--- title: "One Login Now Opens Every Service I Run" description: "Authentik is a self-hosted identity provider that puts single sign-on, MFA and central user management in front of your whole stack. One strong password and one MFA prompt instead of twenty weak ones." author: "SelfHostedApp" pubDate: 2026-07-18T00:00:00.000Z tags: ["guide", "docker", "authentik", "security", "advanced"] canonical_url: "https://selfhostedapp.com/blog/single-sign-on-with-authentik/" source_url: "https://selfhostedapp.com/blog/single-sign-on-with-authentik.md" --- # One Login Now Opens Every Service I Run import { Picture } from 'astro:assets'; import AuthentikHero from '../../assets/images/heroes/single-sign-on-with-authentik-hero.jpg'; The audit I finally ran on myself last year was embarrassing, twenty-two self-hosted services, each with its own user database, and my passwords across them were a family of variations on two themes because nobody can hold twenty-two strong secrets in their head. Most of those services sat behind a Caddy domain with HTTPS and felt protected, and the uncomfortable truth was that the protection on half of them amounted to a password I had picked in thirty seconds at setup time, on services exposed to the whole internet, because that is what putting something behind a reverse proxy means. The fix for this is an identity provider, software whose entire job is to hold one strong login and then vouch for you to everything else, and Authentik is the open-source one I settled on, twenty-five thousand stars, which I had already mentioned in passing when I set up single sign-on for my team wiki and which deserves the full post it never got. You log in once at your own auth domain, it asks for your TOTP code, and from then on every service that speaks OIDC or SAML or LDAP bounces you through that one gate, so the security posture of the whole stack collapses to a single credential you can actually make strong, rotated properly, behind MFA, with a login page that shows you every attempt. The setup is heavier than most things in my stack and worth saying plainly, authentik wants two CPU cores and two gigabytes of RAM, and it is the largest single service I run. You download the official compose file, which brings three containers, the server, a worker that handles background jobs, and its PostgreSQL database, then generate two secrets into the env file before first start. ```bash echo "PG_PASS=$(openssl rand -base64 36 | tr -d '\n')" >> .env echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60 | tr -d '\n')" >> .env ``` The compose file wires the three services together with health checks and needs almost no editing, the server listens on 9000 and 9443, and the first visit to port 9000 starts a setup flow where you set the password for the default akadmin account. The secret key encrypts stored credentials and signs sessions, so it goes into the backup rotation with the database, because losing it means every saved credential and session in authentik is unreadable, which is the kind of lesson the docs teach gently and experience teaches loudly. The first integration taught me the shape of everything that follows, because in authentik you create an application and a provider attached to it, pick OIDC, get a client ID and secret, and paste those two strings into the service you are protecting, BookStack in my case, with a redirect URL that the authentik interface tells you exactly. After the third or fourth service, Gitea and Immich and Karakeep and my FreshRSS, the pattern became muscle memory, five minutes per app, and now every login page in my life is the same blue one, my username, my TOTP code, done. The genuinely clever part is what happens to services that have no SSO support at all, because authentik ships a proxy outpost that works as forward auth with Caddy, so a request hits Caddy, Caddy asks authentik whether this session is logged in, and an unauthenticated visitor gets bounced to the login portal before the app ever sees them. Half my stack is small tools that will never implement OIDC, and forward auth wraps them all in the same gate without touching their code, one Caddy snippet per domain, and the app itself never learns that anything changed. Two warnings from the field, the worker mounts the Docker socket so it can deploy outposts automatically, which is the same trade Watchtower makes and can be replaced with manual outpost deployment or a socket proxy if your threat model dislikes it, and do not lock yourself out, because authentik is now the door to everything, so the recovery flow and a break-glass admin account deserve setting up while you are calm rather than during an outage. The password manager entry count for my own services dropped from twenty-two to one, the one is protected by hardware-backed TOTP, and every failed login across the whole stack lands in one log I actually read. The weakest password I own is now the strongest one I own, and that inversion is the entire point. If one good login should open every door, subscribe to the newsletter.