Learn Authentik - Branding & Theming

#Introduction

In episode 19, you closed attack gaps with reputation and threat detection. Now it's time to stop looking like a stock installation. Authentik is a UI-first IdP, and that applies to the customization side too. Episode 20 covers branding and theming — changing the login page, theme, and messages so they feel like your organization's, not Authentik's.

Think of it like moving into a new office: the electrical and internet connections are the same for everyone, but it's the decor, logo, and wall colors that make the room feel like your company's.

#Tenants and Brand Objects

Two core concepts to understand:

A tenant is an isolated configuration scope within a single Authentik installation.
A brand is the representation of the appearance and behavior per tenant, bound to one or more domain names.

Because the binding is per domain, a single Authentik installation can serve several different brands — for example auth.example.com for employees and id.example.com for customers — each with its own appearance.

Brand settings are managed from the Admin Interface → Brands menu, and the objects can also be accessed via the API at /api/v3/brands/brands/. Several things you can change:

Logo and favicon — upload your own assets; both are stored in the same media storage as the installation.
Brand name (branding_title) — the identity text displayed on the login page.
Default flows per brand — choose different authentication, enrollment, and recovery flows for each brand.
Theme — the dark, light, or follow-device-preference option.

A consistent logo on the login page leaves users in no doubt that they're on the right page — a small but important part of phishing defense.

#Themes and Dark Mode

Authentik supports light and dark themes, configured at the brand level as well as user preference. You can force a single theme so the whole flow stays consistent. For deeper visual customization, focus on brand assets and flow design; Authentik doesn't provide free CSS fields in the UI, so the supported approach is choosing assets and stage arrangements carefully.

#Welcome Screen via Custom Flow Stage

Authentik has no dedicated "welcome" stage — that kind of screen is the result of flow design. You can assemble it from the stages already covered in episode 4:

Add a consent stage with a title and welcome text at the start of the authentication flow, or in the enrollment flow after an account is created.
Use a prompt stage to collect additional data while also conveying brand messages.
Arrange the stage order in the flow designer until the flow feels like a welcome, not just an entry gate.

The principle: in Authentik, a "custom page" is a combination of stages within a flow, not a separate HTML file.

#Blueprints for Branding

Because a brand is an ordinary configuration object, it can be created declaratively through a blueprint (covered thoroughly in episode 21). A simple example:

blueprint-brand.yaml

version: 1
entries:
  - model: authentik_brands.brand
    identifiers:
      domain: auth.example.com
    attrs:
      default: true
      branding_title: Perusahaan Kalian
      branding_logo: /static/logo-perusahaan.png
      branding_favicon: /static/favicon.ico
      flow_authentication: !find authentik_flows.flow
        where:
          - slug: default-authentication-flow

#Locale and Language

The Authentik interface is available in many languages and can be set per brand via default_locale. Each user can also choose their own language preference. Consistent language across the login flow reduces misunderstanding and speeds up authentication completion — small, but noticeable.

#Custom Footer Text

Brands support a list of links on the login page footer via footer_links. By storing a JSON value on the brand:

footer_links on the brand

[
  { "name": "Dokumentasi", "href": "https://docs.goauthentik.io" },
  { "name": "Dukungan", "href": "https://support.example.com" }
]

Each item is rendered as a link in the footer. Make sure the URLs are trusted so they don't direct users somewhere they shouldn't go.

Tip

Create separate brands for staging and production environments, or for different user groups. Because brands are bound to domains, you can test a new look on a staging subdomain without disturbing production.

#Closing

Summary of episode 20:

A brand is bound to a domain and holds the logo, theme, default flows, locale, and footer.
A "custom page" is a composition of stages in a flow, not an HTML file.
Branding can be written as a declarative blueprint.
default_locale and footer_links round out the local experience.

In episode 21, we automate everything: API and automation for creating users, flows, and properties programmatically, plus blueprints and SDKs. See you there!