Authelia

Overview

Authelia is an open-source authentication and authorization gateway, started in 2019 and maintained by a community of contributors. It sits in front of applications behind a reverse proxy such as Nginx, Traefik, or Caddy, adding single sign-on and multi-factor authentication to services that lack their own. It is popular in homelab, self-hosting, and small-team setups. Authelia is fully open source and self-hosted; there is no managed SaaS tier.

What it is good at

Authelia does one job well: it adds SSO and MFA in front of reverse-proxied apps with a lightweight footprint. It supports TOTP, WebAuthn and passkeys, and push notifications, plus access-control rules by user, group, and URL. It now also exposes an OpenID Connect provider, so it can act as an OIDC issuer for compatible clients. The self-hosting community is active and the documentation is solid, which makes it a favorite for protecting internal dashboards and homelab services. For the MFA concepts, see what is passwordless.

Where it falls short

Authelia is a gateway, not a full identity provider. It does not handle user lifecycle provisioning, SCIM, broad SAML federation, or governance and audit reporting the way an enterprise IdP does. There is no commercial support or SLA by default, so you are on your own or reliant on the community. For a full self-hosted IdP, look at Keycloak, Authentik, or Zitadel.

Pricing

Free and open source. There are no license fees and no paid tiers; your cost is the infrastructure and the time to run it, which you can estimate with the TCO calculator.

Best for, and who should look elsewhere

Ideal for self-hosters, homelabs, and small teams that want to put SSO and MFA in front of reverse-proxied apps. Look elsewhere if you need commercial support and SLAs, user provisioning, or a full enterprise IdP.

Bottom line

A popular, lightweight open-source auth gateway for reverse-proxy setups and homelabs, not a replacement for a full enterprise identity provider.