Casdoor vs authentik
An open-source authentik alternative, with a managed cloud
authentik and Casdoor are both open-source identity providers that speak OIDC, SAML, LDAP and RADIUS. authentik sells enterprise features per user and has no hosted version; Casdoor includes every feature in the open-source edition and offers a managed cloud.
Casdoor and authentik at a glance
| Casdoor | authentik | |
|---|---|---|
| Source code | Open source (Apache-2.0) | Open source (MIT), with enterprise features under a separate license |
| Managed service | Casdoor Cloud, from $24.17/month billed yearly | No hosted version; self-host with containers or an AWS CloudFormation template |
| Pricing | From $24.17/month billed yearly per dedicated instance, with no per-user fees; self-hosting is free | Open source free; Enterprise $5 per internal user or $0.02 per external user per month, billed yearly |
| Protocols | OAuth 2.0, OIDC, SAML, CAS, LDAP, RADIUS and SCIM | OIDC, OAuth 2.0, SAML, LDAP, RADIUS, SCIM and proxy authentication |
Information about authentik is from its public website as of October 2026 (authentik license, authentik pricing) and may have changed. authentik is a trademark of its owner.
Why teams choose Casdoor
Don't want to run it?
Casdoor Cloud gives you a dedicated instance and database from $24.17/month billed yearly, upgraded by the team that builds Casdoor.
No enterprise edition
The whole Casdoor repository is Apache-2.0, with no separately licensed enterprise directory.
Authorization included
Casbin RBAC, ABAC and ACL are built in, instead of being left to your code.
Ready for AI agents
Casdoor can be the OAuth authorization server for your MCP servers, with tokens scoped to the tools a user allowed.
When authentik may fit better
- You mainly need SSO in front of self-hosted apps that have no login of their own, using authentik's proxy outposts.
- You want to design login and enrollment steps as visual flows.
Moving from authentik to Casdoor
Export users from authentik and import them into Casdoor. Casdoor can verify bcrypt, Argon2id, PBKDF2 and salted SHA-256 / SHA-512 password hashes, so imported users can keep their passwords. Apps that use OpenID Connect, SAML or LDAP only need new endpoints and credentials.
Plan a migration with usFAQ
Frequently asked questions
Can Casdoor protect apps that have no login of their own?
Is there a hosted authentik?
Compare
How Casdoor compares
Ready to secure your next big move?
Put login, single sign-on, MFA, permissions and AI agent access behind one open-source platform, hosted by us or run by you.
Try Casdoor Cloud free
A dedicated instance in the region you choose, from $24.17/month billed yearly with no per-user fees.
Free trialSelf-host for free
Run the same Apache-2.0 Casdoor on your own servers with Docker or Kubernetes.
Read the docsTalk to an expert
Plan a migration, an on-premises rollout or an authorization model with our team.
Contact sales