Compare
Authentik is a popular MIT-licensed, self-hosted identity provider with exceptionally broad protocol support — SAML, OIDC, LDAP, SCIM, RADIUS, and a forward-auth proxy — spanning homelab to enterprise. It has no managed cloud and is oriented more as an SSO gateway than a customer-facing CIAM. Choose Qeet ID when you want a managed cloud option, typed SDKs and a hosted login for your app, and a tamper-evident audit log.
Qeet ID
- License
- MIT (open source)
- Self-host
- First-class
- Managed cloud
- EU / US
- Focus
- CIAM
- SDKs
- React · Node · Go
Authentik
- License
- MIT (core)
- Self-host
- First-class
- Managed cloud
- None
- Focus
- IdP / SSO gateway
- Protocols
- Broad (LDAP/RADIUS)
Same MIT license. Built for customer-facing apps.
Authentik is a strong, MIT-licensed self-hosted IdP with unusually broad protocol support (LDAP, RADIUS, forward-auth proxy). Qeet ID shares the MIT license but is built as a CIAM: a managed cloud option, typed SDKs, a hosted login app, and a tamper-evident audit chain.
Feature-by-feature
Verified against Qeet ID's implemented status and Authentik's public docs. Where we're still building, we say so.
- Available
- Partial / gated
- Not offered
| Capability | Qeet ID | Authentik |
|---|---|---|
| Authentication | ||
Passkeys / WebAuthn | Yes | Yes |
Email + password | Yes | Yes |
Social login (Google, Apple, GitHub, Microsoft, …) | Yes | Yes |
MFA (TOTP, SMS, email, recovery codes) | Yes | Yes |
| Federation | ||
OAuth 2.0 / OIDC (you are the IdP) | Yes | Yes |
SAML 2.0 SP + IdP | Yes | Yes |
SCIM 2.0 provisioning Both ship SCIM; Authentik gates outbound sync to Google Workspace / Entra behind its Enterprise license. | Yes | Yes |
LDAP / RADIUS / forward-auth proxy Authentik's LDAP, RADIUS, and forward-auth proxy providers are a real strength; Qeet ID does not offer them. | No | Yes |
| Authorization | ||
RBAC + single-call /check API Authentik added RBAC to its OSS core; Qeet ID adds a single-call /check endpoint. | Yes | Yes |
ABAC policy engine Authentik's expression policies can gate flows on attributes, but there is no dedicated ABAC engine. | Yes | Partial |
Explainable authz (grant-path “why?” trace) Qeet ID returns the grant path or denial reason on every check. | Yes | No |
| Deployment | ||
Open-source core Both ship a permissively MIT-licensed core. | MIT | MIT |
Self-host first-class Both self-host well; Authentik is fully GA, Qeet ID is pre-GA. | Yes | Yes |
First-party managed cloud (SaaS) Authentik states it does not currently offer a hosted version — self-host only. | Yes | No |
| Pricing | ||
Self-host cost | Free (MIT) | Free (MIT core) |
Enterprise self-host license Authentik gates provisioning sync, enhanced audit, and mTLS behind a paid Enterprise self-host license. | N/A (self-host free) | $5 internal + $0.02 external / user / mo |
Managed cloud free tier | 25,000 MAU | No SaaS |
| Security & audit | ||
Tamper-evident hash-chained audit log + /verify Authentik logs events (enhanced audit + CSV export are Enterprise-gated), but there is no hash-chained integrity endpoint. | Yes | No |
Breached-password rejection (HIBP) Both can reject breached passwords via a HaveIBeenPwned policy. | Yes | Yes |
| Compliance | ||
GDPR erasure / data export | Yes | Yes |
Managed-cloud SOC 2 Type II / ISO 27001 Authentik has no first-party cloud to certify; certification is on you when you self-host either project. | Roadmap (pre-GA) | No SaaS |
| Developer experience | ||
CIAM-focused hosted login + prebuilt UI Authentik is more an IdP / SSO gateway than a customer-facing CIAM; its flow pages are themeable but not a drop-in component kit. Qeet ID's React component kit is in progress. | Yes | Partial |
First-party typed SDKs Authentik generates API clients but has no first-party typed app SDKs for embedding auth. | React · Node · Go | Partial |
Native admin dashboard Both ship an admin UI; Authentik's is built around flows and providers. | Yes | Yes |
Comparison is based on publicly-available product information at the time of writing. We do our best to be accurate — if anything above is wrong, please let us know and we'll correct it.
Migrate from Authentik
MIT identity, built for your customers
Self-host the MIT core, or start free on our managed cloud up to 25,000 MAU. If you need Authentik's LDAP / RADIUS / proxy breadth for internal SSO, it is an excellent choice.