Compare
FoxAuth compared with authentik
authentik is a self-hosted identity provider covering SAML, LDAP and RADIUS as well as OIDC. FoxAuth does OAuth 2.1 only, with the banking-grade profiles.
Last checked 2026-09-06 against the linked sources. authentik changes. Where its documentation did not say, this page says so instead of guessing. Found something out of date? Tell us at hello@foxauth.dev.
The short answer
Pick authentik if you are replacing an SSO estate that speaks SAML, LDAP or RADIUS as well as OIDC. If the applications are your own and what you need is an OAuth 2.1 authorization server with the banking-grade profiles and no enterprise tier to buy, pick FoxAuth.
Choose authentik if…
- Your estate has applications that speak SAML, LDAP or RADIUS alongside OpenID Connect.
- You want a broad SSO product, with flows, policies and outposts, more than you want a protocol server.
- You want an MIT-licensed core with no source-available restriction.
- You are consolidating logins across bought software instead of issuing tokens to your own.
Choose FoxAuth if…
- You are securing your own applications and every one of them speaks OAuth or OIDC.
- You need DPoP, PAR, CIBA, mTLS, RAR or JARM, none of which authentik documents.
- You want a smaller operational surface than a Python, Go and Rust stack with PostgreSQL behind it.
- You want an AI agent administering the instance through the same audited path a human uses.
Side by side
Every row has a verdict and the reason for it
- Built in
- Behind a flag, preview or add-on
- Not available
- Not documented
- Not applicable
Row verdicts: 6 FoxAuth ·3authentik · 0 even ·2 different goals. A count is not a recommendation. The rows that matter to you are the ones that count.
| Dimension | FoxAuth | authentik | Verdict |
|---|---|---|---|
| Scope and stack | |||
| Protocols | ○OAuth 2.1 and OpenID Connect only. No SAML, LDAP or RADIUS. | ●SAML, OAuth2/OIDC, LDAP and RADIUS. | authentik authentik covers an estate; FoxAuth covers applications that speak OAuth. What their docs sayThe repository describes authentik as supporting "SAML, OAuth2/OIDC, LDAP, RADIUS, and more". |
| What it is for | ●An authorization server issuing tokens to applications you build. | ●An identity provider for single sign-on across applications you run. | Different goals These are adjacent products, each built for a different job. |
| Runtime and stack | ●TypeScript on Bun; the HTTP layer is Elysia. | ●Python, Go, Rust and TypeScript components. | Different goals A broader stack, because it does more; a smaller one tends to be easier to reason about. |
| Deployment footprint | ●One process and a database. | ●Documented minimum of 2 CPU cores and 2 GB of RAM, with PostgreSQL. | FoxAuth A smaller footprint, for a smaller job. What their docs sayThe install guide requires "A host with at least 2 CPU cores and 2 GB of RAM". |
| Protocol coverage | |||
| Core OAuth and OIDC | ●OAuth 2.1 with PKCE mandatory for every client, OIDC Core and Discovery. | ●OAuth2 and OIDC as one of several supported protocols. | FoxAuth Mandatory PKCE, exact redirect matching and no implicit grant are the OAuth 2.1 defaults, and here they are the entire product. Over there OAuth is one protocol among four. |
| Sender-constrained tokens | ●DPoP (RFC 9449) and mTLS (RFC 8705). | ?Not documented. | FoxAuth A gap that matters mainly in regulated deployments, where it is likely to be decisive. |
| PAR, CIBA, RAR and JARM | ●PAR (RFC 9126), CIBA, RAR (RFC 9396) and JARM, each behind a flag. | ?Not documented. | FoxAuth Here the banking-grade profiles are implemented, and nothing about them is waiting on a roadmap. |
| Device flow | ●RFC 8628, behind a feature flag. | ?Not documented. | FoxAuth Recorded as not documented, because authentik's documentation does not describe it. That is a weaker claim than absent. |
| Administration and licensing | |||
| Administration by an AI agent | ●MCP control plane over the console's own routes, audited and confirmation-gated. Off by default. | ?Not documented. | FoxAuth authentik's documentation describes no agent surface. Here an agent goes through the console's own routes and lands in the same audit trail a person does. |
| Licence | ◐FSL-1.1-ALv2: source-available, converting to Apache 2.0 after two years. | ●MIT for the core, with a separate enterprise licence for enterprise features. | authentik An MIT core carries no competing-service restriction; FSL does until each version converts. What their docs sayThe repository lists an "MIT License" for the code and an "EE License" for enterprise features. |
| Maturity | ◐0.4.0. The HTTP surface and admin API may still change between minor releases. | ●An established project with a large self-hosting community. | authentik The maturity gap is real, and this page will not soften it. |
These are adjacent products
Most comparisons on this site weigh two implementations of the same thing. This one does not.
authentik is an identity provider for single sign-on. Its value is that it speaks SAML, LDAP and RADIUS as well as OIDC, which is what you need when the things logging in are appliances and bought software you cannot change. FoxAuth is an OAuth 2.1 authorization server: it issues tokens to applications you build, and it speaks nothing but OAuth and OpenID Connect.
Anyone consolidating logins across an estate wants authentik’s category of product, and FoxAuth is not in it. If you are securing your own applications and every one of them speaks OIDC, the extra protocols are surface you would have to operate — and would probably never use.
Where the overlap is real
Both issue OIDC tokens, and for that job the differences are narrow but specific. FoxAuth defaults to OAuth 2.1 behaviour: PKCE is mandatory for every client, public or confidential, redirect URIs must match exactly, and there is no implicit grant. It can hold those defaults because OAuth is the entire product here, where for authentik it is one protocol among four. And the banking-grade profiles are implemented here and not documented there.
Everywhere else on the table, the honest verdict goes the other way: a broader protocol surface, an MIT-licensed core, and years more production deployment.
Questions
What people ask before they switch
What is the difference between FoxAuth and authentik?
authentik is an identity provider for single sign-on across an estate: it describes itself as supporting "SAML, OAuth2/OIDC, LDAP, RADIUS, and more", which is usually what you want when the things logging in are bought software you do not control. FoxAuth is an OAuth 2.1 and OpenID Connect authorization server for applications you do control, and it speaks nothing else. They overlap on OIDC and diverge everywhere else.
Does FoxAuth support LDAP or RADIUS?
FoxAuth supports neither LDAP nor RADIUS, and neither is planned. It implements OAuth 2.1 and OpenID Connect only. authentik supports LDAP and RADIUS as well as SAML, so if you need to put a login in front of an appliance or a legacy application that speaks one of those, FoxAuth cannot do it and authentik can.
Is FoxAuth lighter to run than authentik?
FoxAuth is a single Bun process and one database, PostgreSQL or MongoDB. authentik documents a minimum of a host with at least 2 CPU cores and 2 GB of RAM, and its repository contains Python, Go, Rust and TypeScript components with PostgreSQL behind them. That is a broader surface, and it is broader because authentik does considerably more. Whether the extra weight is worth carrying depends on whether you need the protocols it adds.
Can I migrate from authentik to FoxAuth?
Only if everything you have connected to authentik speaks OIDC. Those clients port over with an issuer and client id change. Anything connected over SAML, LDAP or RADIUS has no path, because FoxAuth does not implement those protocols. That part of the estate would have to be re-integrated over OIDC first, and in most cases that is a larger project than the migration itself.