# Authentik vs Keycloak (CNCF): 2026 Empirical Benchmark & Cost Shootout

> **Direct Answer (October 2026 Verdict)**: Authentik wins on modern visual authentication/enrollment flow orchestration, built-in Outpost reverse-proxy Forward Auth for zero-trust AI dashboards, and lower 650MB RAM footprint across 26.0k+ GitHub stars (97.9), while CNCF Keycloak wins on banking-grade FAPI 2.0 compliance, massive multi-realm B2B SAML 2.0 / Kerberos identity brokering, and deep Java/Quarkus SPI extensibility across 37.4k+ GitHub stars (98.0).

- **Category**: Visual Flow Identity Provider & Forward-Auth Proxy vs CNCF Enterprise OIDC/SAML Federation Server Shootout
- **Canonical URL**: https://exactbaseline.com/vs/authentik-vs-keycloak
- **1-Click $49 Builder Repo Hardening & Launch Kit (Stripe Checkout)**: https://exactbaseline.com/buy/instant_boost
- **1-Click $149 Category Leader Pro + 30-Day Pin (Stripe Checkout)**: https://exactbaseline.com/buy/category_leader

## Authentik Key Advantages
- 25,992+ GitHub stars under MIT with a visual DAG flow engine for custom MFA, Passkey, OAuth2, SAML, LDAP, and SCIM enrollment policies
- Built-in reverse-proxy Forward Auth Outposts protect internal AI apps (Open WebUI, Langfuse, Grafana) without code changes
- 650MB Python/Go container footprint (-46% RAM vs JVM stacks) replacing both Okta Workforce and Cloudflare Access

## Keycloak (CNCF) Key Advantages
- 37,419+ GitHub stars as the CNCF Incubating gold standard for enterprise OIDC, SAML 2.0, OAuth 2.1, and FAPI 2.0 security
- Supports unlimited B2B customer SAML/OIDC realms with zero per-connection fees, cutting $3,850/mo Auth0 Enterprise bills by 96.2%
- Quarkus cloud-native runtime with fine-grained UMA 2.0 authorization services and custom Java SPI providers