If you've ever logged into Portainer, Gitea, Proxmox, and Jellyfin with four different passwords, you already know why SSO matters. The real question in 2026 is whether to deploy Authentik or Keycloak on your Proxmox LXC — and the answer depends less on features than on how much RAM you're willing to dedicate and how much config XML you enjoy reading.

Both are open-source identity providers that speak OIDC, OAuth 2.0, and SAML. Both can front-end every service in your stack. But they make different trade-offs, and those trade-offs matter a lot when your "server" is a repurposed mini PC or a single Proxmox node with 32 GB shared across a dozen LXCs.

What You Actually Get With Each

Authentik is a Python/Go stack built specifically for the modern self-hosting use case. It ships with a visual flow builder, a clean admin UI, and a community-scripts installer that drops it into a Proxmox LXC in about 10 minutes. Version 2026.5.3 is the current stable release, and it supports OIDC, SAML 2.0, LDAP, SCIM, and a proxy outpost that lets you put auth in front of apps that don't natively support it — like Proxmox Backup Server or a self-hosted Grafana without a paid license.

Keycloak is a Java application backed by Red Hat (now IBM), with a decade of production deployments in banks, governments, and enterprise environments. Its Quarkus runtime has improved startup time significantly, but you're still looking at 60–90 seconds to reach a healthy state after docker compose up. The admin console is powerful and genuinely comprehensive — every OAuth/OIDC/SAML feature you could need is in there, often buried three menus deep.

Resource Usage on Proxmox LXC

This is where the decision usually gets made for home lab operators.

Authentik at idle (with one outpost, a handful of integrations) sits around 400–600 MB RAM in an LXC with 2 vCPUs. You can comfortably run it on the Beelink SEi12 Pro or any mini PC with 16 GB RAM without carving out a dedicated node.

Keycloak needs a minimum of 1.5–2 GB RAM just to start. In practice, a home lab Keycloak deployment with active OIDC sessions and a few realm configurations will park itself at 2.5–3 GB. Red Hat's own docs recommend 4 GB for a single production node and 8 GB for clustered deployments. On a Minisforum MS-01 with 32 GB shared across your stack, that's a significant allocation for auth alone.

# Authentik LXC recommended specs
RAM: 2 GB (runs fine at 1 GB for light use)
vCPU: 2
Disk: 20 GB
Keycloak LXC minimum specs
RAM: 4 GB
vCPU: 2
Disk: 20 GB

Setting Up Authentik on Proxmox LXC

The fastest path to Authentik on Proxmox is the community script. From your Proxmox host shell:

bash -c "$(wget -qLO - https://github.com/community-scripts/ProxmoxVE/raw/main/ct/authentik.sh)"

This provisions an Ubuntu LXC, installs Docker, pulls the official Authentik image stack (server + worker + PostgreSQL + Redis), and starts everything. The script handles the LXC creation parameters — just accept the defaults or customize RAM/disk when prompted.

After provisioning, Authentik is reachable on port 9000 (HTTP) and 9443 (HTTPS). On first boot, navigate to http://[LXC-IP]:9000/if/flow/initial-setup/ to set your admin credentials.

Hardware I'm running this on: The CWWK N100 mini PC handles Authentik comfortably as one of ~18 LXCs on a single Proxmox node. The N100's 16 GB RAM and NVMe storage (Samsung 970 EVO Plus) keep latency low even during LDAP sync cycles.

Setting Up Keycloak on Proxmox LXC

Keycloak doesn't have an official community script, so you're deploying it manually in a Docker LXC. Create a privileged LXC with at least 4 GB RAM and Docker installed, then:

# docker-compose.yml for Keycloak
services:
  postgres:
    image: postgres:16
    environment:
      POSTGRES_DB: keycloak
      POSTGRES_USER: keycloak
      POSTGRES_PASSWORD: changeme
    volumes:
      - postgres_data:/var/lib/postgresql/data
  keycloak:
    image: quay.io/keycloak/keycloak:26.1
    command: start
    environment:
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://postgres/keycloak
      KC_DB_USERNAME: keycloak
      KC_DB_PASSWORD: changeme
      KC_HOSTNAME: auth.yourdomain.com
      KC_PROXY: edge
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: changeme
    ports:
      - "8080:8080"
    depends_on:
      - postgres
volumes:
  postgres_data:

Expect 60–90 seconds before Keycloak is responsive. In development mode (start-dev) it's faster but not suitable for production use.

OIDC Integration With Proxmox VE

Both tools can authenticate directly against Proxmox VE via OIDC — a massive quality-of-life upgrade over managing local PVE users.

With Authentik: Create an OAuth2/OIDC provider in Authentik, set the redirect URI to https://[PROXMOX-IP]:8006, then in PVE go to Datacenter → Permissions → Realms → Add → OpenID Connect. Paste the Issuer URL from Authentik's provider overview. One known gotcha: Proxmox chokes on ECDSA certificates for signing. Set your Authentik provider to use RSA signing instead, or you'll hit 401 errors during the OIDC callback.

With Keycloak: The flow is the same — create a realm, add a client for Proxmox, configure the redirect URIs, grab the OpenID endpoint from https://[KEYCLOAK-HOST]/realms/[REALM]/.well-known/openid-configuration. Keycloak's client configuration has more knobs (token lifespan, refresh token behavior, fine-grained scope mapping) that are overkill for home lab use but useful if you're securing a shared environment.

Once OIDC is wired, you can map Authentik groups to Proxmox roles:

# In Proxmox after OIDC realm is active:
pveum group add authentik-admins
pveum aclmod / -group authentik-admins -role Administrator

The Proxy Outpost: Authentik's Hidden Power Feature

Authentik ships with an outpost — a lightweight Go binary or Docker container — that acts as a forward auth proxy. This lets you put SSO in front of apps that have zero native OIDC support.

For example, Proxmox Backup Server's web UI or a self-hosted Nginx Proxy Manager dashboard can be gated behind Authentik authentication without touching the application itself. You configure your reverse proxy (Traefik or Nginx) to forward auth headers to the Authentik outpost.

Keycloak can do something similar through its Gatekeeper proxy (now maintained by Louketo) or third-party adapters, but it's significantly more configuration work and the tooling is less mature.

When to Pick Keycloak Anyway

Keycloak wins in these specific scenarios:

Enterprise protocol coverage. If you need SAML 2.0 with complex attribute mapping, WS-Federation, or Kerberos authentication for Windows domain integration, Keycloak has deeper support. Authentik handles SAML but Keycloak's SAML implementation is more battle-tested.

Red Hat ecosystem. If your stack includes RHEL, OpenShift, or any IBM enterprise tooling, Keycloak (via Red Hat SSO) is the natural fit with vendor support paths available.

Compliance requirements. For a home lab running actual business workloads or client environments, Keycloak's decade of enterprise production use and SOC2-adjacent documentation is worth the RAM overhead.

Multi-organization tenancy. Keycloak's realm model handles multiple isolated tenants cleanly. Authentik can do multi-tenant setups but it's more of a workaround than a first-class feature.

Hardware That Makes Either Option Comfortable

Whichever IdP you pick, having enough RAM eliminates most of the pain. These mini PCs handle both Authentik and a reasonable LXC stack without breaking a sweat:

Verdict: Which One for Your Home Lab?

For most Proxmox home labs in 2026, Authentik is the right call. Faster to deploy, lighter on RAM, a better UI, and the proxy outpost feature alone is worth the choice. The community-scripts installer means you can have a working SSO stack in under 15 minutes.

Pick Keycloak if you're running the lab as a production environment with compliance needs, you're integrating with a Windows domain, or you want the Red Hat support path. The extra RAM and setup time is a real cost, but the protocol depth is genuinely superior for complex enterprise scenarios.

Either way, get SSO deployed. Four separate login screens in your own lab is a problem you don't have to live with.

---

Disclosure: This post contains affiliate links. If you purchase through these links, I may earn a small commission at no extra cost to you.