---
title: "Deploy Authentik"
description: "authentik 2026.8: identity provider with SSO, OIDC, SAML, LDAP and MFA."
category: "Authentication"
url: https://railway.com/deploy/authentik-2
---

# Deploy Authentik

authentik 2026.8: identity provider with SSO, OIDC, SAML, LDAP and MFA.

**[Deploy Authentik on Railway](https://railway.com/template/authentik-2)**

Machine-readable deploy manifest (JSON, validated by TemplateCI): https://railway.com/deploy/authentik-2/manifest.json

- **Creator:** Agaz Self-Host
- **Category:** Authentication

## Template content

### worker https://goauthentik.io/img/icon.png

- **Image:** authentik/server:2026.8.3
- **Start command:** `dumb-init -- ak worker`

### Postgres https://devicons.railway.app/i/postgresql.svg

- **Image:** ghcr.io/railwayapp-templates/postgres-ssl:18

### authentik https://goauthentik.io/img/icon.png

- **Image:** authentik/server:2026.8.3
- **Start command:** `dumb-init -- ak server`
- **Health check:** /api/v3/root/config/
- **Public domain:** Yes

## Documentation

# Deploy and Host Authentik on Railway

authentik is an open-source identity provider for single sign-on. It supports OAuth2 and OpenID Connect, SAML, LDAP, RADIUS and SCIM, proxy authentication for apps without login, MFA with TOTP, WebAuthn and passkeys, and customizable login flows. It is a self-hosted alternative to Okta, Auth0 and Keycloak.

## About Hosting Authentik

This template runs the official `authentik/server:2026.8.3` image as a server and a worker with Railway Postgres; current authentik versions no longer need Redis. The admin `akadmin` is bootstrapped from `AUTHENTIK_BOOTSTRAP_EMAIL`, a generated password and a generated API token, so the initial-setup flow is locked. Default login flows appear about a minute after the first boot, once the worker applies its blueprints. Uploaded media such as icons live on a Railway volume on the server. Both services together need about 1 GB of RAM, so the Hobby plan works for small setups. Add your own domain to use it for production SSO.

## Common Use Cases

- Single sign-on for self-hosted apps with OIDC or SAML
- Adding login and MFA in front of apps with the proxy outpost
- An LDAP directory for legacy apps backed by modern MFA

## Dependencies for Authentik Hosting

- `authentik/server:2026.8.3` (official image, server and worker)
- Railway Postgres
- A Railway volume at `/data` on the server

### Deployment Dependencies

- [authentik documentation](https://docs.goauthentik.io/)
- [authentik 2026.8.3 release](https://github.com/goauthentik/authentik/releases/tag/version%2F2026.8.3)
- [Automated install variables](https://docs.goauthentik.io/install-config/automated-install/)

### Implementation Details

| Service | Source | Networking | Storage |
| --- | --- | --- | --- |
| authentik | `authentik/server:2026.8.3` (`ak server`) | public domain on 9000 | volume at `/data` |
| worker | `authentik/server:2026.8.3` (`ak worker`) | private | none |
| Postgres | Railway Postgres | private | Railway volume |

| Variable | Default | Purpose |
| --- | --- | --- |
| `AUTHENTIK_BOOTSTRAP_EMAIL` | `admin@example.com` | Email of `akadmin` |
| `AUTHENTIK_BOOTSTRAP_PASSWORD` | generated | Password of `akadmin` |
| `AUTHENTIK_BOOTSTRAP_TOKEN` | generated | API token for `akadmin` |
| `AUTHENTIK_SECRET_KEY` | generated | Signing and encryption key |
| `AUTHENTIK_URL` | `https://` | Where to sign in |

Notes:

- Sign in at `https:///if/flow/initial-setup/` is disabled; use `https:///` with `akadmin`.
- Bootstrap variables only apply on the first start; change the password in the admin UI later.
- The worker has no volume, so outposts and certificates are managed through the API rather than files.

This is a community-maintained deployment package and does not imply affiliation with or endorsement by Authentik Security or the authentik project.

## Why Deploy Authentik on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Authentik on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.


## Similar templates

- [Keycloak](https://railway.com/deploy/mSwigX) — Keycloak template with keywind theme + apple and discord providers
- [lua-protector](https://railway.com/deploy/lua-protector) — Test deployed my project first
- [bknd](https://railway.com/deploy/p4nTYL) — Feature-rich yet lightweight backend

Open this page in a browser: https://railway.com/deploy/authentik-2