Authentik pricing 2026: plans and costs
Quick pricing summary
- Open Source: $0 free
- Enterprise: $5 user / month, billed annually
- Enterprise Plus: $20,000 year (starting at)
- Worth noting: Self-hosted only; no hosted version. Enterprise billed annually; service accounts free. Enterprise Plus starts at $20k annually.
Plans
Open Source
$0 free
- Supports OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos, and Proxy
- OpenID Certified for OpenID Connect
- Web-based RDP/SSH access
- OAuth 2.0 token exchange and key-bound ID tokens
- Multi-account switching
- Custom object attributes for users, groups, and more
- Covers B2B and B2C use cases
- Community Discord
- No support
Enterprise
$5 user / month, billed annually
- Everything in Open Source
- Privileged Access Management
- Agent accounts for non-human identity
- Google Workspace integration
- Microsoft Entra ID integration
- Client certificate authentication (mTLS)
- Chrome Enterprise Device Trust connector
- Shared Signals Framework (ABM) support
- Password history compliance checks
- Enhanced audit logging for compliance
- Scheduled user offboarding
- Embed external OAuth/SAML sources
- OAuth2 authentication in SCIM
- Windows local device login
- Self-hosted event maps
- Exportable CSV reports
- Radius EAP-TLS
- Advanced device compliance (in development)
- Ticket-based support for subscriptions over $1k
- $0.02 / external user / month
- No cost for service accounts
Enterprise Plus
$20,000 year (starting at)
- Everything in Enterprise
- Billing and purchase via invoice
- Dedicated, customized support and SLAs
- Volume discounts at thousands of users
- Support for multi-instance deployments
- FIPS compliance for FedRAMP requirements
What you get on each plan
| Feature | Open Source | Enterprise | Enterprise Plus |
|---|---|---|---|
| OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos, Proxy | ✓ | ✓ | ✓ |
| Web-based RDP/SSH access | ✓ | ✓ | ✓ |
| Privileged Access Management | — | ✓ | ✓ |
| Google Workspace / Microsoft Entra ID integration | — | ✓ | ✓ |
| Client certificate authentication (mTLS) | — | ✓ | ✓ |
| Enhanced audit logging | — | ✓ | ✓ |
| Support | Community Discord | Ticket-based support for subscriptions over $1k | Dedicated, customized support and SLAs |
| Invoice billing | — | — | ✓ |
| Multi-instance deployments | — | — | ✓ |
| FIPS compliance | — | — | ✓ |
Hidden costs & add-ons
| Cost driver | Price | When it applies |
|---|---|---|
| External users | $0.02 / external user / month | Enterprise |
Authentik pricing vs alternatives
| Brand | Entry price | Free plan | Model | Best for | |
|---|---|---|---|---|---|
| Authentik | Free; paid from $5 per seat / mo | Yes | Per seat | — | |
| Microsoft Entra ID | — | — | — | — | Compare → |
| Keycloak | — | — | — | Teams that want to self-host standards-based single sign-on and identity brokering for their applications | Compare → |
| JumpCloud | $9 per seat / mo | No · 30-day trial | Per seat | IT teams, from startups to enterprises and MSPs, that manage mixed-OS device fleets and want identity and device management in one platform. | Compare → |
| Microsoft Entra External ID | — | — | — | Organizations building customer-facing or partner-facing sign-in on Microsoft's cloud, including new projects that would previously have used Azure AD B2C. | Compare → |
List prices as published on goauthentik.io/pricing/. Totals are worked examples, not quotes.