Authentik
Connect Authentik to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Authentik to collect identity & sso evidence with automated compliance tests, switched on per workspace.
| Category | Identity & SSO |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| Authentik's guide | docs.goauthentik.io |
Connect with an API token
-
In Authentik:
- In the authentik Admin interface, go to Directory › Users, click New User and select Service Account.
- Enter a Username, set Expiring as you need, and click Next.
- Go to Directory › Tokens and App passwords and click Create.
- Enter an Identifier, select the service account in User, set Intent to API Token, set Expiring, and click Create.
- Use the copy action on the token's row to copy the token value.
- Give the service account view-only access to users, authenticator devices and validation stages: assign it a role with those global view permissions, or add it to a group that has them. The token acts with the service account's permissions.
Where to find the other values:
- Instance URL: The https address you use to open your authentik instance (the same base address as the Admin interface).
Authentik's public documentation does not cover every step.
The token value stays retrievable through the copy action for users holding the "View token's key" permission. The exact role-editor labels for selecting the individual view permissions (users, authenticator devices, validation stages) were not confirmed on the fetched page.
Source: docs.goauthentik.io, checked 2026-10-07.
The permissions Safeguard needs:
view: users, authenticator devices, validation stages. -
On Compliance › Connectors, open Authentik, click Connect, choose API token and fill in:
Field What to enter Instance URL Required. Your own server: an https address reachable from the internet. API token Required. Stored encrypted and never shown again. -
Click Connect with token.
Frameworks
Safeguard's automated tests read Authentik and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.1, CC6.2, CC6.3 | 5 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.17, A.5.18, A.6.5, A.8.2, A.8.5 | 5 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4), 164.312(d) | 5 |
| PCI DSS | Automated tests | 7.2.2, 7.2.4, 8.2.5, 8.2.6, 8.4.2 | 5 |
| NIST CSF 2.0 | Automated tests | PR.AA-01, PR.AA-03, PR.AA-05 | 5 |
These tests are switched on per workspace by the Safeguard team.
Related
- Identity & SSO connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks