How to Install Authentik with Docker Compose for SSO Across Self-Hosted Apps

If you run multiple self-hosted apps and you're tired of logging in to each one separately, it's time to set up a single sign-on system. In this guide, you'll learn how to install Authentik with Docker Compose and use it to protect your apps with one central login.

Authentik is an open-source identity provider (IdP) that gives you SSO, OAuth2/OIDC, SAML, and LDAP in one place. You control all user data, all login flows, and all policies. It runs as a set of Docker containers and fits perfectly on a Linux VPS.

The stack has four main pieces:

• PostgreSQL: Stores all user data, apps, and configuration.
• Redis: Handles sessions and background task queues.
• Server: The main Authentik process that handles logins and the web UI.
• Worker: Runs background jobs like outpost management and email sending.

To install Authentik with Docker Compose, make sure your server has:

• At least 2 CPU cores and 2 GB of RAM.
• Ubuntu 22.04 or newer is running.
• Docker and Docker Compose v2 are installed.
• A domain name pointing to your server, which is needed for reverse proxy and SSL.
• Ports 80 and 443 are open in your firewall.

A fresh Linux VPS is the perfect place to run this. You get a dedicated IP, full root access, and full control over what runs on the machine.

SSH into your server and update the system with the command below:

Install Docker if it's not already installed:

Verify Docker Compose is working:

You should see Docker Compose version v2 or higher.

You must create a dedicated folder for Authentik and navigate into it with the command below:

The official Authentik project provides a ready-to-use Docker Compose file. You can download it with the following command:

This gives you a docker-compose.yml file that defines all four services, including PostgreSQL, Redis, server, and worker.

Here's what the file looks like:

Note: The database and redis named volumes handle persistent storage automatically. Your data survives container restarts.

Authentik needs a strong PostgreSQL password and a secret key. You can run these two commands to generate them and write them directly to your .env file:

Important Note: PostgreSQL does not support passwords longer than 99 characters. The command above uses base64-36, which stays well within that limit.

Email is optional but highly recommended. Authentik uses it to send password reset links, admin alerts, and verification emails. Append this block to your .env file:

Replace the values with your actual SMTP provider details.

If you want Authentik to listen directly on standard HTTP/HTTPS ports instead of 9000/9443, add these lines to the .env file:

At this point, you can pull the images and start all containers with the commands below:

Give it about 60 seconds for the health checks to pass and the database migrations to complete. Then, check the logs to confirm everything started cleanly:

Look for a line like Starting on port 9000, that's your confirmation.

Open your browser and go to:

You'll see a setup screen asking you to create the akadmin account. Set a strong password here; this is your main admin account.

After that, you'll land on the Authentik admin interface at:

This is where you manage everything: users, groups, applications, providers, and outposts.

Before protecting apps, you can put Authentik behind a proper reverse proxy with SSL. Here's a basic Nginx config to put Authentik behind a domain.

You can easily register a domain from PerLod if you don't have one.

Create the file:

Paste this config with your domain:

Enable the site and get your SSL certificate with Certbot:

Here's how you can actually connect a real app to Authentik:

A Provider tells Authentik how to authenticate users for a specific app. For forward auth, use the Proxy Provider.

1. In the Authentik admin panel, go to Applications → Providers.
2. Click New Provider.
3. Select Proxy Provider and click Next.
4. Fill in the details:
   • Name: my-app-provider
   • Authorization flow: default-provider-authorization-implicit-consent
   • Mode: Select Forward auth (single application)
   • External host: https://myapp.yourdomain.com
5. Click Create.

An Application connects your provider to a real URL.

1. Go to Applications → Applications.
2. Click New Application.
3. Fill in:
   • Name: My App
   • Slug: my-app
   • Provider: Select my-app-provider
4. Click Create.

An Outpost is the actual authentication proxy that sits between your reverse proxy and Authentik. Authentik ships with an embedded outpost, so you don't need to deploy anything extra.

• Go to Applications → Outposts.
• You'll see a default outpost called Authentik Embedded Outpost.
• Click Edit.
• Under Applications, add your newly created application.
• Click Update.

Now comes the part to protect a running app. Let's say you have a simple app running at myapp.yourdomain.com on port 8080 internally.

Create the file:

Add this Nginx config for your app's domain:

Enable it and get SSL:

Now try visiting https://myapp.yourdomain.com in your browser. You'll be redirected to the Authentik login page. After you log in, you'll be sent right back to your app with the user's identity passed in the X-authentik-username and X-authentik-email headers.

It's worth understanding what's happening in Forward Auth:

• Your browser requests https://myapp.yourdomain.com.
• Nginx intercepts the request and uses auth_request to ask Authentik: Is this session valid?
• If Authentik returns 200 OK, Nginx passes the request to your app along with the user's identity headers.
• If Authentik returns 401, Nginx redirects the user to the Authentik login page.
• After a successful login, Authentik redirects back to the original URL.

Your app doesn't need to know anything about authentication; Nginx handles it all.

For apps that natively support OAuth2 or OIDC, like Grafana, Nextcloud, Portainer, you can use the OAuth2/OpenID Provider instead of Proxy Provider.

1. Go to Applications → Providers → New Provider.
2. Select OAuth2/OpenID Provider.
3. Fill in:
   • Name: grafana-provider
   • Authorization flow: default-provider-authorization-explicit-consent
   • Client type: Confidential
   • Redirect URIs: https://grafana.yourdomain.com/login/generic_oauth
4. Note the Client ID and Client Secret, paste these into your app's OAuth config.
5. Create an Application linked to this provider.

The OIDC discovery URL will be:

To add a new user:

• Go to Directory → Users → New User → Internal User.
• Fill in username, name, and email.
• Set a password under the user's Credentials tab.

To restrict an app to specific users, create a Group and assign it to the app's Policy Bindings:

• Go to Directory → Groups → New Group.
• Name your group, for example, app-users.
• Add members.
• In your Application settings, go to Policy / Group / User Bindings and bind the group.

Authentik supports TOTP like Google Authenticator and Authy, WebAuthn (hardware keys), and email-based MFA.

To turn on TOTP for all users:

• Go to Flows and Stages → Stages → New Stage.
• Select Authenticator Validation Stage.
• Enable TOTP under allowed devices.
• Add this stage to your authentication flow under Flows and Stages → Flows.

To upgrade to a new version, you can easily download the latest Compose file and restart:

Always check the release notes before upgrading; some versions have migration steps.

For more detailed information and release changelog, you can visit the official Authentik documentation.

At this point, you have a working SSO layer protecting your self-hosted apps. You have learned to run an Authentik instance, create a provider and application, and set up forward auth so your app requires a login without changing a single line of app code.

We hope you enjoy this guide.