Configure Authentik SSO
Create an OAuth2/OpenID Connect provider and application in Authentik, then connect the provider to Coolify with a confidential client ID and secret.
Authentik SSO will be available in Coolify v4.3.0. The latest released version is v4.1.2, so this guide documents an upcoming feature that is not available in the current release.
Replace these values while following the guide:
- Coolify callback:
https://coolify.shadowarcanist.com/auth/authentik/callback - Authentik Base URL:
https://auth.shadowarcanist.com - Application name:
Coolify
Set up Authentik SSO
Start an Authentik application
Sign in to the Authentik administration interface and open Applications > Applications.
Select Create with Provider, enter a name such as Coolify, and choose a slug. Continue with OAuth2/OpenID Connect as the provider type.
If your Authentik version creates providers separately, open Applications > Providers, create an OAuth2/OpenID Provider, then attach it to a new application.
See Authentik's OAuth2/OpenID provider documentation if the navigation or field names differ in your installed version.
Configure the OAuth2/OpenID provider
Configure the provider as a confidential authorization-code client:
| Authentik setting | Value |
|---|---|
| Client type | Confidential |
| Redirect URIs/Origins | Strict URI https://coolify.shadowarcanist.com/auth/authentik/callback |
| Scopes | Include openid, profile, and email. Coolify also requests Authentik's goauthentik.io/api scope. |
| Authorization flow | Select the flow your users should complete. |
| Signing key | Use the signing key required by your Authentik policy. |
Save the provider and application.
Use Authentik policies, groups, or application bindings to restrict who may access the Coolify application.
Save the Authentik credentials
Copy the provider Client ID and Client Secret. Store the secret securely.
The Base URL for Coolify is the Authentik instance origin, such as https://auth.shadowarcanist.com. Do not append /application/o/authorize/ or the application slug.
Configure Authentik in Coolify
Open Settings > OAuth and find Authentik.
| Coolify field | Authentik value |
|---|---|
| Client ID | Authentik provider client ID |
| Client Secret | Authentik provider client secret |
| Redirect URI | https://coolify.shadowarcanist.com/auth/authentik/callback |
| Base URL | Authentik origin, such as https://auth.shadowarcanist.com |
Select Save, then turn on Enabled for Authentik.
Verify Authentik sign-in
Open the Coolify login page in a private browser window and select Login with Authentik. Complete the assigned Authentik flow, then confirm that Coolify opens the account matching the Authentik email address.
Also test an Authentik user who is not allowed by the application policy and confirm that Authentik blocks access.