--- title: "Deploy Authentik | (Just Updated) SSO Identity Provider, OIDC and SAML, Admin Login and API Token Ready" description: "Authentik SSO identity provider: OIDC, SAML, LDAP, generated admin login" category: "Authentication" url: https://railway.com/deploy/authentik-or-just-updated-sso-identity-p --- # Deploy Authentik | (Just Updated) SSO Identity Provider, OIDC and SAML, Admin Login and API Token Ready Authentik SSO identity provider: OIDC, SAML, LDAP, generated admin login **[Deploy Authentik | (Just Updated) SSO Identity Provider, OIDC and SAML, Admin Login and API Token Ready on Railway](https://railway.com/template/authentik-or-just-updated-sso-identity-p)** Machine-readable deploy manifest (JSON, validated by TemplateCI): https://railway.com/deploy/authentik-or-just-updated-sso-identity-p/manifest.json - **Creator:** SuperSlowSloth - **Category:** Authentication ## Template content ### postgres - **Image:** postgres:17@sha256:31ba9c94a03ada9988f2bb493a22a75eef3a185884533e5cdbcd498ea835b08f ### authentik - **Image:** ghcr.io/goauthentik/server:2026.8.5@sha256:602227a86455d6772e3d16b7d852713c4f864f40df5df894abd1285bb53979a5 - **Start command:** `/bin/sh -c 'export AUTHENTIK_LISTEN__HTTP="[::]:${PORT:-9000}" AUTHENTIK_POSTGRESQL__USER=postgres AUTHENTIK_POSTGRESQL__NAME=postgres AUTHENTIK_DISABLE_UPDATE_CHECK=true AUTHENTIK_DISABLE_STARTUP_ANALYTICS=true; echo "authentik boot uid=$(id -u) listen=$AUTHENTIK_LISTEN__HTTP data_owner=$(stat -c %u:%g /data)"; exec dumb-init -- ak allinone'` - **Health check:** /api/v3/ - **Public domain:** Yes ## Documentation # Deploy and Host Authentik on Railway **Built for an LLM agent to deploy and use.** There is no setup wizard and nothing to fill in: the admin password and an API token are generated at deploy time, the contract below lists every URL and variable name, and one working script authenticates against the REST API and creates a group. Authentik is an open-source identity provider and SSO platform: OpenID Connect, OAuth2, SAML, LDAP and proxy providers, flexible login flows, MFA, and user and group management. This template runs the official Authentik server image together with a PostgreSQL database, and keeps both on Railway volumes so users, applications and flows survive redeploys. ## About Hosting Authentik This template runs two services. `authentik` is the official **ghcr.io/goauthentik/server** image (pinned by digest) started as `ak allinone`, which runs the web server and the background worker in one container, with a volume at `/data`. `postgres` is the official **postgres:17** image (pinned by digest) with a volume at `/var/lib/postgresql`, reachable only on the private network. On first boot Authentik runs its database migrations, which take a few minutes, then creates the `akadmin` user from `AUTHENTIK_BOOTSTRAP_PASSWORD` and `AUTHENTIK_BOOTSTRAP_EMAIL` and registers `AUTHENTIK_BOOTSTRAP_TOKEN` as an API token for it. Update checks and startup analytics are disabled. The server listens on `[::]:$PORT`, so Railway's healthcheck and the private network (IPv6) both reach it. The container runs as root only so it can fix ownership of the root-owned Railway volume; Authentik then drops privileges itself. Allow roughly 150 seconds for the first deploy to turn healthy. ### Agent contract - Public URL: `https://`, on the `authentik` service (set `AUTHENTIK_URL` to it, no trailing slash) - Private URL: `http://authentik.railway.internal:8080` - Credentials: user `akadmin`, password in `AUTHENTIK_BOOTSTRAP_PASSWORD`, API token in `AUTHENTIK_BOOTSTRAP_TOKEN` (both on the `authentik` service) - Auth: `Authorization: Bearer $AUTHENTIK_BOOTSTRAP_TOKEN` on every `/api/v3/` call; anonymous requests get 403; the web interface is at `/if/admin/` and takes the `akadmin` password - Health: `GET /api/v3/` returns 200 with no credentials ```bash # run with AUTHENTIK_URL and AUTHENTIK_BOOTSTRAP_TOKEN (authentik service); needs curl H="Authorization: Bearer $AUTHENTIK_BOOTSTRAP_TOKEN" curl -s -o /dev/null -w 'health %{http_code}\n' "$AUTHENTIK_URL/api/v3/" curl -s -o /dev/null -w 'anonymous %{http_code}\n' "$AUTHENTIK_URL/api/v3/core/users/me/" curl -fsS -H "$H" "$AUTHENTIK_URL/api/v3/core/users/me/" | grep -o '"username":"[a-z]*"' curl -fsS -H "$H" -H 'Content-Type: application/json' -d '{"name":"agents"}' "$AUTHENTIK_URL/api/v3/core/groups/" -o /dev/null -w 'create group %{http_code}\n' curl -fsS -H "$H" "$AUTHENTIK_URL/api/v3/core/groups/?name=agents" | grep -o '"name":"agents"' ``` A fresh deploy prints `health 200`, `anonymous 403`, `"username":"akadmin"`, `create group 201` and `"name":"agents"`. Create applications, providers and users the same way under `/api/v3/`, or open `/if/admin/` and sign in as `akadmin`. ## Why Deploy Authentik on Railway? Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it. By deploying Authentik on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway. - **Agent-ready** - generated admin password and API token, a contract block and one working script; no setup wizard. - **Stable login** - the admin password, API token and secret key are the same after every redeploy. - **State survives redeploys** - the database and the Authentik data directory live on volumes. - **Private database** - PostgreSQL has no public domain and is reached over the private network. ## Common Use Cases - **Single sign-on for self-hosted apps** - one login for Grafana, Gitea, Nextcloud and anything that speaks OIDC or SAML. - **Agent-driven identity management** - let an AI agent create users, groups, applications and providers through the REST API. - **Authentication for your own product** - an OIDC provider with MFA and custom login flows in front of an internal tool. ## Dependencies for Authentik Hosting - A PostgreSQL database (included in this template, volume at `/var/lib/postgresql`). - A volume at `/data` on the Authentik service (included in this template). ### Deployment Dependencies - [goauthentik/authentik](https://github.com/goauthentik/authentik) - upstream project - [Authentik documentation](https://docs.goauthentik.io/) - configuration reference ## Similar templates - [Keycloak](https://railway.com/deploy/mSwigX) — Keycloak template with keywind theme + apple and discord providers - [lua-protector](https://railway.com/deploy/lua-protector) — Test deployed my project first - [bknd](https://railway.com/deploy/p4nTYL) — Feature-rich yet lightweight backend Open this page in a browser: https://railway.com/deploy/authentik-or-just-updated-sso-identity-p