on a small team, Pocket ID. For forward-auth in front of self-hosted apps, Authelia. Auth.js and Better Auth are not alternatives: they add login to a single application.
Is Cloudflare Access an identity provider?
No. Cloudflare Access is an access gateway. It decides whether a request reaches an application, and it relies on an identity provider to say who the user is. It ships a one-time email PIN and supports social, corporate, generic OIDC and generic SAML providers. Cloudflare's own documentation recommends OIDC over SAML where both are available.
Can Authentik, Keycloak or Pocket ID be the login for Cloudflare Access?
Yes. Authentik, Keycloak, ZITADEL, Authelia and Pocket ID all act as OIDC providers, which Cloudflare Access accepts through its generic OIDC integration. Access keeps enforcing its policies; the self-hosted provider handles the login itself, including passkeys.
Does Authentik support passkey-only login?
Yes. Authentik's WebAuthn authenticator documentation for version 2026.8 describes passkey-based passwordless login when the resident key requirement is set to preferred or required, and passkey autofill on the identification stage.
Is Authentik free?
The open-source core is MIT-licensed and free. Authentik's pricing page lists an Enterprise tier at $5 per internal user per month (billed annually) and $0.02 per external user, and Enterprise Plus from $20,000 per year. The project states it will not move open-source features into the paid tiers.
Should we use Better Auth or Auth.js instead of an identity provider?
Only if one application needs its own customer login. Libraries put authentication inside an app's code and database. They do not give staff one login across many internal tools. Auth.js's own site now says it is part of Better Auth, so new projects should start with Better Auth.
Ready to Find the Right AI Tools?
Browse our data-driven rankings to find the best AI tools for your team.