- Configuring an OpenID Provider in Authentik to generate client credentials.
- Linking the application in Immich using the Issuer URL and authentication secrets.
- Adjusting specific redirect URIs to ensure the mobile application functions correctly.
- Implementation of Auto Register and Auto Launch to automate user access.
How do I connect Authentik to Immich? If you're setting up your own photo server at home, you probably already know that Immich is a true gemBut managing users one by one can be a headache. To avoid having to type the password a thousand times or manually create accounts for the whole family, the smartest thing to do is set up a system of Single Sign-On (SSO)And this is where Authentik comes in.
The idea is simple: Authentik acts as the gatekeeper of your server, validating who you are so that you can then entering Immich without complicationsAlthough configuring OIDC (OpenID Connect) might seem like a world of technical complications, once you understand how both applications communicate, it's a piece of cake and makes deployment a breeze. professional finish and much safer.
Preparing the ground at Authentik
Before touching anything in Immich, we need to tell Authentik that there's a photo app it wants to allow its users to use. To do this, the first step is to go to the administration interface and create a OpenID type providerWhen you configure this provider, you'll see that the system automatically generates a Client ID and a Client SecretWrite this data down in a notepad because these are the master keys that we will later paste into the Immich configuration.
An important detail is the authorization flow: if you want your users to not have to accept permissions every time they log in, you can select the implicit flow to expedite the process. Regarding the redirect URIs, don't overdo it and use the exact ones specified in the Immich documentation, because if even a single character is wrong, the system will throw an error and prevent you from logging in. If you are using very old versions of Authentik (prior to 2026.5), keep in mind that All URIs are treated as Authorization typeSo don't complicate things by configuring logout URIs.
Once you have the supplier ready, the next step is to create the Application itself in the Authentik panel. You just need to give it a name (like "My Photos" or "Immich") and link it to the provider you just created. Finally, go back into the provider details and copy the Issuer URL (OpenID Configuration Issuer), which is the address Immich will use to find out how to authenticate.
Detailed configuration in Immich
Now we move on to the Immich website. You have to go to the section on Administration, then Settings and look for the OAuth Authentication section. Activate the enable box and you'll see a form appear that looks intimidating but is actually very straightforward. This is where you paste the Issuer URL, Client ID and Client Secret that you saved previously.
For a smooth experience, I recommend activating the Auto Registerwhich automatically creates the user's Immich account the first time they log in via Authentik, and the Auto Launchwhich redirects the user directly to the Authentik login without going through the Immich home screen. Note here: if you enable Auto Launch, You could be left out from your local administrator account. To log in with the original admin account, you will need to use the special URL by adding ?autoLaunch=0 at the end of the login address.
The puzzle of URIs and mobile access
This is where many people make mistakes. Immich needs several redirect URIs depending on where you're accessing it from. For the web, you'll need to add /auth/login and /user-settings along with your domain. But the most critical thing is the mobile app: you must include the URI. app.immich:///oauth-callbackIf your authentication server does not accept this custom scheme, the solution is to configure an HTTP endpoint that acts as a bridge and redirects traffic to that address, specifying it later in the Mobile Redirect URI Override option by Immich.
If you encounter a 500 error or network issues, especially in Docker or Unraid environments, the problem might be that the containers can't see each other using their public domain names. Some users have resolved this using Local IPs instead of domains or by adjusting the host network so that traffic flows correctly between the reverse proxy and the authentication services.
User and permissions management
To test that everything is working, do not use the Authentik administrator account. Go to the user directory, create new user with your own password and try logging into Immich with that account. If everything is okay, you'll be redirected to Authentik, enter your details, and bam!, you'll be in your photo gallery. Remember that you can play around with the Storage claims in the Immich configuration to assign specific disk quotas to each user based on the information that Authentik sends in the token.
Integrating these two tools allows you to centralize security and avoid password fatigue by delegating identity validation to a robust system. By correctly configuring OIDC flows and redirect routes, both on the web and in the mobile application, you create an ecosystem where access is transparent to the end user but strictly controlled by the administrator, optimizing identity management in your personal lab.
Passionate about technology since he was little. I love being up to date in the sector and, above all, communicating it. That is why I have been dedicated to communication on technology and video game websites for many years. You can find me writing about Android, Windows, MacOS, iOS, Nintendo or any other related topic that comes to mind.