GitOps and configuration as code
| Area | Keycloak | Authentik |
|---|---|---|
| First-party declarative path | Realm export and import support bootstrapping and recovery, but import is not a general in-place reconciliation engine | Blueprints define flows, providers, applications, policies, and other objects in YAML |
| Ongoing reconciliation | Common approaches include the Admin API, community Terraform providers, and keycloak-config-cli | Blueprint instances reconcile changed content and can load from local files, the database, or an OCI registry |
| Kubernetes packaging | Official Keycloak Operator | Official Helm chart |
| Review focus | Realm lifecycle, provider compatibility, extensions, secrets, and effective role or claim changes | Blueprint dependencies, policy evaluation, object identifiers, secrets, and flow behavior |
Multi-tenancy is not a like-for-like comparison
Keycloak realms are isolated administrative domains with their own users, clients, roles, and identity providers. Keycloak Organizations model business organizations and memberships within a realm; they do not replace a realm when realm-level isolation is required.
Authentik's additional-tenant capability is currently documented as an Enterprise alpha feature. It uses separate PostgreSQL schemas, requires licensing for additional tenants, has operational constraints, and warns that expression policies can access all tenants. Authentik brands customize domains and login behavior but are not tenant isolation.
For an open-source-only requirement that needs strong tenant separation, do not score Authentik as having native multi-tenancy without qualification. Test the exact edition and feature state you intend to run.
Production readiness
- Keycloak strengths. Long production history, extensive protocol and federation capabilities, a large operating knowledge base, and a supported Red Hat distribution path.
- Keycloak tradeoffs. JVM operations, database and cache design, realm sprawl, extensions, and configuration tooling can add meaningful complexity.
- Authentik strengths. Integrated flow design, proxy outposts, first-party Blueprints, approachable administration, and official Compose and Helm installation paths.
- Authentik tradeoffs. A younger operating track record, privileged Python expression policies, edition-specific enterprise features, and flow or Blueprint customizations that require regression testing.
Decision guide
- Choose Keycloak when mature realm isolation, deep federation, extensive community knowledge, or the Red Hat support path outweigh a more assembled GitOps experience.
- Choose Authentik when first-party Blueprint reconciliation, visual flows, and reverse-proxy integration are central—and when its edition boundaries and tenancy limits fit the requirement.
- For either platform, test upgrade and rollback, database recovery, directory synchronization, administrative lockout, tenant-boundary mistakes, and custom configuration under failure.
Primary references
- Keycloak documents creation-only Operator realm imports in Automating a realm import.
- Keycloak documents organizations and membership inside a realm in its Server Administration Guide.
- Authentik documents declarative sources and reconciliation in Blueprints.
- Authentik documents edition, alpha status, isolation, and caveats in Tenancy.
Related resources
- Plan the runtime with Self-hosted identity on Docker Compose and Kubernetes.
- Price the operating model with Open-source identity and SSO: the real cost of self-hosting.