Skip to main content

Authentik Integration Guide

Authentik is an open-source identity provider. This guide connects Mixpost to Authentik for single sign-on.

1. Create an OAuth2 / OpenID provider​

  1. Sign in to the Authentik admin interface and go to Applications → Providers → Create.
  2. Choose OAuth2/OpenID Provider.
  3. Give it a name (for example Mixpost), pick an authorization flow, and set:
    • Client type: Confidential
    • Redirect URIs: the Redirect URI shown on Mixpost's Single Sign-On settings page, e.g. https://mixpost.example.com/mixpost/auth/sso/callback
    • Signing Key: select a certificate (required for signed ID tokens)
  4. Save, and copy the generated Client ID and Client Secret.

2. Create the application​

  1. Go to Applications → Applications → Create.
  2. Name it (for example Mixpost), set a slug (for example mixpost), and select the provider you just created.
  3. Save. Users need access to this application to sign in — control that through Authentik's policy bindings if needed.

3. Configure the connection in Mixpost​

In Admin Console → Settings → Single Sign-On:

  1. Identity provider: Authentik.
  2. Issuer URL: https://<authentik-host>/application/o/<slug>/ — for example https://id.example.com/application/o/mixpost/. Authentik shows this value as OpenID Configuration Issuer on the provider's overview page.
  3. Paste the Client ID and Client Secret.
  4. Enable single sign-on, Save, then click Test connection — Mixpost should list the discovered endpoints.

Your login page now shows the Sign in with Authentik button.

4. Groups for role mapping (optional)​

Authentik includes the user's group names in the groups claim through its default profile scope mapping, so role mapping usually works out of the box:

  1. On the provider, make sure the profile scope mapping (authentik default OAuth Mapping: OpenID 'profile') is selected under Advanced protocol settings → Scopes.
  2. Keep profile in Mixpost's Scopes setting (it is part of the default openid profile email).
  3. In Mixpost, add group mapping rows using the Authentik group names exactly as they appear under Directory → Groups.

5. Done​

Sign in with an Authentik user to verify the flow end to end. If something fails, the login page shows the reason, and the troubleshooting section covers the common causes.

On this page