# Authentik vs Keycloak (CNCF): 2026 Empirical Benchmark & Cost Shootout

> **Direct Answer (October 2026 Verdict)**: Authentik wins on modern visual authentication/enrollment flow orchestration, built-in Outpost reverse-proxy Forward Auth for zero-trust AI dashboards, and lower 650MB RAM footprint across 26.0k+ GitHub stars (97.9), while CNCF Keycloak wins on banking-grade FAPI 2.0 compliance, massive multi-realm B2B SAML 2.0 / Kerberos identity brokering, and deep Java/Quarkus SPI extensibility across 37.4k+ GitHub stars (98.0).

- **Category**: Visual Flow Identity Provider & Forward-Auth Proxy vs CNCF Enterprise OIDC/SAML Federation Server Shootout
- **Canonical URL**: https://pulse-forge.io/vs/authentik-vs-keycloak
- **1-Click $0 Free Starter docker-compose.prod.yml + CLAUDE.md**: https://pulse-forge.io/api/launch-kit/free-claude-md?repo=authentik/authentik
- **1-Click $4.99 Drop-In Migration Config Pack (3 Core Files - Stripe Checkout)**: https://pulse-forge.io/buy/micro_pass?repo=authentik/authentik&source=md_vs
- **1-Click $9.99 Complete 9-File Production Config .ZIP (Stripe Checkout)**: https://pulse-forge.io/buy/repo_pass_999?repo=authentik/authentik&source=md_vs_999
- **1-Click $49 Builder Repo Hardening & Launch Kit (Stripe Checkout)**: https://pulse-forge.io/buy/instant_boost?repo=authentik/authentik
- **1-Click $149 Category Leader Pro + 30-Day Pin (Stripe Checkout)**: https://pulse-forge.io/buy/category_leader?repo=authentik/authentik
- **Specimen #1 Production Config Preview (`docker-compose.prod.yml`)**: `+ [docker-compose.prod.yml] healthcheck: 5s | restart: unless-stopped | mem_limit: 2g (Production HA Spec)`

## Authentik Key Advantages
- 25,992+ GitHub stars under MIT with a visual DAG flow engine for custom MFA, Passkey, OAuth2, SAML, LDAP, and SCIM enrollment policies
- Built-in reverse-proxy Forward Auth Outposts protect internal AI apps (Open WebUI, Langfuse, Grafana) without code changes
- 650MB Python/Go container footprint (-46% RAM vs JVM stacks) replacing both Okta Workforce and Cloudflare Access

## Keycloak (CNCF) Key Advantages
- 37,419+ GitHub stars as the CNCF Incubating gold standard for enterprise OIDC, SAML 2.0, OAuth 2.1, and FAPI 2.0 security
- Supports unlimited B2B customer SAML/OIDC realms with zero per-connection fees, cutting $3,850/mo Auth0 Enterprise bills by 96.2%
- Quarkus cloud-native runtime with fine-grained UMA 2.0 authorization services and custom Java SPI providers