Softwr

Cybersecurity · head to head

authentik vs Blacksmith

authentik logo

authentik

Cybersecurity

Open-source identity provider with flexible authentication flows

From
Free
Free plan
Yes
Full reviewWebsite
Blacksmith logo

Blacksmith

Developer Tools

2x faster GitHub Actions with 60% cost savings

From
Free
Free plan
Yes
Full reviewWebsite

The short version

  • Each has a real cost: authentik smaller project than Keycloak, with a correspondingly smaller community and fewer integration guides; Blacksmith per-minute pricing model requires estimating usage to predict costs
  • They diverge on capability: authentik covers Configurable flows, Blacksmith covers Bare metal runners.
  • Prices and features above were last checked on 29 August 2026.

Where they differ

Only the attributes on which authentik and Blacksmith actually diverge.

Attributes where authentik and Blacksmith differ
AttributeauthentikBlacksmith
Pricing modelOpen-source core with a paid enterprise tierUnknown
PlatformsDocker, Kubernetes, Linux, Self-hostedGitHub Actions, Linux, Windows, macOS
CategoryCybersecurityDeveloper Tools

Identical on both: starting price (Free), free tier (Yes), user rating (Not yet rated).

What each one covers

Drawn from each product's published feature list. An absence here means we hold no record of it - not that the product lacks it.

Only in authentik

  • Configurable flows
  • Protocol support
  • Application proxy
  • Modern admin interface

Only in Blacksmith

  • Bare metal runners
  • Multiple OS support
  • ARM support
  • Docker layer caching
  • Sticky disks
  • GitHub Actions observability
  • Free tier
  • Static IPs

What people use each for

The jobs each tool is most often brought in to do.

authentik

  • Self-hosted SSO across internal services without commercial identity pricingnot Blacksmith
  • Putting authentication in front of applications that have none, via the proxynot Blacksmith
  • Teams who tried Keycloak and wanted something less heavynot Blacksmith

Blacksmith

  • Replacing GitHub Actions runners with faster, cheaper infrastructurenot authentik
  • Accelerating CI build times for organizations with heavy CI loadnot authentik
  • Reducing cloud spend on GitHub Actions by 60% or morenot authentik
  • Supporting ARM architecture builds without GitHub runnersnot authentik

Where each one falls short

Documented limitations, not opinions. Every one is a constraint you would hit in normal use.

authentik

  • Smaller project than Keycloak, with a correspondingly smaller community and fewer integration guides
  • The flow model is flexible but conceptually unfamiliar, and simple setups can feel over-abstracted
  • Enterprise support and some governance features sit behind the paid tier
  • Self-hosted identity is still yours to secure, patch and keep available

Blacksmith

  • Per-minute pricing model requires estimating usage to predict costs
  • macOS M4 pricing ($0.08/min) is significantly higher than GitHub Actions
  • Docker layer caching and sticky disks are paid add-ons at $0.50/GB/mo
  • Static IP add-on costs $100/IP/mo

Pricing, plan by plan

authentik

Free
  • Open sourceFree
    • Full identity provider
    • All protocols
    • Community support

Blacksmith

Free
  • Ubuntu x64$0.004/minute
    • 3,000 free minutes per month
    • 2x faster hardware
    • 4x faster cache downloads
  • Ubuntu ARM$0.0025/minute
    • 3,000 free minutes per month
    • 2x faster hardware
    • 4x faster cache downloads
  • Windows x64$0.008/minute
    • 3,000 free minutes per month
    • 2x faster hardware
    • 4x faster cache downloads
  • macOS M4$0.08/minute
    • 3,000 free minutes per month
    • 2x faster hardware
    • 4x faster cache downloads

Which should you pick?

Choose authentik if

  • You need configurable flows.
  • You want to start without paying.
  • You work on Docker, Kubernetes, Linux, Self-hosted.
  • You also want protocol support.
authentik review

Choose Blacksmith if

  • You need bare metal runners.
  • You want to start without paying.
  • You work on GitHub Actions, Linux, Windows, macOS.
  • You also want multiple os support.
Blacksmith review

Questions people ask

Is authentik or Blacksmith better?
Neither clearly leads. authentik starts at Free and Blacksmith at Free, and user ratings are close enough to be indistinguishable. Choose on capability and platform support.
Which is cheaper, authentik or Blacksmith?
authentik starts at Free and Blacksmith at Free.
Does authentik or Blacksmith run on more platforms?
authentik runs on Docker, Kubernetes, Linux, Self-hosted. Blacksmith runs on GitHub Actions, Linux, Windows, macOS.
Can I use authentik for free?
Both have a free tier, so you can try either at no cost before committing.
What is authentik best used for?
authentik is most often used for self-hosted sso across internal services without commercial identity pricing, putting authentication in front of applications that have none, via the proxy, teams who tried keycloak and wanted something less heavy. Of those, self-hosted sso across internal services without commercial identity pricing and putting authentication in front of applications that have none, via the proxy are not what Blacksmith is typically brought in for.
What can authentik do that Blacksmith cannot?
authentik covers Configurable flows, Protocol support, Application proxy, Modern admin interface. Blacksmith covers Bare metal runners, Multiple OS support, ARM support, Docker layer caching.

Answered from the vendors’ own pages

authentik: Is authentik free?

The open-source edition is free and complete for most use. An enterprise tier adds support and additional features.

Blacksmith: How much do Blacksmith runners cost compared to GitHub Actions?

Blacksmith offers 60-75% cost savings depending on OS. Ubuntu x64 costs $0.004/min vs GitHub at $0.012/min. All plans include 3,000 free minutes monthly.

Source
authentik: authentik or Keycloak?

authentik is generally reported as easier to run and administer; Keycloak is more established with a larger community and Red Hat behind it.

Blacksmith: Can I use Docker layer caching with Blacksmith?

Yes, Docker layer caching is available as an add-on at $0.50/GB/mo. Managed Docker layer persistence is included with the base service.

Source
authentik: Can authentik protect apps with no login of their own?

Yes. Its application proxy places authentication in front of services that have no built-in authentication.

Blacksmith: What is the SLA for Enterprise plans?

Enterprise Blacksmith plans include a 99.9% SLA guarantee along with 24/7 priority support, dedicated Slack channels, white-glove onboarding, and CI optimization support.

Source
Share

Related pages

More on authentik

More on Blacksmith

Keep looking

Other head to heads