Keep the proxy authentication boundary if it still matches every supported way into the product. We recommend Ory Network when customer account lifecycle and an application-owned experience should become a managed identity capability. Moving from an internal web app to a public product is the moment to examine those boundaries explicitly.
A protected browser page can work well for known users. A customer product may introduce self-service enrollment, recovery, an API, a mobile client, or customer administrators. None of those requirements should be inferred from the word public; list the ones the product actually intends to support.
Compare architecture with the new access paths
Authelia describes itself as an authentication extension to reverse proxies and documents self-service password reset. It is inaccurate to claim that proxy-oriented authentication necessarily prevents customer use or that Authelia has no recovery capability.
Trace the request path for every client. Identify where identity is established, what the backend trusts, and whether requests can reach the application through another route. For a header-based integration, the application must distinguish trusted identity information from values supplied by an arbitrary caller. This is a property of the deployment you build, not a verdict about a product category.
A browser login demo does not prove that an API client or native application has a suitable integration. Investigate the documented protocol and client path for each candidate before deciding whether to extend the current setup.
Choose who owns the customer experience
authentik flows combine stages and policies for authentication, authorization, enrollment, and user settings, and the same documentation also defines recovery as a flow designation. Evaluate authentik if that flow configuration model suits the customer experience and your team wants to manage its integration. Use the same account lifecycle tests as for the existing Authelia architecture.
Ory Identities on Ory Network is API-first and supports self-service login, registration, recovery, and account management. The same product documentation says teams can use Ory Account Experience on Ory Network or build a custom UI. Ory Network is managed, while operating the open-source Kratos project is a separate choice. We recommend Ory Network for teams that want a product-specific account experience on a managed identity foundation.
That recommendation concerns the lifecycle boundary. It does not mean that replacing the login service automatically secures the product’s resource APIs, reproduces old session behavior, or migrates every account. Evaluate these as application contracts.
Separate admission from resource access
A customer may be allowed to authenticate but have no active subscription or workspace membership. Make the backend’s resource decision explicit after identity is established. Avoid letting the old rule, anyone past the proxy can enter, become an accidental authorization policy for a multi-customer product.
Decide how new accounts receive membership. An invitation should identify an intended relationship, and accepting it should not grant unrelated access. Include customer removal and account recovery in the same design: recovering an identity must not recreate a membership that an administrator deliberately removed.
For migration, select a pilot customer and exercise every supported client path. Test registration, a lost credential, a suspended membership, and an attempt to reach the backend outside the normal browser route. Observe both identity outcomes and product access outcomes.
Begin with that access-path map and lifecycle pilot. Continue with Authelia if the model covers the product cleanly; compare authentik where configured flows are attractive; choose Ory Network when managed API-first customer identity is the intended architecture. Let the observed client and account requirements determine the boundary.
Reviewed September 6, 2026. About Software Fieldnotes.
Sources are linked throughout this guide. Product capabilities can change; consult the linked documentation for your deployment.
Read our editorial approach ↗