Skip to main content

Release 2026.8

We’re publishing these release notes as a preview of what's to come. To try a release candidate, find the latest RC version on GitHub releases, then update your Docker image tag accordingly.

Read more about beta testing

Highlights​

  • Privileged access management (PAM): Enterprise Users can request access to applications or specific application entitlements. Designated approvers can approve or deny requests and set when access expires.
  • User switching: Users can keep multiple accounts signed in within the same browser and switch between them from the User interface.
  • User offboarding: Enterprise Schedule users for deactivation or deletion, with optional session and token revocation.
  • Object attributes: Define custom fields for users, groups, application entitlements, and other objects, with validation built into the Admin interface and API.
  • Self-hosted event maps: Enterprise Use the new bundled event map without external requests, or configure a self-hosted map for each brand.
  • OAuth 2.0 and OpenID Connect improvements: Exchange tokens between trusted providers and use key-bound ID tokens for stronger protection against token theft.

Breaking changes​

hash_password management command security improvements​

The hash_password management command no longer accepts a password as a positional command-line argument. Run the command without arguments to enter the password at a hidden interactive prompt:

docker compose run --rm server hash_password

For automation, pipe the password through standard input:

echo "$PASSWORD" | docker compose run --rm server hash_password

"Prevent duplicate device" in WebAuthn setup stage removed​

The Prevent duplicate devices option of the WebAuthn authenticator setup stage has been removed. It compared attestation certificates, which manufacturers deliberately share across entire production batches, so it rejected legitimate enrollments of a second security key bought at the same time as the first. The option was disabled by default in 2026.5.4 and is now gone; no configuration is required to replace it, and no action is needed when upgrading.

New features and improvements​

Privileged access management (PAM) Enterprise​

Users can now request access to applications and application entitlements from the User interface. They can browse the resources that they are eligible to request and track whether each request is pending, approved, denied, or revoked. Approved access expires automatically after the configured duration.

Administrators define request rules that control who can request and approve access. Rules support approval by individual users, groups, or policies, minimum reviewer counts, request and grant expiration limits, reviewer notifications, and custom flows that collect request details. Reviewers can approve or deny pending requests and revoke active grants. Each action is recorded in the event log.

For more details, refer to the privileged access management documentation.

User switching​

Users can now keep multiple authentik accounts signed in within the same browser and switch between them from the account menu in the User interface. They can also add another account without signing out of their current accounts.

Administrators enable the feature by selecting a User switch flow for the brand. Because this is a normal authentik flow, policies can control whether a switch requires a password, MFA, or a shorter verification process. Successful switches are recorded in the event log. For configuration details, refer to the user switching documentation.

Scheduled user offboarding Enterprise​

Administrators can schedule a user for deactivation or deletion at a specific date and time, with the option to revoke the user's sessions and tokens.

Scheduled offboardings can be reviewed or canceled before they run. authentik retries failed actions and records the result in the event log, providing a clear history of who scheduled the offboarding and which actions were selected. For more details, refer to the user offboarding documentation.

Object attributes​

Administrators can now define custom text, number, and Boolean fields under Directory > Object attributes. Fields can be required, unique, or validated against a regular expression.

These fields appear when editing users, groups, application entitlements, and device access groups, and the same validation applies when objects are managed through the API.

authentik also includes definitions for common identity, contact, address, Unix, and employee attributes. These definitions are disabled by default and can be enabled as needed.

Self-hosted event maps Enterprise​

The events map now uses a basemap bundled with authentik and does not make external requests by default, making it suitable for air-gapped and restricted-network deployments. Nearby events are grouped together, with columns showing the event volume and the types of events recorded in each area.

Users can select an area to filter the event list, and each brand can use the bundled map or configure a self-hosted map under Map tiles. For more details, refer to the events documentation.

OAuth 2.0 and OpenID Connect​

OpenID Certification​

As of 2026.8, authentik is officially OpenID Certified™ by the OpenID Foundation — for both OpenID Provider profiles (Basic, Implicit, Hybrid, Config, and Form Post OP) and logout profiles (RP-Initiated, Front-Channel, and Back-Channel).

Token exchange​

OAuth 2.0 token exchange allows applications to exchange a token from a trusted provider or source for an authentik access token representing the same user. This makes it easier for connected services to act on a user's behalf without sharing the original token between services.

Token exchange is disabled by default and can be enabled under the provider's Grant Types setting. Trusted providers and sources are configured using the existing JWT federation settings.

OpenID key binding​

OpenID Connect providers can now issue key-bound ID tokens. These tokens require the client to prove that it holds the associated key, providing stronger protection if a token is stolen. Key binding is available for authorization code, device code, and refresh flows.

Nested LDAP group synchronization​

LDAP sources can now preserve the source directory's nested group hierarchy in authentik. Enable Sync Group Parents to create parent relationships between synchronized groups. For configuration details, refer to the LDAP source documentation.

Expiring policy bindings​

Policy, group, and user bindings can now have an expiration date and time. An expired binding no longer grants access or contributes a successful policy result, which makes temporary application, flow, and stage access possible without requiring an administrator to remove the binding later.

Base URL system setting​

authentik now has a Base URL system setting that records the external URL where the instance is available. It can be configured under System > Settings, through the API, or with AUTHENTIK_WEB__BASE_URL during installation.

Enter only the scheme and host, even if authentik is served under a subpath. This setting will become required starting with authentik 2026.11, so we recommend configuring it now.

PostgreSQL connection-pooler support​

authentik now supports using a transaction-mode PostgreSQL connection pooler alongside a separate direct database connection for operations that require a stable session. Existing PostgreSQL settings continue to handle normal traffic, while the new direct settings can point to a direct or session-pooled endpoint. For configuration details, refer to Session-scoped operations and transaction-mode poolers.

Server and proxy outpost rewrite in Rust​

As part of our ongoing project to improve the performance and resource consumption of authentik, the authentik server (only the entrypoint for requests, the core remains Django) and proxy outpost, previously written in Golang, have been rewritten in Rust. We aimed this rewrite to be a 1-to-1 match with the previous code.

This currently does not bring any improvements, but is a stepping stone for us to couple the Django core and the proxying Rust closer together, to avoid wasting resources. Stay tuned for more in following releases!

Small general improvements​

  • Application Dashboard: Users can switch between the existing card grid and a new compact list view. The selected view is remembered in the browser.
  • AKQL: Queries against JSON fields now match numeric and Boolean values in addition to strings.
  • CAPTCHA providers: The Captcha stage now supports JSON verification requests and the self-hostable Cap CAPTCHA provider.
  • GitLab SCIM: SCIM providers now include a compatibility mode for GitLab.
  • OAuth and OpenID Connect: Providers can sign with Ed448 keys, OAuth sources can store longer authorization URLs, and Twitter sources can retrieve a user's email address.
  • SAML providers: Authentication requests that set ForceAuthn now require fresh authentication.
  • WS-Federation: Enterprise Providers can issue SAML 1.1 assertions, enabling WS-Federation integration with [Microsoft 365 and Entra ID]](https://integrations.goauthentik.io/platforms/microsoft-ws-federation/).
  • User event history: Account changes made by administrators now appear in the affected user's event history.
  • Password hash imports: Bootstrap and API password hash imports now reject malformed values before they are stored.
  • Enterprise licensing: Enterprise The license status card now shows when a license expires today or the number of days remaining.
  • Performance: Group lists use fewer database queries, and S3-backed file storage reuses clients instead of creating them for each operation.
  • Authenticators: Deleting an authenticator stage no longer deletes enrolled devices that reference it.
  • Runtime health checks: Server and worker health checks now run through the Rust entrypoint.
  • Upgrades: The lifecycle tooling now prevents unsupported major-version skips before migrations begin.

New integration guides​

An integration is how authentik connects to third-party applications, directories, and other identity providers. The following integration guides were recently added. A big thanks to our contributors!

New source guides​

The following source guides were recently added. A big thanks to our contributors!

Upgrading​

This release does not introduce any new requirements. You can follow the upgrade instructions below; for more detailed information about upgrading authentik, refer to our Upgrade documentation.

warning

When you upgrade, be aware that the version of the authentik instance and of any outposts must be the same. We recommend that you always upgrade any outposts at the same time you upgrade your authentik instance.

Docker Compose​

To upgrade, download the new docker-compose file and update the Docker stack with the new version, using these commands:

wget -O docker-compose.yml https://goauthentik.io/version/xxxx.x/lifecycle/container/compose.yml
docker compose up -d

The -O flag retains the downloaded file's name, overwriting any existing local file with the same name.

Kubernetes​

Upgrade the Helm Chart to the new version, using the following commands:

helm repo update
helm upgrade authentik authentik/authentik -f values.yaml --version ^xxxx.x

Deprecations​

PostgreSQL custom connection options are deprecated​

The AUTHENTIK_POSTGRESQL__CONN_OPTIONS and its replica equivalent are deprecated and will be removed in an upcoming version. It was never properly used and may cause future breakages. If you're looking for a specific usage, open an issue to discuss alternative solutions.

Minor changes/fixes​

API Changes​