Skip to Content
Faable Authvs Authelia

Faable Auth vs Authelia

Short answer: they solve different problems. Authelia  is a self-hosted single sign-on portal that sits next to a reverse proxy and puts a login gate in front of services that have no authentication of their own — the classic homelab and internal-tooling use case. Faable Auth is a managed, multi-tenant OAuth 2.0 / OpenID Connect identity server that your own application integrates with, so your users sign up and log in to your product.

If you’re protecting Grafana, Sonarr or an internal dashboard behind Traefik, Authelia is likely the better tool. If you’re shipping a SaaS with its own user base, Authelia isn’t designed for that.

Authelia details checked against authelia.com and its roadmap in September 2026 (v4.39). Its OpenID Connect provider is still labelled open beta, and several items below are on its roadmap for v4.40.

At a glance

CapabilityFaable AuthAuthelia
DeploymentFully managedSelf-hosted: a small Go binary, plus a database and Redis for HA
Primary jobIdentity for apps you buildGate in front of apps you deploy
Forward auth for a reverse proxy❌✅ Traefik, nginx, Caddy, HAProxy, Envoy — its core feature
Per-route access rules❌ (authorization lives in your API’s tokens)✅ by domain, path, method, user, group and network
OAuth 2.0 / OIDC provider✅✅ OpenID Certified™, open beta
Client credentials, device code✅✅
Token exchange✅❌
Dynamic client registration✅❌ (roadmap)
RP-initiated / front-channel logout✅❌ (roadmap)
User storeManaged, with a user APILDAP, or a YAML file you edit
Self-service signup✅❌ users are provisioned by an admin
Social login (Google, GitHub, Microsoft)✅❌ (in planning)
Passwordless by email✅ magic link or code (Hobby and up)❌
Passkeys as the sign-in method✅ (Pro)✅ counts as a single factor
MFAAuthenticator app, security keys, passkeysTOTP, WebAuthn/passkeys, Duo push
SAML✅ SAML 2.0 identity provider for your apps (Pro)❌ (in planning)
Multi-tenant by design✅❌ one instance, one directory
Extensibility in the login flow✅ Actions + WebhooksConfiguration-driven rules
Hosted login pages✅ managed and branded✅ the portal you host
Admin CLI for users✅ faable auth❌ edit the YAML file or LDAP
CostFree up to 15,000 MAU, no credit card; no per-user charge afterFree & open source (Apache 2.0) — you pay in infra and ops
Where identities liveFaable, in EuropeWherever you host it

Login pages

Both products give you a hosted login you don’t write — the difference is who hosts it and who it is for.

Authelia’s portal covers password login (with a passkey button when enabled), the second-factor screen with a method picker, password reset by email, device registration, the OIDC consent screen, and a user settings page where people manage their 2FA devices. Branding is limited to a logo, a favicon, a theme (light, dark, grey, OLED or automatic) and translation overrides — it ships in more than 70 languages. A different layout or palette means forking its React frontend.

Faable Auth’s hosted login adds what a product with its own users needs: sign-up, social buttons, an emailed code or link, a passkey offer right after login, device activation for a CLI, and per-client differences in which methods appear and in what order. Your logo heads every screen; the language is English or Spanish. On Pro it runs on your own domain, with the certificate handled for you.

CLI and administration

The authelia binary is a toolbox for operators: validate the configuration, generate password hashes and keys, run storage migrations, rotate the encryption key, and import or export users’ TOTP and WebAuthn devices. It has no command to create or delete a user or set a password — users live in LDAP or in the YAML file, which you edit (authelia crypto hash generate gives you the hash to paste in). An admin panel and user management are on Authelia’s roadmap, not yet started.

faable auth manages the users themselves:

faable auth users list --suspended
faable auth users get user_abc123              # identities, last login and IP
faable auth users suspend user_abc123 -r "left the company"
faable auth logs list --user user_abc123 --since 2026-09-01

When Faable Auth is the better fit

  • You’re building a product with its own users. Sign-up, email verification, password reset, social login and a user API come with it; Authelia expects users to already exist in LDAP or a config file.
  • You’re multi-tenant. Each Faable account is an isolated tenant with its own clients, users and signing keys. Authelia is one instance, one directory.
  • You don’t want to run identity infrastructure. No container, no Redis, no session store, no upgrade window, no database to back up.
  • An app only accepts SAML. Your tenant is its SAML 2.0 identity provider; Authelia has no SAML.
  • Other apps need a full OIDC provider — dynamic registration for MCP clients, token exchange for keyless CI, logout across applications.
  • You need European hosting without operating the servers yourself.

When Authelia might fit better

  • You’re protecting self-hosted services behind a reverse proxy. Forward auth with Traefik, nginx or Caddy is exactly what Authelia is for, and Faable Auth does not do it.
  • You want per-route access rules or Duo push. Authelia has both; Faable Auth is an identity provider, not a reverse-proxy gate.
  • Everything must stay on your own hardware, with no third party involved at any point.
  • Your user directory is already LDAP and you want to keep it as the source of truth.

Can they coexist?

Yes, and it’s a reasonable setup: Authelia in front of your internal infrastructure, Faable Auth for the product your customers log into. They don’t compete for the same requests.

Last updated on

vs Supabase AuthNext.js: Face ID & Passkeys