Starter suite advertised per user/month, billed annually; standalone products/add-ons differ. Source
Okta Workforce Identity vs authentik
Fit:
Migration notes
Supports SAML/OIDC and directory/proxy protocols. Recreate app integrations, policy flows and user stores. Some workplace provisioning/security integrations require Enterprise.
Sources: goauthentik.io · checked 2026-10-21
Okta Workforce IdentityPaid incumbent
| Starter | entry | USD 72 / user / yr |
|---|---|---|
| Essentials | popular | USD 204 / user / yr |
| Essentials | business | USD 204 / user / yr |
| Enterprise | enterprise | Quote only |
| Open Source | self-hosted open-source core | Free |
|---|---|---|
| Enterprise | paid self-hosted enterprise subscription | USD 60 / user / yr |
| Enterprise Plus | paid self-hosted enterprise contract | USD 20,000 / organization / yr |
What you may give up
- Privileged access management and agent accounts
- Google Workspace and Microsoft Entra ID integrations
- Enhanced audit logging, scheduled offboarding and CSV reports
- mTLS authentication and device trust integrations
Tier B: Core MIT; root LICENSE explicitly carves out enterprise directory under separate terms. Paid administration/security integrations; community protocols and B2B/B2C login remain available. Vendor explicitly states no hosted service. License source
What running it takes
-
- authentik server and worker processes
-
- Podman
Hover or focus an icon for its name. Dashed means not established; struck through means no; grouped icons are alternatives.
Current Compose guide documents PostgreSQL and server/worker deployment. Raw compose.yml fetch rejected unsupported YAML content type; exact auxiliary service/version matrix not established here; no legacy Redis dependency inferred. Infrastructure and staff time are not priced here; this page does not compare total cost.