Single sign-on with authentik

One account for store, game panel and wiki: with single sign-on (SSO) your customers log in once and are signed in everywhere. This guide shows how to connect Paymenter and Pterodactyl to the open-source identity provider authentik – and why it is worth it for security, too.

Why single sign-on?

• Fewer passwords: customers need one account instead of three.
• More security: two-factor sign-in, password rules and lockouts are managed centrally in authentik.
• Less support: password resets and account issues are handled in one place.
• Clean offboarding: disable one account and access to every service is gone.

How it works

authentik is the identity provider: it checks who is signing in. Paymenter, Pterodactyl and other services are clients that trust the sign-in via the OpenID Connect (OIDC) standard. Paymenter itself only ships a few social logins – for your own OIDC provider such as authentik you need an extension.

Step 1: prepare authentik

1. In authentik, go to Applications → Providers and create an OAuth2/OpenID Provider.
2. Choose client type Confidential and enter the redirect URI shown by the Paymenter extension.
3. Use the scopes openid, email and profile.
4. Under Applications, create an application and assign the provider.
5. Note the client ID, client secret and the OpenID configuration URL (issuer).

Step 2: connect Paymenter

1. Install and enable the AuthentikSSO extension.
2. Enter the issuer or discovery URL, client ID and client secret.
3. Decide whether new customers are created automatically and whether the login button is shown alongside or instead of the password form.
4. Sign in with a test account and check that email and name are taken over correctly.

Tip: enable single logout so that signing out of Paymenter also ends the authentik session.

Step 3: add Pterodactyl

Pterodactyl has no built-in OIDC login. There are two common approaches:

• Create accounts automatically: AuthentikSSO can optionally create or link a matching Pterodactyl or Pelican account when a customer signs in to Paymenter. You add a panel API key and check the connection with the built-in test.
• SSO in the panel itself: with a panel extension, users also sign in to Pterodactyl directly through authentik. We will cover suitable panel extensions here once they are ready for production.

Common pitfalls

• Wrong redirect URI: it must match exactly, including https:// and the full path.
• Missing email: without the email scope, Paymenter cannot match an account.
• Clock drift: if server clocks differ, tokens are rejected – enable NTP.
• Existing accounts: customers with the same email are linked; make sure email addresses are verified in authentik first.

Conclusion

With authentik as a central login, your offer becomes simpler for customers and safer for you. If you would rather not run authentik yourself, we can do it for you with managed self-hosting.

Related

• Install Paymenter
• Our software for Paymenter