Authelia

aid: authelia
name: Authelia
description: 'Authelia is an open source authentication and authorization server providing multi-factor authentication and
  single sign-on for applications behind a reverse proxy. It supports OpenID Connect 1.0, OAuth 2.0, TOTP, WebAuthn, and Duo
  Push as authentication methods. Authelia exposes a REST API documented with an OpenAPI specification and integrates with
  nginx, Traefik, Caddy, and other reverse proxies.

  '
type: Index
accessModel:
  pricing: freemium
  onboarding: self-serve
  trial: false
  try_now: true
  public: false
  label: Freemium · Self-serve signup
  confidence: high
  source:
  - plans
  - authentication
  generated: '2026-07-22'
  method: derived
image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/icons/authelia.png
tags:
- Authentication
- Authorization
- LDAP
- MFA
- Open Source
- OpenID Connect
- Self-Hosted
- SSO
url: https://raw.githubusercontent.com/api-evangelist/authelia/refs/heads/main/apis.yml
created: '2026-03-25'
modified: '2026-04-19'
specificationVersion: '0.19'
apis:
- aid: authelia:authelia-oidc-provider
  name: Authelia OpenID Connect 1.0 Provider
  description: 'Authelia acts as an OpenID Certified OpenID Connect 1.0 Provider supporting Authorization Code, Implicit,
    and Hybrid flows with PKCE, PAR, and various token endpoint authentication methods.

    '
  humanURL: https://www.authelia.com/configuration/identity-providers/openid-connect/provider/
  baseURL: https://your-authelia-instance.example.com
  tags:
  - Authentication
  - OAuth
  - OIDC
  - OpenID Connect
  properties:
  - type: Documentation
    url: https://www.authelia.com/configuration/identity-providers/openid-connect/provider/
- aid: authelia:authelia-discovery-api
  name: Authelia Discovery API
  description: Well-known discovery endpoints.
  humanURL: https://www.authelia.com/reference/
  baseURL: https://your-authelia-instance.example.com/api
  tags:
  - Discovery
  properties:
  - type: OpenAPI
    url: openapi/authelia-discovery-api-openapi.yml
  - type: Documentation
    url: https://www.authelia.com/reference/
  - type: GitHubRepository
    url: https://github.com/authelia/authelia
- aid: authelia:authelia-oidc-api
  name: Authelia OIDC API
  description: OpenID Connect 1.0 / OAuth 2.0 provider endpoints.
  humanURL: https://www.authelia.com/reference/
  baseURL: https://your-authelia-instance.example.com/api
  tags:
  - OIDC
  properties:
  - type: OpenAPI
    url: openapi/authelia-oidc-api-openapi.yml
  - type: Documentation
    url: https://www.authelia.com/reference/
  - type: GitHubRepository
    url: https://github.com/authelia/authelia
common:
- type: AgenticAccess
  url: agentic-access/authelia-agentic-access.yml
- type: DomainSecurity
  url: security/authelia-domain-security.yml
- type: Authentication
  url: authentication/authelia-authentication.yml
- type: OAuthScopes
  url: scopes/authelia-scopes.yml
- type: Website
  url: https://www.authelia.com
- type: Documentation
  url: https://www.authelia.com/configuration/prologue/introduction/
- type: GitHubOrganization
  url: https://github.com/authelia
- type: GitHubRepository
  url: https://github.com/authelia/authelia
- type: ChangeLog
  url: https://github.com/authelia/authelia/releases
- type: Support
  url: https://github.com/authelia/authelia/discussions
- type: Community
  url: https://discord.gg/authelia
- type: Features
  data:
  - name: Multi-Factor Authentication
    description: Supports TOTP, WebAuthn/FIDO2, Duo Push, and mobile authenticator apps as second factors.
  - name: OpenID Connect 1.0 Provider
    description: OpenID Certified identity provider supporting Authorization Code, Implicit, and Hybrid flows.
  - name: Single Sign-On
    description: Session-based SSO across all applications behind the reverse proxy with configurable session lifetime.
  - name: LDAP/Active Directory Integration
    description: User authentication against LDAP, Active Directory, and OpenLDAP directories with group-based access control.
  - name: Access Control Rules
    description: Fine-grained access control policies based on domain, path, user, group, and network for precise authorization.
  - name: Reverse Proxy Integration
    description: Native integration with nginx, Traefik, Caddy, HAProxy, Envoy, and Skipper via forward-auth and ExtAuthz
      endpoints.
  - name: Passwordless Authentication
    description: Support for WebAuthn/FIDO2 passwordless login using hardware security keys and platform authenticators.
- type: UseCases
  data:
  - name: Self-Hosted SSO
    description: Deploy a self-hosted SSO solution for internal web applications and services without relying on cloud identity
      providers.
  - name: Homelab Security
    description: Protect self-hosted homelab applications with MFA and access control without exposing them to the internet
      unprotected.
  - name: Small Business Identity
    description: Provide centralized authentication for small business web applications using LDAP and access control policies.
  - name: OIDC Provider
    description: Act as an OpenID Connect provider for applications requiring OAuth 2.0 and OIDC-based authentication flows.
- type: Integrations
  data:
  - name: Nginx
    description: Integration with nginx-based proxies including nginx, nginx-proxy-manager, and Swag via auth_request module.
  - name: Traefik
    description: Native Traefik middleware integration via ForwardAuth for seamless authentication in Docker and Kubernetes
      environments.
  - name: Caddy
    description: Caddy forward-auth integration for protecting applications behind the Caddy web server.
  - name: LDAP/Active Directory
    description: User directory integration with LDAP, Active Directory, and FreeIPA for enterprise user management.
  - name: Helm
    description: Official Helm chart available at the authelia/chartrepo GitHub repository for Kubernetes deployment.
- type: Solutions
  data:
  - name: Self-Hosted Identity
    description: Complete self-hosted identity and access management solution for privacy-conscious deployments.
  - name: Zero Trust Security
    description: Enforce zero trust network access policies for internal applications with per-request authentication verification.
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com