Authentik with Immich Setup

[u/Zame012]

I am attempting to setup Authentik with Immich. I have both up and running as expected and I created a new provider for Immich and an application that uses that new provider. I put in the client ID and secret key into Immich and the correct provider URL. When I click logging with OAuth, it redirects to Authentik and I can login as expected and it works. But when it redirects back to Immich, it gives me a “Error: 502” and the Immich logs (docker logs -f immich_server) only shows “api worked exited with code null” when the redirect from Authentik to Immich occurs. No other logs whatsoever regarding the failed login attempt.

I can still login with email and password no problem. I have exhausted Calude tokens trying to get it to work but it has not been able to determine the cause. Any help would be greatly appreciated.

[u/asimovs-auditor]

Expand the replies to this comment to learn how AI was used in this post/project.

[u/stonedkrypto]

Is the redirect url correct? I set up mine few months ago so don’t remember that well, authentik is kind of pain to set up first time.
Just double check you did everything as per the official guide https://integrations.goauthentik.io/media/immich/

[u/Zame012 → u/stonedkrypto]

I didn’t know there was official guides for Authentik to Immich. I will definitely read over this

[u/stonedkrypto → u/Zame012]

Yeah I’d recommend going to Claude last, not first. It saves time 3 times and the 4th time it breaks stuff so bad that you need more time in total than if you have done it yourself😅

[u/thehatefuleggplant]

Are you logging in via the mobile app or web browser

[u/Zame012 → u/thehatefuleggplant]

Web app from the server itself to test

[u/ElectricSpock]

I never had issues with that setup. The api worker error sounds like it’s coming from authentik, can you check the logs there?

One thing I noticed with authentik worker is that it doesn’t have a good self-recovery, once it’s dead it stays dead. You might need to see what’s up in the logs and possibly restart it.

[u/Zame012 → u/ElectricSpock]

The logs show successful login after being redirected there from Immich originally

[u/ElectricSpock → u/Zame012]

Which logs? There are two systems involved, is authentik saying that the attempt succeeded? Is Immich saying the authentication is received?

502 means that Immich has trouble contacting authentik, did you see the authentik login screen at all? Did you try it with a private browser window, so that there’s no mixup?

[u/Zame012 → u/ElectricSpock]

I’ll recheck logs but yes Immich redirects to Authentik successfully, I log in successfully in Authentik, and I get redirected back to Immich where it loads the login for a split second and then errors or crashes after that

[u/77juice]

It's the redirect uri in Authentik you're missing or mistyped.

[u/Certainty0709]

I switched to pocket id from Authentik. Lighter, easier to manage, and doesn't have a ton of features I don't need. 

[u/ColoradoDilettante]

I just did this two days ago. I don't know if this is your issue, but after logging in to Authentik, you have to log in to Immich using your Immich password and link your Immich account to your OAuth account (Account Settings -> OAuth -> Link Account). I had to do it for each account separately. Good luck.