Skip to main content

User interface

End-users who are accessing their applications via authentik typically only access the User interface, not the Admin interface. (There are exceptions; some end-users have permissions to also access the Admin interface, while some end-users never go to the User interface, but rather log directly into their application using authentik behind the scenes.)

Conversely, administrators for an authentik instance work primarily in the Admin interface; that is where administrators add applications, create new users and groups, manage system settings, and more.

info

This document covers the basic tasks that end-users accomplish in the User interface. All of our technical documentation is available to all users, just note that the vast majority of it is for the Admin interface because the User interface is for simple end-user tasks.

Access the User interface​

As an end-user, you will typically first see the User interface when you log in to authentik. The main page of the User interface is the Application Dashboard page, where you can find all of the applications that you access through authentik.

To view your own settings click the gear icon in the upper right. The following sections are displayed on the page:

User details​

This section of the User interface displays (and allows you to edit if you have the requisite permissions) the fields below. Note that these are the options available in a default authentik instance; administrators can customize which options show up here.

  • Username: the username is the unique identifier associated with the user, and is required for logging in. This value can only be edited by the user if the global System settings are configured to allow all users to change their username, or if the attribute goauthentik.io/user/can-change-username has been added to the Attributes field for a specific user (overriding the global System setting).
  • Name: a display name, or nickname, for the user. Similar to the username, this value can be set globally in System settings, or per user with the attribute goauthentik.io/user/can-change-name.
  • Email: the email address for the user. This value also can be set globally in System settings, or if the attribute goauthentik.io/user/can-change-email has been added to the Attributes field for a specific user (overriding the global System setting).
  • Locale: override any global locale settings and either choose a specific language or select Auto-detect, which relies on the user's browser local settings.
  • Change your password: if a user has the permission to update their password, they can do so here.

Sessions​

This tab shows all active sessions for the user. Here you can delete sessions, including the current one (which would result in an automatic log out) or a session on a remote device.

You can view applications to which you gave consent to allow authentik to share your profile user data with the application.

When an administrator adds this stage to an authorization flow, the user logging in is presented with a pop-up confirmation page asking if they agree to allow the application to directly request their account data (typically profile and email address) from the source. The user clicks Continue to give consent.

For more information refer to our documentation on the Consent stage.

Credentials​

The Credentials tab is where you can add and configure a new MFA device for accessing authentik, create access tokens and App passwords.

MFA Devices​

This is where users can add and configure MFA devices for accessing authentik. The three default options for MFA are:

  • Static tokens: authentik generates 6 single-use tokens.
  • TOTP Device: using your preferred authenticator, scan the QR code, enter the code from the authenticator into the authentik prompt, and then click Continue. For authenticators that do not support QR scanning, you can copy the secret and paste it into your authenticator.
  • WebAuthn device: this option uses the WebAuthn/FIDO2/Passkeys Authenticator setup stage to allow the user to create a passkey for the device.

An authentik administrator can add additional MFA options for users, such as Email, SMS, or Duo, by adding the stage for that authentication method to the flow.

LDAP providers and MFA

Because LDAP does not natively support OTP, authentik supports appending the OTP code to the password for situations where the protocol is LDAP and they are required to use MFA. If enabled, the user can enter the authenticator's code as part of the bind/authentication password, separated by a semicolon. For example, for the password example-password and the MFA code 123456, the input in the password field must be example-password;123456.

Tokens and app passwords​

  • Tokens: API tokens authenticate requests to the authentik API at /api/v3/. Send them in an Authorization: Bearer <api_token> header. They do not grant access to an application's API behind authentik.
  • App passwords: generated passwords that you use with your authentik username in supported authentication methods, such as LDAP binds, proxy HTTP Basic authentication, and OAuth2 machine-to-machine authentication. An app password is not an API token or an OAuth2 access token.

To create an app password:

  1. Open your user settings and select Credentials.
  2. Under Tokens and App passwords, click New App Password.
  3. Enter a unique Identifier, optionally add a Description, and set Expires on.
  4. Click Create App Password.
  5. Use the copy button beside the new entry to copy the generated password. The Identifier is a label, not the password or your username.

Administrators can also create app passwords for users under Directory > Tokens and App passwords by selecting the user and setting Intent to App password. For automation, see Service accounts.

Choose the authentication method that your application uses:

  • LDAP: use the app password as the bind password for your user's DN. The password stage in the provider's Bind Flow must enable User database + app passwords. See Bind with an app password.
  • Proxy or forward auth: send your authentik username and app password using HTTP Basic authentication. See the proxy request example. Sending the app password directly as Authorization: Bearer <app_password> does not work.
  • OAuth2/OIDC: exchange your username and app password for an access token using machine-to-machine authentication, then send the returned access token to the application as a Bearer token.

App passwords authenticate as their owner and do not grant additional application access or permissions. They can be accepted wherever app-password authentication is enabled; the Identifier does not restrict a password to one application. To revoke an app password, delete its entry. To rotate it, create a replacement, update the client, and delete the old entry.

Connected services​

If an authentik administrator adds a source to the instance, such as GitHub, Discord, Google Workspace or Microsoft Entra ID, then users will see a list of those sources here and can choose to log in (Connect) using credentials from that source, or Disconnect form the service. Note that SCIM and LDAP sources are not displayed.