Recommended Free Tools
Put Authentik at the authentication boundary of your reverse proxy, not inside each application. For one service that needs its own groups and policies, use single-application forward authentication. For several services that share the same access rules, use domain-level forward authentication. Use proxy mode only when you deliberately want application traffic to pass through an Authentik outpost. Whichever pattern you choose, preserve the original host, scheme, and client address, restrict trusted proxy networks, and require phishing-resistant multi-factor authentication for sensitive services.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What Authentik protects in a self-hosted setup
Authentik is an identity and access layer that sits between an internet user and services such as game-server panels, administration dashboards, media libraries, monitoring systems, and internal tools. Your application still handles its own business logic; Authentik decides whether a request has an authenticated session and whether that user is allowed through the policy attached to the application.
As an Amazon Associate I earn from qualifying purchases.
Most deployments place a reverse proxy in front of both Authentik and the protected service. The proxy receives the public request, asks an Authentik outpost whether the request is authenticated, and either redirects the user to the sign-in flow or forwards the request to the service. This keeps authentication policy in one place while allowing each service to remain on its normal internal port.
Choose the correct Authentik provider pattern
| Pattern | Request path | Best fit | Main trade-off |
|---|---|---|---|
| Proxy mode | Client traffic is sent through an Authentik outpost before reaching the application. | Applications that need Authentik to act as the traffic gateway. | The outpost is in the application data path, so its availability and capacity directly affect the service. |
| Single-application forward auth | Your existing reverse proxy sends an authentication check to the outpost, then sends approved traffic directly to the application. | A service with independent groups, policies, or bindings. | You configure a separate provider and application for every independently governed service. |
| Domain-level forward auth | Multiple hosts under one parent domain use a shared authentication endpoint and cookie domain. | A collection of services with the same access policy. | Administration is simpler, but you cannot apply different application-level authorization rules to each service. |
When single-application forward auth is the safer choice
Create a separate application and provider when a service needs its own group membership, policy bindings, or authorization exceptions. A game server administration panel, for example, may need to be available to moderators while a monitoring dashboard is limited to infrastructure administrators. Independent providers let you express those differences without creating broad domain-wide access.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Route the service normally to its upstream. On that service’s public host, route /outpost.goauthentik.io to the Authentik outpost. The reverse proxy performs the forward-auth check and keeps the application request on its ordinary upstream path.
When domain-level forward auth is appropriate
Use domain-level forward auth when several applications genuinely share the same audience and policy. A private collection of read-only dashboards is a reasonable example. The shared authentication URL and cookie domain reduce repeated configuration, but the arrangement should not be used merely because it is convenient. If one host later needs a different group, binding, or exception, move that host to its own application and provider rather than weakening the shared rule.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Plan the trust boundary before exposing a service
- Separate public and private networks. The reverse proxy should be the only component accepting public traffic. Keep Authentik’s internal endpoints reachable only from the proxy and the outpost where possible.
- Decide which component terminates TLS. The public proxy normally terminates HTTPS; connections from the proxy to Authentik and the application can be HTTP or HTTPS according to your network design. Validate certificates when an outpost connects to an HTTPS upstream.
- Identify the direct proxy networks. Authentik accepts forwarded headers only from trusted proxy networks. Set
AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRSto the CIDR ranges that directly connect to Authentik. Never include a network from which untrusted clients can connect. - Keep the internal Authentik ports private. With a containerized deployment, the internal 9000/9443 path should be reachable only by trusted containers when using a reverse proxy such as Traefik.
- Do not protect Authentik with itself. Never attach the forward-auth middleware to Authentik’s own router. Doing so can create a redirect loop or lock you out of the identity service.
Configure a protected application step by step
1. Deploy Authentik and an outpost
Install Authentik according to its deployment method and ensure the outpost can reach the Authentik server over the network. Confirm that the outpost is healthy before adding application routes. If the outpost cannot resolve the Authentik hostname, reach its port, or validate the TLS certificate, every protected service will fail authentication regardless of its own configuration.
2. Create the provider
- In the Authentik administrator interface, open the provider creation area and choose the proxy provider type.
- Select forward authentication for a service that should remain on the existing reverse-proxy path, or select proxy mode when Authentik should carry the application traffic.
- For a service with independent authorization, create one provider for that service. For services with identical policy under one parent domain, use the domain-level forward-auth arrangement.
- Save the provider and record which outpost will serve it.
3. Create the application and bind it to the provider
- Create an application in Authentik and assign the provider you just created.
- Attach the groups, policies, and bindings that should govern this service.
- Keep the application name and public host mapping unambiguous. A clear one-to-one naming scheme makes it easier to revoke access later and to diagnose a policy mismatch.
4. Add the reverse-proxy routes
For forward auth, configure two logical routes on the public host:
- The service route sends ordinary application requests to the service’s upstream.
- The path
/outpost.goauthentik.iosends authentication checks and callback traffic to the selected outpost.
The proxy’s forward-auth middleware must call the outpost before the upstream request is released. A successful check should preserve the authentication response headers required by your application; an unauthenticated request should be redirected to the Authentik sign-in flow rather than passed to the upstream.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
5. Test both allowed and denied paths
- Open a private browser window and visit the protected host. You should be redirected to Authentik.
- Sign in with an account that satisfies the application’s policy and confirm that the upstream loads.
- Test an account outside the permitted group. It should receive an authorization failure, not the application’s login page or an unprotected response.
- Inspect the proxy and outpost logs for the request ID if the result is unexpected.
- Test a WebSocket feature if the service uses live consoles, multiplayer status, or real-time logs.
Reverse-proxy requirements that prevent subtle failures
Authentication can appear to work while redirects, cookies, client addresses, or WebSockets fail if the proxy sends incomplete request metadata. Preserve the original request context with these headers:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsX-Forwarded-Host: original public host
X-Forwarded-Proto: http or https used by the client
X-Forwarded-For: original client addressHost may be used instead of X-Forwarded-Host when that is how your proxy is designed. The important point is that Authentik and the application must see the public host and scheme, not an internal container name and port.
For WebSockets, use HTTP/1.1 and pass both Connection: Upgrade and Upgrade: WebSocket. Without those headers, a browser may authenticate successfully but a live terminal, game-console stream, or real-time dashboard will disconnect immediately.
Nginx
Define the authentication subroute and the protected upstream as separate locations. Pass the original host, scheme, and forwarding chain, and explicitly configure the WebSocket upgrade on locations that need it. Keep the outpost endpoint private except through the intended public host route.
Traefik
Attach the forward-auth middleware only to application routers. Do not attach it to Authentik’s own router. In a container deployment, keep the internal 9000/9443 route on a trusted network and expose it to the middleware through that network rather than publishing it broadly.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Caddy
Use a dedicated authentication handler for the protected host and a separate reverse-proxy handler for the outpost path. Verify that the handler preserves the incoming host and scheme and that WebSocket upgrade requests are not downgraded.
HAProxy
Implement the outpost check as an authorization decision before selecting the application backend. Preserve the forwarding headers on both the authentication request and the approved application request, and allow HTTP/1.1 upgrade semantics for WebSocket backends.
Use multi-factor authentication that matches the threat model
Authentik’s hardening guidance calls requiring a second factor “the single most effective change you can make to an authentication flow.” For an internet-facing administration panel or a service that can change firewall, game-server, or storage settings, password-only access is an avoidable risk.
Require an authenticator in the flow
- Add an Authenticator Validation stage to the authentication flow.
- Require users to enroll an authenticator rather than making enrollment optional for privileged accounts.
- Choose the accepted device classes. If phishing resistance is the priority, restrict the validation stage to WebAuthn.
- Set WebAuthn user verification to Required when your threat model demands proof that the person is present and has unlocked the authenticator.
Understand the WebAuthn options
| Authenticator type | Examples | Strengths | Operational considerations |
|---|---|---|---|
| Hardware security key | FIDO2/WebAuthn key | Strong phishing resistance and separation from the computer being accessed. | Users need a spare key or another recovery method; lost keys require an account-recovery procedure. |
| Platform authenticator | Windows Hello, Touch ID, or Face ID | Convenient, device-integrated authentication with biometric or local-PIN protection. | Access depends on the enrolled device and its operating-system recovery options. |
| Passkey | Passkey stored by an operating system or password manager | Can synchronize across a user’s approved devices while retaining WebAuthn’s phishing-resistant protocol. | Synchronization and account-recovery policy become part of your trust model. |
Make a hardware key mandatory
Enroll the key in the WebAuthn setup stage, then allow the WebAuthn device class in Authenticator Validation. Merely enabling WebAuthn does not force every user to register a hardware key; the enrollment and validation stages must agree on the allowed device class.
Keep enrollment and validation filters aligned. Authentik notes that older enrollments or unrecognized AAGUIDs can pass a filter without a stored device type. If an allowlist must be enforceable, have affected users re-enroll instead of assuming an existing credential will be classified correctly.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Protect Authentik’s secrets and sessions
AUTHENTIK_SECRET_KEY signs session cookies and supports cryptographic operations. Generate it from a cryptographically secure source, keep it out of version control, and inject it through a secret manager or equivalent protected deployment mechanism.
Changing the secret invalidates active sessions. Treat that as an intentional security operation: schedule it when administrators can sign in again, communicate the expected logout, and verify that all application sessions are re-established afterward. Never rotate it casually during an incident without preserving a known-good recovery path.
Patch Authentik and respond to security advisories
Track Authentik security advisories and upgrade promptly. Advisory GHSA-qgqp-xh8r-v73r describes an email-authenticator multi-factor bypass fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2. Until the deployment is upgraded to a fixed release, do not rely on email MFA as the only additional factor. Prefer WebAuthn or another factor appropriate to the deployment’s threat model.
After an upgrade, test a complete sign-in, a denied account, an expired session, and a WebSocket application. Also verify that the outpost is compatible with the Authentik server version and that its connection uses the expected TLS validation settings.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshoot the most common failure modes
Redirect loop between the service and Authentik
- Confirm the forward-auth middleware is not attached to Authentik’s own router.
- Check that
X-Forwarded-Protoreflects the public HTTPS request. A proxy that reports HTTP can cause Authentik to redirect back to the same URL repeatedly. - Verify the cookie domain and public hostname, especially when using domain-level forward auth.
Every request returns an upstream or outpost error
- Check that the proxy can resolve and reach the outpost.
- Confirm that the selected outpost is assigned to the provider and is healthy.
- Review
AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS; an omitted proxy network can make forwarded headers unusable, while an overly broad value weakens the trust boundary. - If the outpost connects to HTTPS, validate the upstream certificate rather than disabling verification.
The user authenticates but sees the wrong authorization result
- Inspect the application’s group, policy, and binding assignments.
- Check whether a domain-level provider is applying one shared rule where the service needs independent authorization.
- Move that service to a separate provider and application when its policy must differ.
WebSocket consoles disconnect
- Use HTTP/1.1 between the proxy and the WebSocket upstream.
- Pass
Connection: UpgradeandUpgrade: WebSocket. - Ensure the authentication check is completed before the upgrade and that the approved request reaches the same host and path expected by the application.
A WebAuthn device passes an unexpected filter
Review whether the credential was enrolled before the device-type metadata was available or whether its AAGUID is unrecognized. Re-enroll the user when the allowlist must be strict, then test the validation stage with an account using a disallowed device class.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Operational checklist for a durable deployment
- Choose proxy mode, single-application forward auth, or domain-level forward auth based on policy granularity, not habit.
- Create independent providers for services with independent groups, policies, or bindings.
- Route
/outpost.goauthentik.ioto the outpost on every single-application forward-auth host. - Preserve
HostorX-Forwarded-Host,X-Forwarded-Proto, andX-Forwarded-For. - Trust only the proxy CIDRs that directly connect to Authentik.
- Keep Authentik’s internal 9000/9443 path off the public network.
- Do not put forward-auth middleware on Authentik’s own router.
- Require a second factor for sensitive services; prefer WebAuthn when phishing resistance matters.
- Align WebAuthn enrollment and validation device restrictions, and re-enroll affected older credentials.
- Store
AUTHENTIK_SECRET_KEYin protected secret storage and understand that changing it logs out active sessions. - Track advisories, upgrade to a fixed release, and test ordinary requests, denials, redirects, sessions, and WebSockets after every change.
How to decide for a self-hosted gaming stack
Use single-application forward auth for a game-server control panel, moderation tool, or deployment console when different staff groups need different capabilities. Use domain-level forward auth for several low-risk dashboards that all have the same audience. Keep the actual game protocol and other non-HTTP traffic on its normal network path unless the application explicitly supports an Authentik-compatible gateway; forward auth protects HTTP requests and does not automatically secure arbitrary UDP or TCP gameplay traffic.
Free tools Windows power users keep installed
One-click scans. No signup required.
For anything that can issue commands, change server configuration, or expose player data, require WebAuthn-capable MFA and keep the administration host separate from public player endpoints. This limits the blast radius if a public game service is compromised while preserving centralized sign-in for the people who operate it.
Frequently Asked Questions
Can forward auth protect a service that is not HTTP-based?
No. The documented forward-auth patterns apply to HTTP reverse-proxy requests. Non-HTTP game protocols such as arbitrary UDP or TCP traffic need their own network security and authentication design.
Should every subdomain share one Authentik provider?
Only when the services have the same authorization policy. A service requiring different groups, policies, or bindings should have its own provider and application.
Why does changing AUTHENTIK_SECRET_KEY sign users out?
The key signs session cookies and cryptographic operations. Replacing it invalidates existing sessions by design, so users must authenticate again.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
