AI
From Side Project to Full-Time Company
Jens Langhammer built Authentik in his evenings and weekends as a Python identity experiment. He posted it on the self-hosted subreddit in 2022. Community reactions were immediate and positive. Venture capital firms reached out. Jens gave away equity to form Authentik Security and pay himself a salary. His first employee was a longtime home lab user. In mid-2024 Authentik became the number one trending GitHub project. The community scaled from a core group of experts to a wide-ranging user base.
Meeting the Community Where They Are
The community started in GitHub issues. Users requested a Discord server, so the team created one. A subreddit formed organically and became one of the most active discussion hubs. The team runs weekly backlog meetings to triage community bugs and feature requests. A request for Telegram social login received many upvotes and was added to the roadmap. Low-quality AI bug reports require time to filter, but entitled users are rare.
Evolving the Tech Stack Without Rewriting Everything
Authentik started as a pure Django project because founder Jens was proficient in Django and could ship features quickly. LDAP synchronization became a performance bottleneck in Python. The team partially rewrote that component in Go. A Rust rewrite of the Go code, called the coop, slashes memory consumption by half. Redis caused more problems than solutions, so the team removed it. Postgres filled most needs. The architecture evolved while Django remained core.
Security Transparency Builds Trust
Building a security product in the open puts the project where attackers can see the code too. The team runs regular independent pentests and publishes the results. They maintain a standard responsible disclosure policy with four days of lead time before security announcements. CVEs are assigned. The community understands that CVEs indicate a responsible process. Transparency about security builds trust for users depending on Authentik for identity infrastructure.
Licensing, Open Core, and the Business Model
The project started GPL-licensed. When the company formed, the team relicensed to MIT. Authentik Security is a public benefit corporation with a charter mandating open source for the public. The company sells enterprise subscriptions for features in an enterprise folder within the same repo. Dependency license management requires constant attention. The open core model attracts expert community eyes on the code and helps recruiting. Home lab users who adopt Authentik at home often bring it into their companies later.
Q&A
How do you balance open source community needs with enterprise customer demands? They offer support contracts for companies while keeping the open source side fully functional, and enterprise roadmap items come from customer conversations. ▶ 24:17
What differentiates Authentik from other identity providers? Authentik is programmable with a Django API for every action and embeddable Python expression policies, making it developer-forward and automatable. ▶ 26:22
Notable Quotes
I don’t recommend building an identity provider from scratch. Fletcher Heisler · ▶ 3:12
your side project could become your full-time job Fletcher Heisler · ▶ 4:08
the best stack is the one that you already know Marcelo Elizeche Landó · ▶ 9:49
we’re not going to start taking things out of open source and charging for it or putting arbitrary usage limits Fletcher Heisler · ▶ 17:43
To keep the most permissive rights, we chose to license an MIT. Fletcher Heisler · ▶ 22:41
Key Takeaways
- Start with a familiar tech stack and evolve only when performance demands it.
- Meet users where they are: Discord, subreddit, and weekly backlog triage.
- Publish pentest results and maintain a responsible disclosure policy.
- Choose an open source license early and consider forming a PBC.
- Listen to community requests to guide your roadmap and build goodwill.