How many separate logins does your family have for the apps you run at home? The movie server. The photo gallery. The recipe box. Each one with its own password, its own "forgot my login" drama.

Here's a better way: one login for everything. It's called single sign-on (SSO), and big companies use it so employees log in once and get access to dozens of tools. You can run the exact same thing at home with a tool called Authentik.

What single sign-on actually does

Think of Authentik as the bouncer at the front door of your self-hosted world. Instead of every app checking IDs separately, they all ask the bouncer: "Is this person allowed in?"

Your family logs in once. After that, every connected app trusts that login. No re-typing passwords. No syncing accounts across five tools.

And because Authentik runs on your own machine, none of those logins ever touch a company server. Google and Microsoft offer SSO too — but they see every app you sign into. Yours sees nothing it shouldn't.

Why this beats a password manager here

A password manager stores many passwords. SSO removes the need for many passwords. Different jobs.

For a family setup, SSO wins because:

  • One account to create per family member, not one per app
  • One place to revoke access — kid loses a phone, you disable their login once
  • Add MFA in one spot and it protects everything behind it

When your teenager moves out, you flip one switch. They're locked out of all of it.

The 4-step starter plan

You don't need to be an engineer. You need an evening.

  1. Run Authentik with Docker. The official docker-compose file gets you a working server in minutes. If you've ever set up a movie server, this is the same difficulty.
  2. Create your family accounts. Make one user for each person. Set a strong password and turn on a phone-based code (MFA) for the adults.
  3. Connect your first app. Pick something simple you already run. Most self-hosted apps support a standard called OIDC or OAuth — Authentik walks you through it with copy-paste fields.
  4. Test, then add the rest. Once one app works, the next ones take five minutes each. The pattern repeats.

The one mistake to avoid

Don't make Authentik your only way into your network. If it ever breaks, you could lock yourself out of everything at once.

Keep a backup admin path — a direct login on at least one critical app, or local SSH access to the server. Treat the bouncer as convenient, not as your only door.

Your takeaway

Spin up Authentik this weekend and connect just one app to it. Get a single login working for one tool before you touch the others. Once that click happens — log in once, app opens, no password prompt — you'll wonder how your family ever managed without it.