> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tierity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# authentik

> Sync users, authenticators, applications and failed logins from authentik, including self-hosted instances.

## Overview

Tierity connects to authentik with an API token, syncs every 6 hours, and raises findings such as superusers without MFA, terminated users who are still active and dormant accounts. It works with authentik Cloud and self-hosted instances. See [Identity providers](https://docs.tierity.com/integrations/identity.md) for everything that's synced and checked.

## Prerequisites

* An authentik superuser, or a service account allowed to view users, authenticator devices, applications and events
* Manage access (or higher) in Tierity
* If you self-host authentik, it must be reachable from Tierity

## Credentials required

| Field | Description |
| - | - |
| **authentik URL** | Your authentik address, for example `https://auth.example.com` |
| **API token** | An API token for that user |
| **Employment status attribute** | Optional. The user attribute your HR sync writes employment status to. Leave blank to detect it automatically. |

## Setup

**1. Create an API token**

In the authentik admin interface, go to **Directory → Tokens and App passwords** and create a token with the **API** intent for a superuser or service account that can view users, authenticator devices, applications and events. Copy the key.

**2. Connect in Tierity**

Go to **Config → Integrations → authentik**, enter your authentik URL and the token, and click **Test connection**. The first sync starts straight away.

## What authentik adds

* MFA strength from each user's authenticator devices, with WebAuthn as phishing-resistant and TOTP as app-based
* Superusers, treated as admins
* Applications each user can access
* Failed logins from authentik's event log

## Disconnecting

Go to **Config → Integrations → authentik** and click **Disconnect**, then delete the token in authentik.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.