Authentik
live verifiedAuthentik Security · Per-internal-user, annual. External users (B2B / customer-facing federation) priced at $0.02/external-user/mo; service accounts are free.
Open-source, self-hosted by default. Free Community tier covers all core IdP features. Enterprise adds dedicated support; Enterprise Plus adds FIPS and multi-instance for regulated industries. Below ~30 internal seats, self-hosted Community is the cheapest credible IdP. Above that, the operational burden usually justifies a commercial alternative.
1.Year-1 TCO breakdown
Representative buyer: 200 employees, 30 SaaS apps, full SAML + MFA + lifecycle automation, 90-day audit retention.
2.The hidden cost category for this IdP
Licensing is not the cost; running it is. Authentik's Open Source tier genuinely costs $0 and the Enterprise rate is modest, so the comparison against a commercial IdP is never really about the invoice. It is about whether you can carry an identity provider as production infrastructure: high availability for a service where downtime locks every employee out of every application, patching on a security-critical component, upgrade testing, backup and restore of the identity store, and someone on call who understands it. Those costs are yours to size — take your loaded engineering rate, your honest estimate of the fraction of a person this absorbs, and your hosting bill, and compare that total against the licence you would otherwise pay. Published figures for other people's ops costs are not evidence about yours; the inputs differ too much to average. The structural point stands without a number: self-hosting trades a predictable licence for an unpredictable staffing commitment, and it suits organisations that already run critical infrastructure well.
3.Migration cost out of Authentik
The easiest exit in this cohort, because Authentik's SAML and OIDC implementations are standards-compliant and there is no proprietary automation engine holding business logic. Applications repoint; users re-enrol MFA. The one thing that does not travel is any custom flow you built in Authentik's flow engine, which encodes authentication stages in Authentik's own model. If you have kept to stock flows, this is close to a pure reconfiguration exercise.
4.The negotiation lever
Self-host vs Enterprise. The lever isn't on price (it's open source) — it's the build-vs-buy decision. Have a frank internal conversation about DevOps capacity before committing to self-host; switching from self-host to Enterprise mid-deployment is a meaningful migration cost.
5.Vendor tier reference
| Tier | Per-user (USD/mo) | Features |
|---|---|---|
| Open Source (self-host) | $0 | Free, all core features. Licensing is genuinely $0; the cost you carry is hosting and admin time |
| Enterprise (self-host or SaaS) | $5 | Per internal user, billed annually. Dedicated support, advanced policies, role-based admin. Service accounts free |
| Enterprise Plus | Quote | Starting at $20,000/yr, invoiced. Dedicated support and SLAs, volume discounts on custom contracts |