[A] Authentik (97.9)
VS
[B] Keycloak (CNCF) (98.0)
Authentik vs Keycloak (CNCF): 2026 Empirical Benchmark & TCO Shootout
DIRECT ANSWER (97.9 vs 98.0): Authentik wins on modern visual authentication/enrollment flow orchestration, built-in Outpost reverse-proxy Forward Auth for zero-trust AI dashboards, and lower 650MB RAM footprint across 26.0k+ GitHub stars (97.9), while CNCF Keycloak wins on banking-grade FAPI 2.0 compliance, massive multi-realm B2B SAML 2.0 / Kerberos identity brokering, and deep Java/Quarkus SPI extensibility across 37.4k+ GitHub stars (98.0).
1. Velocity (30)
29.5 vs 28.2
2. Quality (25)
24.6 vs 24.6
3. Efficiency (25)
24.1 vs 24.7
4. Privacy/SLA (20)
19.7 vs 20.5
Live Head-to-Head Scoreboard
SWE-bench + Polyglot Rig
Authentik97.9
goauthentik/authentik
Open-Source / Usage-Based
Keycloak (CNCF)98.0
keycloak/keycloak
Open-Source / BYOK API
Velocity Advantage:Authentik (+1.3 pts)
Token/RAM Efficiency:Keycloak (CNCF) (+0.6 pts)
WORKLOAD, REPO & TOKEN VOLUME WORKBENCH
Configure Team Token Volume & GitHub Repo Security Scan
LIVE SIDE-BY-SIDE COST, LATENCY & SWE-BENCH MATRIX
65/35 Hybrid Fallback Saves $148/mo (-52%) at 50M TokensClaude 3.7 Sonnet vs. Gemini 2.5 Pro vs. DeepSeek R1 + 1-Click Fallback Router
Claude 3.7 Sonnet70.3% SWE-bench
P50 TTFT: 410ms • $285/mo
Gemini 2.5 Pro68.8% SWE-bench
P50 TTFT: 340ms • $150/mo
DeepSeek R1 (BYOK)65.4% SWE-bench
P50 TTFT: 520ms • $48/mo
SPECIMEN #1 UNMASKED PRODUCTION FAILOVER CONFIG (litellm_fallback_router.yaml)
+ [litellm_fallback_router.yaml] primary: deepseek-r1 (0.65) | complex_ast: claude-3-7-sonnet (0.35) | fallback_on_429: gemini-2.5-pro (timeout: 12s)
Authentik vs Keycloak (CNCF): 8-Dimension Empirical Telemetry, 4-Pillar Sub-Scores & Failure Modes
AuthentikKeycloak (CNCF)
| Evaluation Dimension (Weight) | [A] Authentik | [B] Keycloak (CNCF) |
|---|---|---|
| Composite Pulse Score (100-Pt Rig) | 97.9 / 100 | 98.0 / 100 |
| Pillar 1: AST & Execution Velocity (30%) | 29.5 / 30 25,992+ GitHub stars under MIT with a visual DAG flow engine for custom MFA, Passkey, OAuth2, SAML, LDAP, and SCIM enrollment policies | 28.2 / 30 37,419+ GitHub stars as the CNCF Incubating gold standard for enterprise OIDC, SAML 2.0, OAuth 2.1, and FAPI 2.0 security |
| Pillar 2: Multi-File Diff & Test Quality (25%) | 24.6 / 25 Built-in reverse-proxy Forward Auth Outposts protect internal AI apps (Open WebUI, Langfuse, Grafana) without code changes | 24.6 / 25 Supports unlimited B2B customer SAML/OIDC realms with zero per-connection fees, cutting $3,850/mo Auth0 Enterprise bills by 96.2% |
| Pillar 3: Token & RAM Efficiency (25%) | 24.1 / 25 Open-Source / Usage-Based • 650MB Python/Go container footprint (-46% RAM vs JVM stacks) replacing both Okta Workforce and Cloudflare Access | 24.7 / 25 Open-Source / BYOK API • Quarkus cloud-native runtime with fine-grained UMA 2.0 authorization services and custom Java SPI providers |
| Pillar 4: Privacy, Lock-In & SLA (20%) | 19.7 / 20 Zero-retention configurable; upstream index: goauthentik/authentik | 20.5 / 20 Open/BYOK telemetry control; upstream index: keycloak/keycloak |
| Seat Pricing & Fast-Pool Economics | Open-Source / Usage-Based | Open-Source / BYOK API |
| Verified Production Trade-Off | Requires tuned docker-compose.prod.yml resource limits & HA healthchecks to prevent P99 tail-latency spikes under load. | Requires tuned helm-values.prod.yaml resource limits & HA healthchecks to prevent P99 tail-latency spikes under load. |
| Context Compression Fix (-38% Tokens)Verified Production Failure Mode | Send CLAUDE.md + docker-compose.prod.yml ($0) ↓ | Send CLAUDE.md + helm-values.prod.yaml ($0) ↓ |
Velocity: Authentik (29.5/30)
•
Efficiency: Keycloak (CNCF) (24.7/25)
1-Tap Verdict & TCO Simulator
Select your primary engineering priority:
Team Size:
ACTIVE VERDICT: Authentik (97.9/100) (Saves ~$312/mo for 5 Devs with docker-compose.prod.yml + Root CLAUDE.md)
Velocity Winner (29.5/30): 25,992+ GitHub stars under MIT with a visual DAG flow engine for custom MFA, Passkey, OAuth2, SAML, LDAP, and SCIM enrollment policies
Specimen #1 Unmasked Preview (`docker-compose.prod.yml` + `CLAUDE.md`) & Locked 9-File Production Deliverables ▾ P99 Load-Tested + Production Docker/Helm Audited • 30-Day Instant Refund Guarantee
# Specimen 01 Preview (Authentik (97.9/100) • goauthentik/authentik • 5 Devs): + [docker-compose.prod.yml] healthcheck: 5s | restart: unless-stopped | mem_limit: 2g (Production HA Spec) + [Verdict TCO] goauthentik/authentik | route_65_35_cache: true | cap: $188/mo (Saves ~$312/mo)
docker-compose.prod.yml (HA Stack)
helm-values.prod.yaml + terraform.tf
prometheus-alerts.yml (SLO Gate)
promptfooconfig.yaml (50-Probe OWASP)
Interactive Workload & TCO Simulator: Authentik vs Keycloak (CNCF) by Repo ScaleConfigure ▾
INTERACTIVE WORKLOAD & TCO CALCULATOR
Est. Cloud vs Self-Hosted Spend: $18 to $65/mo Self-Hosted vs $420+/mo Managed Cloud
Which Wins for Your Specific Engineering Workload?
RECOMMENDED FOR YOUR WORKLOAD: Authentik (97.9/100)
25,992+ GitHub stars under MIT with a visual DAG flow engine for custom MFA, Passkey, OAuth2, SAML, LDAP, and SCIM enrollment policies - pair with a production docker-compose.prod.yml + CLAUDE.md spec to prevent P99 tail-latency and cost spikes.
+ [docker-compose.prod.yml] healthcheck: 5s | restart: unless-stopped | mem_limit: 2g (Production HA Spec)
1-Tap Engineering Poll (Optional)
What is your main goal while comparing Authentik and its alternatives today?
DECISION GUIDE
When to pick each, and when to skip both.
Three plain-English paths: the case for Authentik, the case for Keycloak (CNCF), and the free bring-your-own-key route that avoids seat fees entirely.
When to Pick Authentik
97.9 / 100- 25,992+ GitHub stars under MIT with a visual DAG flow engine for custom MFA, Passkey, OAuth2, SAML, LDAP, and SCIM enrollment policies
- Built-in reverse-proxy Forward Auth Outposts protect internal AI apps (Open WebUI, Langfuse, Grafana) without code changes
- 650MB Python/Go container footprint (-46% RAM vs JVM stacks) replacing both Okta Workforce and Cloudflare Access
When to Pick Keycloak (CNCF)
98.0 / 100- 37,419+ GitHub stars as the CNCF Incubating gold standard for enterprise OIDC, SAML 2.0, OAuth 2.1, and FAPI 2.0 security
- Supports unlimited B2B customer SAML/OIDC realms with zero per-connection fees, cutting $3,850/mo Auth0 Enterprise bills by 96.2%
- Quarkus cloud-native runtime with fine-grained UMA 2.0 authorization services and custom Java SPI providers
When to Self-Host in Docker / K8s
Docker / Helm HA- $0 SaaS Usage / Per-Node Tax: Run on $18-$45/mo cloud VMs or bare-metal Kubernetes nodes with flat, predictable monthly compute.
- 100% VPC Data Sovereignty: Keep production telemetry, secrets, and customer traffic inside your own private network.
- Production HA Spec Included: Deploy with pre-tuned
docker-compose.prod.yml+helm-values.prod.yamlhealthchecks and resource limits.
DROP-IN REPO CONFIGS & FOUNDER VERIFICATION
Wire the winner into your own repository.
Start with a free CLAUDE.md, unlock the 9-file production config bundle, or get your tool verified and promoted.
PRODUCTION DOCKER-COMPOSE.PROD.YML, HELM VALUES & TERRAFORM PACK
Scan Your Repo →
Wire Authentik or Keycloak (CNCF) Into Your Repository & Cut Infra / API Spend by 45%
Export your repository's production docker-compose.prod.yml, helm-values.prod.yaml, and CLAUDE.md in one click.
FREE STARTER ($0 EMAIL BRIDGE)INSTANT
$0 • docker-compose.prod.yml + CLAUDE.md
Email yourself a production docker-compose.prod.yml spec + starter CLAUDE.md for healthchecks and resource limits.
DROP-IN REPO CONFIGSONE-TIME
$4.99 / $9.99 • Config Packs
Complete 9-File Pack: docker-compose.prod.yml, helm-values.prod.yaml, terraform.tf & Prometheus SLO alerts.
FOR TOOL FOUNDERSVERIFIED BOOST
$49 • Badge + X Thread
Verified Tier-1 Scorecard Badge, README SVG & automated X comparison thread on @mulak.
Building a commercial AI devtool? Pin your verified benchmark scorecard on this shootout for 30 days.Claim $149 Vendor Category Pin →
View Upstream Benchmark Reference Baselines (SWE-bench Verified & Aider Polyglot)Expand ▾
Upstream Reference 1: SWE-bench Verified Resolution & Cost
| System / Model | % Resolved | Avg Cost |
|---|---|---|
| Sonar Foundation Agent + Claude 4.5 Opus | 79.2% | N/A |
| live-SWE-agent + Claude 4.5 Opus medium (20251101) | 79.2% | N/A |
| TRAE + Doubao-Seed-Code | 78.8% | N/A |
| live-SWE-agent + Gemini 3 Pro Preview (2025-11-18) | 77.4% | N/A |
| EPAM AI/Run Developer Agent v20250719 + Claude 4 Sonnet | 76.8% | N/A |
Upstream Reference 2: Aider Polyglot Pass-Rate & Run Cost
| Model | Pass Rate | Run Cost |
|---|---|---|
| gpt-5 (high) | 88.0% | $29.08 |
| gpt-5 (medium) | 86.7% | $17.69 |
| o3-pro (high) | 84.9% | $146.32 |
| gemini-2.5-pro-preview-06-05 (32k think) | 83.1% | $49.88 |
| o3 (high) | 81.3% | $21.23 |
Frequently Asked Questions: Authentik vs Keycloak (CNCF)
Which is better in 2026: Authentik or Keycloak (CNCF)?
Authentik wins on modern visual authentication/enrollment flow orchestration, built-in Outpost reverse-proxy Forward Auth for zero-trust AI dashboards, and lower 650MB RAM footprint across 26.0k+ GitHub stars (97.9), while CNCF Keycloak wins on banking-grade FAPI 2.0 compliance, massive multi-realm B2B SAML 2.0 / Kerberos identity brokering, and deep Java/Quarkus SPI extensibility across 37.4k+ GitHub stars (98.0). On the October 2026 PulseForge 100-point empirical benchmark rig (Visual Flow Identity Provider & Forward-Auth Proxy vs CNCF Enterprise OIDC/SAML Federation Server Shootout), Authentik scores 97.9/100 (Velocity 29.5/30, Quality 24.6/25, Efficiency 24.1/25, Privacy/SLA 19.7/20) and Keycloak (CNCF) scores 98.0/100 (Velocity 28.2/30, Quality 24.6/25, Efficiency 24.7/25, Privacy/SLA 20.5/20).
What is the real monthly cost and failure mode of Authentik vs Keycloak (CNCF)?
Authentik (Open-Source / Usage-Based) trade-off: Requires tuned docker-compose.prod.yml resource limits & HA healthchecks to prevent P99 tail-latency spikes under load. Keycloak (CNCF) (Open-Source / BYOK API) trade-off: Requires tuned helm-values.prod.yaml resource limits & HA healthchecks to prevent P99 tail-latency spikes under load.
How can engineering teams synchronize rules across Authentik and Keycloak (CNCF) while cutting token spend by 45%?
Generate a free unified CLAUDE.md and .cursorrules/.windsurfrules index at https://pulse-forge.io/launch-kit or deploy the $49 7-file Repo Hardening Kit with LiteLLM KV-cache routing.
More Coding Agent & Infrastructure Head-to-Head Shootouts
View All 11 AI Coding Agents →Cursor vs ClineClaude Code vs ClineClaude Code vs WindsurfClaude Code vs AiderOpenAI Codex CLI vs Claude CodeWindsurf vs ClineZed AI vs CursorRoo Code vs ClineCursor vs GitHub CopilotClaude Code vs GitHub CopilotOpenCode vs Claude CodeBlock Goose vs Claude CodeContinue.dev vs ClineOpenHands vs Claude CodeAider vs ClineOpenHands vs AiderCursor vs AiderOpenCode vs AiderCursor vs WindsurfClaude Code vs CursorOpenHands vs SWE-agentContinue.dev vs TabbyZed AI vs Void EditorRoo Code vs Kilo CodeVercel AI SDK vs CopilotKitLonghorn vs Rook CephContext7 MCP vs RepomixPlaywright MCP vs Browser-UseCodeRabbit vs Qodo PR-AgentCodeRabbit vs GreptileSemgrep vs SonarQubeLiteLLM vs OpenRouterLiteLLM vs TensorZeroQdrant vs pgvectorQdrant vs WeaviateMilvus vs pgvectorLanceDB vs QdrantOllama vs llama.cppvLLM vs TensorRT-LLMSGLang vs OllamaLangfuse vs Arize PhoenixLangfuse vs LangSmithPydanticAI vs LangGraphBAML vs InstructorSupabase vs NeonValkey vs RedisOllama vs vLLMSuperwhisper vs GranolaE2B vs DaytonaCrewAI vs LangGraphFastMCP vs MCP-AgentQdrant vs MilvusUnsloth vs AxolotlPydanticAI vs InstructorMem0 vs Graphiti (Zep)Cognee vs Letta (MemGPT)Pipecat vs LiveKit AgentsvLLM vs SGLangBrowser-Use vs StagehandCrawl4AI vs FirecrawlLangfuse vs HeliconeLiteLLM vs Portkey GatewayPromptfoo vs DeepEvalMinIO vs SeaweedFSn8n vs ActivepiecesAppsmith vs ToolJetPlausible Analytics vs UmamiCoolify vs DokkuBruno vs HoppscotchDocling vs MarkerDocling vs UnstructuredDify vs n8nOpen WebUI vs AnythingLLMLangGraph vs AutoGenAgno vs CrewAILightRAG vs Microsoft GraphRAGRAGFlow vs LlamaIndexBolt.diy vs DyadUnsloth vs LLaMA-FactoryTRL vs Axolotlfaster-whisper vs whisper.cppFish Speech vs F5-TTSVanna AI vs WrenAIPandasAI vs MindsDBQwen2.5-VL vs InternVL 2.5MiniCPM-o 2.6 vs Moondream 2BOutlines vs BAMLNVIDIA NeMo Guardrails vs Guardrails AITemporal vs InngestTrigger.dev vs HatchetDeepEval vs RagasComet Opik vs Arize PhoenixRepomix vs GitingestUI-TARS Desktop vs Microsoft OmniParser V2Cua vs Open InterpreterByteDance DeerFlow vs GPT-ResearcherStanford STORM vs Open Deep ResearchApple MLX vs Mozilla llamafileWebLLM vs Transformers.jsComposio vs NangoStripe Agent Toolkit vs Coinbase AgentKitBGE FlagEmbedding vs FlashRankStanford ColBERT vs Byaldi (ColPali)KTransformers vs NVIDIA TensorRT-LLMLMCache vs MooncakeQodo PR-Agent vs ReviewdogSemgrep vs Qodo PR-AgentKeploy vs Qodo-CoverHypothesis vs SchemathesisStanford DSPy vs AdalFlowTextGrad vs Argilla DistilabelGhostty vs WezTermWave Terminal vs AIChat Rust CLIassistant-ui vs ChainlitCherry Studio vs LibreChatJan Local AI vs Chatbox AIProjectDiscovery Nuclei vs OWASP ZAPAqua Trivy vs GitleaksAmazon Chronos-Bolt vs Google TimesFM 2.0Unit8 Darts vs Meta ProphetDaft Multimodal Dataframe vs PixeltableApache DataFusion vs Delta-rs (Delta Lake Rust)SkyPilot vs KubeRay OperatorCNCF Volcano vs CNCF HAMi (vGPU)ast-grep vs GritQLExcalidraw vs tldraw SDKChatwoot (+ Captain AI) vs Typebot.ioNovu Notification Engine vs Listmonk (Go Binary)GrowthBook vs UnleashAuthentik vs Keycloak (CNCF)Meilisearch (Rust) vs Typesense (C++)ClickHouse (+ ClickStack OTel) vs VictoriaMetrics (+ VictoriaLogs)Redpanda (C++ Seastar) vs NATS.io (+ JetStream)Dagster (Software-Defined Assets) vs Prefect 3.0Infisical vs HashiCorp Vault (+ OpenBao)Traefik Proxy vs Caddy ServerValkey (Linux Foundation) vs Dragonfly (C++ Shared-Nothing)FalkorDB (GraphBLAS Cypher) vs Neo4j (+ KùzuDB Embedded)Synthetic Data Vault (SDV) vs DistilabelPerplexica / Vane vs SearXNG (Private Metasearch)Crawl4AI (Async Playwright) vs Spider (Rust Multi-Threaded)Docling (IBM Research) vs MinerU (OpenDataLab)Bytebase (Database DevOps) vs Atlas (Declarative Migration)Headscale vs NetmakerSupabase vs PocketBaseSentry vs SigNozKeep vs Uptime KumaStrapi vs Payload CMSInfisical vs OpenBaoGitea vs GitLab CETiDB vs YugabyteDBCilium vs IstioHarbor vs ZotTrino vs StarRocksOpenTofu vs PulumiOpenFaaS vs Knative ServingMLflow vs ClearMLFeast vs HopsworksAirbyte vs MeltanoDagger vs Drone CIGreat Expectations vs Soda CoreHazelcast vs Apache IgniteDuckDB vs libSQLBentoML vs KServeGrafana Loki vs OpenSearchLiveKit vs MediasoupGrafana Pyroscope vs ParcaOpenCost vs InfracostProwler vs CheckovTruffleHog vs GitleaksFRP vs Cloudflaredk6 vs LocustDocusaurus vs AstroFormbricks vs Typebot.ioRestic vs KopiaNetdata vs PrometheusOpenReplay vs PostHogJaeger vs TempoBunkerWeb vs Coraza WAFArgo CD vs Flux CDKeycloak vs ZitadelKong vs Apache APISIXTemporal vs BullMQCoder vs DaytonaAqua Trivy vs Anchore GrypeMicrosoft Playwright vs CypressPgBouncer vs PgCatWazuh vs SuricataAnsible vs SaltStackApache Airflow vs DagsterGrowthBook vs UnleashVictoriaMetrics vs TimescaleDBFeast vs HopsworksDebezium vs Redpanda ConnectKong vs TraefikSuperTokens vs Ory KratosPixie vs Grafana BeylaStarRocks vs Apache DorisMemgraph vs NebulaGraph