authentik cost of ownership and editions

Overview: what this cost study answers

This page helps a CIO, CISO or platform lead decide which authentik edition fits the organization, and what running authentik costs beyond any subscription fee. The first decision is whether the features you need are in the free Open Source edition or require an Enterprise or Enterprise Plus license. Check that list against your application and directory requirements before you model anything else.

Organizations usually start this work for one of three reasons: they are moving off a per-user SSO tool and want to compare the subscription line with self-hosting, they are running a licensing review and need a defensible cost baseline, or they are choosing a new identity platform and need to compare options on the same terms. Each trigger changes which costs matter most. A migration pushes effort and parallel running into the model, while a licensing review pushes the per-user and external-user charges into focus.

A short cost model can usually be built in-house. Your team needs the current pricing page, the feature list for each edition, a count of internal and external users, and an estimate of the hosting, database and staff time your environment requires. Bring in a partner when the edition, licensing or architecture questions need independent review, such as whether an enterprise-only feature is required, how the license terms apply to your deployment, or how the design affects availability and upgrades.

Scope: what the cost work includes and what you receive

Each deliverable is written so your team can check the reasoning behind the edition choice. DeployOpen prepares the analysis but does not issue licenses or legal opinions, and you receive the cost model with its assumptions listed.

Edition and feature map

A map that matches each planned use case to Open Source, Enterprise or Enterprise Plus. The pricing page places Google Workspace and Entra ID integrations, mTLS client certificate authentication, privileged access management, password history and enhanced audit logging in Enterprise. Check every item against your application list and identity sources before a license line enters the model.

License review of both code paths

A review of the MIT-licensed core and the separately licensed enterprise directory under authentik/enterprise/, which carries its own license terms. We map which code your planned deployment would run, which terms apply to each part, and where internal use or redistribution questions arise. Confirm the final reading with your counsel, since this review is not a legal opinion.

Three-year cost model

A three-year model with separate recurring and one-time lines. Recurring lines cover subscriptions per user and per external user, PostgreSQL, hosting and the staff time needed for upgrades. One-time lines cover planning, configuration, migration and testing. Each line states its assumptions, such as user counts, so you can change an input and see its effect on the total.

Written decision record

A record of the chosen edition, the features that justify it, the options you rejected and the conditions that would reopen the decision, such as a change in user count or a new identity source. It names the owner who approves the decision and the version of the model it relies on. Store it with your architecture records so later upgrades can be traced back to the original reasoning.

What drives cost and effort

This table lists the factors that move authentik total cost of ownership, why each one changes the bill or the effort, and how to keep it under control.

Driver	Why it changes cost or effort	How to keep it down
Internal workforce users	Enterprise pricing on the authentik pricing page is per user per month, billed annually, so the headcount in scope sets the subscription line.	Confirm which populations need SSO through Enterprise and scope only those accounts into the licensed count.
External users	The pricing page lists a separate charge per external user per month, so customers and partners add cost on their own line.	Keep external and workforce identities in separate groups and confirm with authentik how each account type is counted.
Enterprise-only features	Google Workspace, Entra ID, mTLS, privileged access management, password history and enhanced audit logging require the Enterprise edition.	List the required features in the design phase so the edition decision is made before build work starts.
Applications and protocols	Each OAuth2/OIDC, SAML, LDAP, proxy or RADIUS integration adds configuration, testing and cutover effort, whatever the license model.	Group applications by protocol, onboard them in waves and reuse flows, stages and property mappings across them.
Environments	Test, staging, production and disaster recovery each need their own server, worker and PostgreSQL, so infrastructure cost multiplies with each one.	Keep non-production environments small but matched in version and configuration, and confirm licensing terms for each with authentik.
PostgreSQL hosting	authentik keeps all configuration and data in PostgreSQL, and release 2025.10 moved caching, tasks and sessions there, so database load and connection counts grow.	Run production on a separately managed PostgreSQL, as the Kubernetes guide recommends, and size connections after upgrades.
Compliance evidence	Assessors may ask for audit log retention, access reviews and change records, which add collection, storage and documentation work.	Define evidence needs early, confirm which audit logging features your edition provides and list them in the written scope.
Release line maintenance	Security fixes go only to the supported release lines, so staying current adds recurring upgrade and testing effort.	Plan a regular upgrade window on a supported line and include it in the support scope when requesting a quote.

How the cost assessment runs

The assessment moves from what users and applications need, to which edition covers them, to a cost model with sensitivity cases and a decision record that a finance and security review can sign off.

Inventory users, applications and protocols
Your team and the DeployOpen engineer list user populations, including internal staff, external users and service accounts, along with every application and the protocol each one uses, such as OAuth2/OIDC, SAML, LDAP, proxy or RADIUS. The output is a signed inventory that counts licensable users and identifies any Google Workspace, Entra ID or mTLS dependencies.
Map editions and features to license terms
Each required capability is checked against the Open Source, Enterprise and Enterprise Plus feature lists on the authentik pricing page, and the license boundary between MIT-licensed code and the enterprise directory is reviewed with your legal team. The output is a feature-by-edition matrix with open items marked for vendor confirmation.
Size infrastructure for Compose and Kubernetes
Expected load, the server and worker containers, PostgreSQL, and the outpost footprint are sized for the deployment path you are considering, Docker Compose or Kubernetes with Helm. The sizing notes flag where a separately managed PostgreSQL is needed for production, and the output is a per-environment resource and hosting table.
Estimate people and operating model
Your team's skills are compared with the work of running authentik, covering upgrades, release tracking, outpost operations, backups and on-call coverage. The output is a responsibility matrix showing which tasks stay in-house, which go to a support agreement and which need a retainer, with the staffing assumptions written down.
Build the cost model with sensitivity cases
Infrastructure, licensing, people and one-time implementation costs are combined into a model with each assumption stated. Sensitivity cases vary user count, external user volume, hosting choice and support level so that you can see which inputs move the total most. The output is a spreadsheet your finance team can audit and rerun.
Record decisions and open questions
The results go into a decision record that states the chosen edition, the deployment path, the operating model and the assumptions behind each figure. Open questions, such as pricing confirmation, support scope and FIPS needs, are assigned to an owner. Timing follows the written scope agreed before work starts, and this page does not give durations.

What usually goes wrong in cost planning

Six planning failures appear most often in authentik cost models. Each one has a check you can run before the quote is signed.

Enterprise features assumed free

Open Source is free, but Google Workspace and Microsoft Entra ID integrations, mTLS client certificate authentication, privileged access management, password history and enhanced audit logging are listed as Enterprise features. Check every required feature against the pricing page and the license of the authentik/enterprise/ directory before you choose the free edition.

Counting only workforce users

Enterprise pricing is $5 per user per month billed annually, plus $0.02 per external user per month. Customers, partners and contractors who sign in through authentik add to that bill even though they are absent from the employee roster. Ask for an external user count per application and put it in the written scope.

Bundled PostgreSQL in production

The authentik Kubernetes guide says the PostgreSQL bundled with the Helm chart is for demonstration and test environments and recommends a separately managed PostgreSQL for production. Budget for that database service, including its backups, failover and upgrades, because authentik keeps all configuration and data there except uploaded files.

Connection load after Redis removal

Release 2025.10 removed Redis and moved caching, tasks, sessions and WebSocket functions to PostgreSQL. The release notes warn of roughly 50% more PostgreSQL connections after upgrading. Size connection limits, pooling and database capacity before cutover, and load test them against your expected login volume.

Patching across two release lines

The authentik security policy lists 2026.5.x and 2026.8.x as the supported lines receiving security fixes, and security releases are announced at least 24 hours in advance. Plan staff time to test and deploy both lines, the upgrades between minor versions, and any out-of-cycle patch that needs approval on short notice.

No named owner for operations

Without a named owner, on-call alerts, upgrade decisions and outpost updates fall between teams. Name one accountable owner, a backup and an on-call rota covering the server, worker and database. Include that time in the cost model, since it recurs for as long as authentik runs.

Recurring and one-time costs after go-live

This table separates costs paid once during the rollout from costs that continue after go-live, so you can compare the edition fee with the infrastructure and staff time needed to run authentik.

Cost component	One-time or recurring	What drives it
Design and configuration	One-time	Number of applications, protocols in use, flows and MFA rules, and branding; ask for these as separate lines in a fixed-scope quote
Migration and integration build	One-time	Source system (Keycloak, Okta, Auth0 or LDAP), user and group volume, and how many applications need cutover and rollback steps
Initial hardening	One-time	Admin access model, secret and certificate handling, outpost tokens and event logging configuration, reviewed before go-live
Enterprise subscription	Recurring	Billed at $5 per user per month annually plus $0.02 per external user per month, per the authentik pricing page; confirm the user count definition in writing
Enterprise Plus subscription	Recurring	Starts at $20k annually per the authentik pricing page; price depends on the contracted scope, dedicated support and SLAs
Hosting for server, worker and PostgreSQL	Recurring	Server and worker container sizing, a separately managed PostgreSQL for production, and connection counts after the Redis removal in 2025.10
Backups, monitoring and restore testing	Recurring	Retention period, backup frequency, alerting coverage and how often restores are tested in your environment
Staff time for upgrades and security releases	Recurring	Security releases are announced at least 24 hours in advance, and supported lines are 2026.5.x and 2026.8.x; budget time for testing and rollout
Open Source support model	Recurring (people cost)	Open Source has community Discord support only, so the skills to run, patch and troubleshoot authentik must be budgeted as internal staff time or a retained partner

How the cost picture changes by starting point

The authentik Docker Compose guide positions Compose for test setups and small-scale production, so most costs here are the host, backups and staff time rather than licensing.

Host sizing: the guide's stated minimum is 2 CPU cores and 2 GB of RAM. Confirm the size you need for your user count and login peaks.
Open Source cost: the Open Source edition is free, so your recurring costs are hosting, storage and the time your team spends on updates.
Restore testing: a single host has no node-level redundancy, so your team owns backup and restore testing.
Support: the Open Source edition offers community Discord support only. Ask a partner to quote any ticket-based or dedicated support you need.

What you need to provide

Start with the numbers that drive the subscription. Enterprise pricing is per user per month, billed annually, plus a separate per-user charge for external users, so an accurate model needs a current count split into workforce users and external users (partners, customers, contractors who sign in). Include users who are provisioned but inactive if your licensing terms count them, and confirm with authentik how the seat count is measured before you finalize the figure. Next, list every application that will sign in through authentik and the protocol each one uses: OAuth2/OIDC, SAML, LDAP, proxy, RADIUS, SCIM, remote access control, Google Workspace, Entra ID, Shared Signals Framework or WS-Federation. Mark which apps need Enterprise-only integrations, such as Google Workspace or Entra ID, and which legacy systems can only speak LDAP or RADIUS.

The Enterprise-only features you believe you need should be written down as a requirement list, not assumed from the pricing table. Examples to test against the feature list include mTLS client certificate authentication, privileged access management, password history, enhanced audit logging and ticket-based support. Confirm with authentik which features are in the Enterprise directory license and which ones your team can meet with Open Source code, since the repository license split between MIT and the enterprise directory affects what you can use without a subscription. Finally, document the hosting standard and the people who will carry the work. Record your PostgreSQL policy (managed service or self-run, backup tooling, and who approves major version upgrades), your container platform, and the named staff who will apply upgrades and security releases on short notice. Name the decision owner with budget authority, and ask your legal and compliance team which requirements, such as FIPS or FedRAMP obligations, change the edition choice. Treat those answers as questions to confirm, not facts to assume.

Questions buyers ask about authentik costs

Is authentik free to use, or do we have to pay for it?

Yes, the Open Source edition is free to use. The authentik pricing page lists it at no charge, with community support on Discord only. Most of the repository is under the MIT license (SPDX: MIT), according to the authentik LICENSE file, while code in the authentik/enterprise/ directory falls under a separate enterprise license. Your costs under Open Source are therefore infrastructure, PostgreSQL, and the staff time to build, operate and upgrade the platform. Confirm the license terms for any enterprise-directory feature you plan to use before deployment.

What does the authentik Enterprise subscription cost per user?

Enterprise is priced at $5 per user per month, billed annually, plus $0.02 per external user per month, according to the authentik pricing page. It covers features such as Google Workspace and Microsoft Entra ID integrations, mTLS client certificate authentication, privileged access management, password history, enhanced audit logging, and ticket-based support for subscriptions over $1k. Ask the vendor to confirm how it defines internal and external users, since that definition drives the monthly bill. Record the subscription as a recurring line item alongside hosting and staff.

When is authentik Enterprise Plus worth reviewing for our organization?

Review Enterprise Plus when you need its listed extras: dedicated support with SLAs, multi-instance deployment support, or FIPS compliance for FedRAMP requirements. The authentik pricing page lists it starting at $20k annually. Organizations without those requirements usually compare Enterprise first, since Enterprise Plus carries the higher starting price. Before you rely on any of these extras in a budget, confirm current terms, support response commitments and whether FIPS compliance applies to your deployment with the vendor.

How do external users change the authentik subscription bill?

Each external user adds $0.02 per month on top of the $5 per user per month Enterprise price, according to the authentik pricing page. For illustration only, 10,000 external users would add $200 per month, or $2,400 per year, before hosting and staffing costs. Count external users early, since a customer-facing deployment can have a much larger population than your workforce. Ask the vendor for the exact definition of an external user and how usage is counted over a billing period.

How long does a cost assessment take and what must we provide?

The duration depends on the written scope: the number of applications, the protocols in use, the identity sources to sync, high availability targets, and whether you need Enterprise features or Enterprise Plus support. DeployOpen agrees scope, deliverables and timelines in writing before work starts, and most engagements are fixed-scope, so the timeline follows from that document. To prepare, provide a user count split between internal and external identities, an application inventory with protocols, your hosting and PostgreSQL preferences, and any compliance requirements.

Can our team do the cost study ourselves, and when does self-hosting pay off?

Your team can estimate many components alone, including hosting, PostgreSQL and the effort to onboard applications, but an independent, fixed-scope review gives you a written basis for the decision. Infrastructure and staff costs recur, and the Enterprise subscription is charged per user, so self-hosting tends to pay off when your projected user count and subscription price exceed your steady operating costs. Compare both over several years at your expected user count. For sizing, the Docker Compose guide lists 2 CPU cores and 2 GB of RAM for test and small-scale production, while the Kubernetes guide recommends a separately managed PostgreSQL for production.

How DeployOpen scopes and delivers this work

DeployOpen works on authentik cost of ownership and editions as a planning and implementation exercise inside your own infrastructure, starting from a written scope that compares edition features, hosting and staffing costs against your requirements. The result is a decision record and, where you choose to proceed, a deployed and documented authentik environment that your team can run.

How we scope

We inventory the authentik features your applications need and map each one to the Open Source, Enterprise or Enterprise Plus edition.
We identify which license-gated features, such as Google Workspace, Entra ID, mTLS or audit logging, your use case depends on.
The written scope sets out the cost model to be compared, the assumptions behind it and the questions to confirm with authentik before purchase.

How we build

We model the hosting footprint for the server, worker and PostgreSQL containers in your cloud account, data center or air-gapped network.
We document recurring costs for infrastructure, PostgreSQL operations, upgrades and internal staff time alongside any per-user subscription fees.
We test the chosen deployment pattern in a non-production environment before recommending it for your production estate.

How we hand over

You receive a cost of ownership model, an edition decision record and a list of licensed features with the business reason for each.
The deliverables include the architecture assumptions, the hosting sizing rationale and the upgrade and security release considerations.
We walk your platform, finance and security owners through the model so they can revisit it when user counts or features change.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer, scoped separately from the initial engagement.
A retainer can cover tracking supported authentik release lines, planning upgrades and reviewing edition needs as your estate grows.
Ask any support provider to confirm response terms, the scope of covered versions and what happens to the cost model after a change.