Softwr

Cybersecurity · head to head

authentik vs HashiCorp Boundary

authentik logo

authentik

Cybersecurity

Open-source identity provider with flexible authentication flows

From
Free
Rated
-
Full reviewWebsite
HashiCorp Boundary logo

HashiCorp Boundary

Cybersecurity

Identity-aware session broker for infrastructure access without distributing credentials

From
Free
Rated
-
Full reviewWebsite

The short version

  • Each has a real cost: authentik smaller project than Keycloak, with a correspondingly smaller community and fewer integration guides; HashiCorp Boundary hashiCorp was acquired by IBM in February 2025 and Enterprise licensing now runs through IBM Passport Advantage; IBM has already retired HCP Vault Secrets, so Boundary's roadmap depends on IBM portfolio decisions rather than HashiCorp's own product strategy.
  • They diverge on capability: authentik covers Configurable flows, HashiCorp Boundary covers Identity-based access.
  • Prices and features above were last checked on 31 August 2026.

Where they differ

Only the attributes on which authentik and HashiCorp Boundary actually diverge.

Attributes where authentik and HashiCorp Boundary differ
AttributeauthentikHashiCorp Boundary
Pricing modelOpen-source core with a paid enterprise tierOpen source, no licence fee
PlatformsDocker, Kubernetes, Linux, Self-hostedLinux, macOS, Windows, Web

Identical on both: starting price (Free), free tier (Yes), user rating (Not yet rated), category (Cybersecurity).

What each one covers

Drawn from each product's published feature list. An absence here means we hold no record of it - not that the product lacks it.

Only in authentik

  • Configurable flows
  • Protocol support
  • Application proxy
  • Modern admin interface

Only in HashiCorp Boundary

  • Identity-based access
  • Just-in-time credentials
  • Dynamic host catalogues
  • Session recording
  • Transparent sessions
  • Multi-hop workers
  • Audit logging
  • Terraform provider

What people use each for

The jobs each tool is most often brought in to do.

authentik

  • Self-hosted SSO across internal services without commercial identity pricingnot HashiCorp Boundary
  • Putting authentication in front of applications that have none, via the proxynot HashiCorp Boundary
  • Teams who tried Keycloak and wanted something less heavynot HashiCorp Boundary

HashiCorp Boundary

  • A platform team replacing shared SSH keys and a bastion host so that leavers lose access the moment they are removed from the identity providernot authentik
  • Granting contractors time-boxed database access without ever issuing them a credential they could keepnot authentik
  • An estate where autoscaling replaces hosts continuously and a static access list is always out of datenot authentik
  • Producing session recordings as evidence for an audit that requires proof of who touched production and what they rannot authentik

Where each one falls short

Documented limitations, not opinions. Every one is a constraint you would hit in normal use.

authentik

  • Smaller project than Keycloak, with a correspondingly smaller community and fewer integration guides
  • The flow model is flexible but conceptually unfamiliar, and simple setups can feel over-abstracted
  • Enterprise support and some governance features sit behind the paid tier
  • Self-hosted identity is still yours to secure, patch and keep available

HashiCorp Boundary

  • HashiCorp was acquired by IBM in February 2025 and Enterprise licensing now runs through IBM Passport Advantage; IBM has already retired HCP Vault Secrets, so Boundary's roadmap depends on IBM portfolio decisions rather than HashiCorp's own product strategy.
  • Enterprise pricing is not published anywhere, and the features most organisations actually need for compliance, notably session recording, are Enterprise only, so the free community edition is rarely the version you end up buying.
  • It solves access to infrastructure, not to applications; browser-based internal tools, SaaS admin consoles and APIs need a separate control, so Boundary is one component of a zero-trust programme rather than the whole thing.
  • Running it yourself means operating controllers, worker nodes and a Postgres database in a highly available configuration, and if that control plane is down nobody can reach production, which makes it a new critical dependency.
  • It is materially easier to adopt if you already run Vault and Terraform; teams without that ecosystem face a steeper learning curve than a device-based mesh product like Tailscale, for a similar access outcome.

Pricing, plan by plan

authentik

Free
  • Open sourceFree
    • Full identity provider
    • All protocols
    • Community support

HashiCorp Boundary

Free
  • Boundary Community EditionFree
    • MPL 2.0 open source
    • Self-hosted controllers and workers
    • Identity-based target access
  • Boundary Enterprise$undefined/year
    • Session recording and playback
    • Multi-hop and transparent sessions
    • Multi-tenancy via scopes

Which should you pick?

Choose authentik if

  • You need configurable flows.
  • You want to start without paying.
  • You work on Docker, Kubernetes, Linux, Self-hosted.
  • You also want protocol support.
authentik review

Choose HashiCorp Boundary if

  • You need identity-based access.
  • You want to start without paying.
  • You work on Linux, macOS, Windows, Web.
  • You also want just-in-time credentials.
HashiCorp Boundary review

Questions people ask

Is authentik or HashiCorp Boundary better?
Neither clearly leads. authentik starts at Free and HashiCorp Boundary at Free, and user ratings are close enough to be indistinguishable. Choose on capability and platform support.
Which is cheaper, authentik or HashiCorp Boundary?
authentik starts at Free and HashiCorp Boundary at Free.
Does authentik or HashiCorp Boundary run on more platforms?
authentik runs on Docker, Kubernetes, Linux, Self-hosted. HashiCorp Boundary runs on Linux, macOS, Windows, Web.
Can I use authentik for free?
Both have a free tier, so you can try either at no cost before committing.
What is authentik best used for?
authentik is most often used for self-hosted sso across internal services without commercial identity pricing, putting authentication in front of applications that have none, via the proxy, teams who tried keycloak and wanted something less heavy. Of those, self-hosted sso across internal services without commercial identity pricing and putting authentication in front of applications that have none, via the proxy are not what HashiCorp Boundary is typically brought in for.
What can authentik do that HashiCorp Boundary cannot?
authentik covers Configurable flows, Protocol support, Application proxy, Modern admin interface. HashiCorp Boundary covers Identity-based access, Just-in-time credentials, Dynamic host catalogues, Session recording.

Answered from the vendors’ own pages

authentik: Is authentik free?

The open-source edition is free and complete for most use. An enterprise tier adds support and additional features.

HashiCorp Boundary: Is Boundary open source?

The community edition is, under MPL 2.0. Boundary Enterprise is commercial and is now sold through IBM Passport Advantage.

authentik: authentik or Keycloak?

authentik is generally reported as easier to run and administer; Keycloak is more established with a larger community and Red Hat behind it.

HashiCorp Boundary: Does it replace a VPN?

For infrastructure access, largely yes. It grants a session to a specific target rather than putting the user on a network, but it does not cover browser-based internal applications.

authentik: Can authentik protect apps with no login of their own?

Yes. Its application proxy places authentication in front of services that have no built-in authentication.

HashiCorp Boundary: What does Boundary Enterprise cost?

HashiCorp does not publish Boundary pricing. It is quoted, and since the IBM acquisition it is transacted on IBM licensing paper.

HashiCorp Boundary: Do I need Vault to use it?

No, but the just-in-time credential brokering that makes Boundary worthwhile depends on Vault or an equivalent secrets store.

Share

Related pages

More on authentik

More on HashiCorp Boundary

Keep looking

Other head to heads