The door is not the ID check
Our internal tools sit behind Cloudflare Access, and for a long time the login was a one-time code sent by email. It works. It is also a login nobody would design on purpose in 2026: every visit costs an inbox round trip, and a code in an inbox is exactly what phishing kits are built to catch. What I want is one identity, with a passkey, that every internal tool trusts.
The trap is treating that as a choice of gateway. Access already decides who gets through the door. What it lacks is a better answer to "who is this?", and that answer comes from an identity provider sitting behind it over OIDC. Once I framed it that way, half the "Authentik alternatives" lists stopped being useful, because they rank libraries, proxies and identity providers against each other.
Sorting the eight names
- Identity providers: Authentik, Keycloak, ZITADEL. They own users, credentials, federation and recovery.
- Narrower providers: Authelia, an access proxy with an OIDC provider and no SAML, and Pocket ID, an OIDC provider that only accepts passkeys.
- Libraries: Better Auth and Auth.js. Login code inside one app.
- Gateway: Cloudflare Access. It consumes an identity provider. It isn't one.
Five of these can act as the OIDC provider behind Access: Authentik, Keycloak, ZITADEL, Authelia and Pocket ID. The libraries cannot without extra plugins, and the gateway is already in place.
What I actually weighed
Passkeys as the primary login, not a second factor. Pocket ID allows nothing else. Authentik's 2026.8 WebAuthn stage supports passwordless passkeys with browser autofill. Keycloak and ZITADEL document passkeys too. Authelia's GitHub page lists passwordless passkeys but its OIDC documentation does not, so I'm not counting it.
SAML, for the one vendor tool that insists on it. Only Keycloak and Authentik confirm they act as SAML identity providers. Authelia states it doesn't, and I could not confirm it for ZITADEL from its docs.
Recovery. A lost phone should not mean a lost account, and it should not mean a support ticket to me at midnight either. Authentik builds recovery from the same flow engine as login. Keycloak has its credential-reset flow. With Pocket ID, recovery is an admin process you have to define yourself.
What I have to run. Authentik needs PostgreSQL and Redis. ZITADEL needs PostgreSQL 14 or newer. Keycloak is a Java service with an external database. Pocket ID runs on SQLite. None of the vendors publish comparable memory figures, so I'm not quoting any.
Getting out again. Because Access speaks plain OIDC to whatever sits behind it, swapping the identity provider later doesn't touch the gateway. The real lock-in is in the provider's user store and in enrolled passkeys, which are bound to the login hostname. That is a reason to pick the hostname carefully once, not a reason to avoid choosing.
Licenses and money
Keycloak and Authelia are Apache-2.0, Pocket ID is BSD-2-Clause and Better Auth is MIT. ZITADEL is AGPL-3.0 with exceptions for some directories, which I'd want a lawyer to read before building a product on it. Authentik's core is MIT, with an Enterprise tier at $5 per internal user per month and a public pledge not to move open-source features behind it. For an internal staff login the free core is enough.
My call
I'm piloting Authentik behind Cloudflare Access, with the email code staying available as the fallback while it runs. It's the only option I found with OIDC, SAML and passkey-only login confirmed in one MIT-licensed system, and its flow engine handles enrollment and recovery without custom code. The pilot has to prove two things before anyone depends on it: that a person with two enrolled passkeys can lose one and still get in, and that Access policies behave exactly as before.
Two things would change my mind. If the pilot shows that nobody needs SAML and the flows are more machinery than we use, Pocket ID does the passkey job with a fraction of the moving parts. If this grows into something customers rely on, Keycloak's foundation governance starts to matter more than footprint.
The company-side version of this comparison, with the full feature table, is on We The Flywheel.
What I couldn't confirm
As of 2 October 2026 I could not confirm from primary sources: memory needs for any of these tools, passkey-only login in Authelia, ZITADEL acting as a SAML identity provider, Pocket ID's recovery flow, or the maturity of Better Auth's identity-provider plugin. Cloudflare's plans page did not show Zero Trust seat limits or prices.
Sources
All accessed 2 October 2026.
- Authentik WebAuthn authenticator stage (2026.8) and pricing
- Keycloak server administration guide
- ZITADEL identity brokering and repository
- Authelia OpenID Connect integration
- Pocket ID documentation
- Better Auth and Auth.js
- Cloudflare One identity provider integration
Frequently Asked Questions
What is the best Authentik alternative for a small team?
If the only requirement is passkey login for staff, Pocket ID: an OpenID Certified, passkey-only OIDC provider that runs on SQLite. If you need SAML for a vendor tool or long-term vendor neutrality, Keycloak, which is Apache-2.0 and a CNCF incubating project. If you need OIDC, SAML and passkeys from one system with configurable enrollment and recovery, Authentik itself is hard to beat.
Does Cloudflare Access replace an identity provider?
No. Access enforces policy in front of an app and asks an identity provider who the user is. It ships a one-time email PIN and accepts social, corporate, generic OIDC and generic SAML providers. Cloudflare's docs recommend OIDC where both are possible.
Can I use passkeys with Cloudflare Access?
Yes, through the identity provider behind it. Authentik 2026.8, Keycloak, ZITADEL and Pocket ID all document passkey login, and each can be connected to Access as a generic OIDC provider.
Should I use Better Auth instead of Authentik?
Only for a single product that needs its own customer sign-up. Better Auth and Auth.js live inside one application's code and database. They do not give a team one login across many internal tools. Auth.js now says on its own site that it is part of Better Auth.
Is Authentik open source?
The core is MIT-licensed. Authentik also sells an Enterprise tier, listed at $5 per internal user per month billed annually, and Enterprise Plus from $20,000 per year, and states it will not move open-source features into the paid tiers.
Need Expert Technology Guidance?
20+ years leading technology transformations. Get a technology executive's perspective on your biggest challenges.
