authentik implementation plan and cost

The database and hosting decision comes first in an authentik plan, because authentik stores its configuration and data in PostgreSQL and both the server and worker containers depend on it. According to the architecture documentation, PostgreSQL holds everything except uploaded files, so an outage or slow database affects sign-in, administration and background work at once. Every other line item in the quote, from sizing to backup and on-call coverage, follows from where that PostgreSQL instance runs and who operates it. Settle this before requesting a quote, because a single line for hosting hides the choices that change cost.

The supplied installation guides describe two starting points. The Docker Compose guide calls for a host with at least 2 CPU cores and 2 GB of RAM and positions Compose for test setups and small-scale production. The Kubernetes guide installs with Helm and states that the PostgreSQL bundled with the chart is meant for demonstration and test environments, with a separately managed PostgreSQL recommended for production. For the quote, this means asking whether the database runs on the same host as the application, as a bundled chart component, or as a managed service with its own backups, patching and failover. Each path carries different effort and recurring cost. The stated host minimums are floors, not sizing for your user count, so confirm the host and database sizing against the vendor documentation and your expected load.

The 2025.10 release removed Redis entirely and moved caching, background tasks, sessions and WebSocket functions into PostgreSQL. The release notes warn of roughly 50% more PostgreSQL connections after upgrading. For an existing deployment, this changes the database plan in three ways: the instance must absorb connection and query load that Redis previously handled, connection limits and pool sizing need explicit review, and any upgrade from an older release needs a capacity check before cutover. Ask the DBA to confirm the current connection limit, the headroom left after authentik's added load, whether a connection pooler is appropriate in your environment, and how many connections each server and worker replica opens. Confirm the exact figures with the vendor documentation rather than relying on this summary.

The cost components are easiest to compare when each one has an owner. Infrastructure for the database, including compute, storage, backups and monitoring, may be billed by your cloud provider or your data center team. A managed PostgreSQL service adds its own fees. Partner effort covers sizing, connection testing, the database topology decision, any migration work for Redis-dependent settings, and load testing before go-live. Some of this is one-time work, while database operations, patching, capacity growth and on-call support recur. Ask the quote to show production and non-production databases separately, state whether staging mirrors the production database topology, and name who is responsible for backup restore testing. Worker count also matters, because background tasks run against the same database.

The edition decision comes first because it determines which features the design can rely on. Open Source is free and receives community support through the authentik Discord. Enterprise is listed on the authentik pricing page at $5 per user per month billed annually, plus $0.02 per external user per month. Enterprise Plus starts at $20k annually. Confirm current figures on that page before any budget is set, and record which edition the project assumes. A change of edition after the quote is issued changes the scope, so it should go through change control rather than being absorbed informally.

Several features that affect implementation scope are Enterprise-only. The pricing page lists Google Workspace and Microsoft Entra ID integrations, mTLS client certificate authentication, privileged access management, password history and enhanced audit logging. Each one adds design and test work. An Entra ID integration needs provider configuration and a test tenant. mTLS needs a decision on certificate authority ownership and how certificates are checked in the flow. Password history affects how migrated credentials are handled. Audit logging needs a destination and retention period. Enterprise Plus adds dedicated support with SLAs, multi-instance deployment support and FIPS compliance for FedRAMP requirements. Ask authentik to confirm whether the FIPS option meets the specific FedRAMP requirements in your environment, because FedRAMP status belongs to the authorizing body, not the software.

Licensing also affects the build. Most of the authentik repository is under the MIT license, but code in the authentik/enterprise/ directory is covered by a separate enterprise license defined in that directory. The LICENSE file in the repository is the starting point for this check. If the design depends on enterprise code, legal and procurement should review that license before the build plan is locked. Ask the client to name the people who will sign the subscription and to confirm which license terms apply to any code the team will deploy, modify or redistribute.

A fixed-scope quote should state the edition and the full list of included features, so the reader can see which Enterprise items are priced in and which are excluded. It should list assumptions, including hosting model, PostgreSQL arrangement, user and external user counts, number of applications and their protocols, and the identity sources to be synced. It should name client responsibilities, such as subscription purchases, DNS, certificates, application owner availability and test accounts. It should set change-control rules for added applications or an edition change, and acceptance criteria such as tested login flows, a verified backup restore and a handover runbook. DeployOpen does not publish prices. A quote follows from this written scope, and work starts only after the scope is agreed in writing.

A fixed-scope authentik quote is only as accurate as the assumptions behind it, and most of those assumptions are facts only your team can supply. Before a partner can price the work, your side needs to name an owner for each input below. The first group is infrastructure: access to the cloud account, data center or air-gapped network where authentik will run, plus a host or Kubernetes cluster that the implementer can reach. The most consequential decision is PostgreSQL. The authentik architecture stores all configuration and data in PostgreSQL except uploaded files, and since the 2025.10 release it also handles caching, tasks, sessions and WebSocket functions that previously used Redis. Ask who owns the database, who runs its backups, and whether a managed instance is available. The Kubernetes guide describes the bundled PostgreSQL as suitable for demonstration and testing, so production pricing usually assumes a separately managed database.

Next, DNS and TLS. Name the public hostnames for the authentik server and for any outpost endpoints, and state who controls the DNS zone and who can issue or renew certificates. Confirm whether certificates come from an internal certificate authority, a public issuer or a managed load balancer, and who holds the private keys. These answers decide whether the work includes certificate automation or only manual installation. The application inventory is the input that moves the quote most. For each application, record the protocol (OAuth2/OIDC, SAML, LDAP, proxy, RADIUS, SCIM or another provider type), the business owner, the technical contact, the exact redirect and logout URIs for each environment, and the claims or groups the application expects. An application without a named owner or redirect list cannot be onboarded in the scoped time.

Directory access is the third group. If users come from Active Directory or LDAP, your team must provide a bind account with read access to the relevant containers and groups, along with network paths from the authentik outposts to the directory servers. If you plan to use Google Workspace or Microsoft Entra ID, confirm that those integrations are in scope, because the authentik pricing page lists them as Enterprise-only features. The same applies to mTLS client certificate authentication, enhanced audit logging and privileged access management. Name one decision owner who can choose the edition and set the MFA policy, including which factors are allowed, whether enrollment is mandatory, and how recovery works. Without that decision, the flows and stages cannot be finalized.

Security and change approvers must be named before work starts. The security approver signs off on admin access, secret storage, outpost tokens and the hardening baseline. The change approver owns production windows and rollback authority. Both should know the cutover sequence, because each application switch changes how users sign in. Finally, provide test users for acceptance. Supply accounts that represent each user population, such as employees, contractors, administrators and external users, with the groups and MFA state they will use in production. Name who runs each acceptance test and who signs it off. Test users that exist only in a development directory will not reveal problems in the production identity source.

Every missing item should appear in the quote as a written assumption, a client dependency or a change order. Ask the implementer to list each assumption against the inputs above, so that a late redirect list or an unassigned database owner becomes a documented schedule risk rather than an unexplained overrun. Request the list in writing before you compare quotes, because two proposals with different assumptions cannot be compared on price alone.