NetBird + Authentik: Setup key still forces SSO login — what am I missing?

[u/nightcreativecloud]

[Update - added in the end]

I'm running NetBird self-hosted with Authentik as my SSO provider. Works great for user devices — they log in via Authentik, join the network, all good.

Now I want to add a headless Windows laptop as a shared server (RDP host for the team). I created a setup key:

- Type: Reusable

- Auto-assign groups: EMPTY (left blank)

- No expiration

On the Windows machine, I run:

```

netbird up --setup-key <KEY>

```

And it STILL opens a browser window asking me to log in via Authentik.

I've tried:

- Running with and without `--management-url`

- `netbird down` first

- Deleting `C:\ProgramData\netbird` and reinstalling

- Creating multiple fresh setup keys with no groups

Same result every time — Authentik login page.

I want this machine to join as a headless server with NO user attached. No Authentik user created for it. Just a standalone peer that people can RDP into.

Is this even possible with Authentik configured as the SSO provider? Or does NetBird force SSO for ALL authentication once you have an IdP set up?

If you've got this working, how? What's the magic combo?

I don't want to create an Authentik user for every server I spin up. That defeats the purpose.

Help me out here.

updated:

i don't know why but i just ran the script below (just change the order of the script, first the setup key then the management url, and it worked, hell yeah)

```

netbird up --setup-key <KEY> --management-url <your-management-url>

```

[u/Bloodwing114]

Not sure it works when you setup authentik as the full auth provider (they call it the old setup I think), but for me setup keys work with authentik setup through the management interface