incident.io
Alert rate limits stop being per-source and start being per-tenant, by query.
Comparison · Infra & APIs
authentik vs Oh Dear
A side-by-side editorial comparison of authentik and Oh Dear — release velocity, themes, recent moves, and the top alternatives to consider.
authentik vs Oh Dear: at a glance
What is authentik?
The first patch on 2026.8 is twenty-odd fixes and no new surface.
2026.8.1 is the first patch after the 2026.8 release, and the GitHub tag carries only a link to the docs. The fix list behind it is entirely correctness work: proxy outposts no longer break header parsing in non-compliant backends or double-send the host on token introspection, X-Forwarded-For now takes the rightmost untrusted IP, expression policies stop polluting the request context, and websocket subprotocol negotiation is relayed properly. New installs get a one-day default token duration. Nothing here changes what authentik can do.
What is Oh Dear?
The monitoring account is becoming something an agent operates, not just a dashboard someone reads.
Oh Dear is an uptime and site-health monitoring service shipping a dated changelog most weeks, with each release mixing new capability, security work and fixes. The MCP server is the thread running through all of it: monitor create, update and delete arrived in May, tag groups and notification routing in June, and the August release extends it across downtime, check summaries, domain intelligence, maintenance windows, check state, status page updates, notification destinations, scheduled tasks, Broken Links, Application Health and account management. Around that sit steady monitoring improvements — consecutive-failure thresholds for sitemap alerts, raw JSON bodies in HTTP checks, better handling of out-of-order scheduled-task pings.
authentik vs Oh Dear: editorial side-by-side
authentik
6.3INFRA · APIS
The first patch on 2026.8 is twenty-odd fixes and no new surface.
◆ Current state
2026.8.1 is the first patch after the 2026.8 release, and the GitHub tag carries only a link to the docs. The fix list behind it is entirely correctness work: proxy outposts no longer break header parsing in non-compliant backends or double-send the host on token introspection, X-Forwarded-For now takes the rightmost untrusted IP, expression policies stop polluting the request context, and websocket subprotocol negotiation is relayed properly. New installs get a one-day default token duration. Nothing here changes what authentik can do.
◆ Where it's heading
The release train is behaving as expected after a major: 2026.8.0 landed in mid-August after a long rc series, and the first patch is dominated by outpost and proxy edge cases, which is where authentik meets other people's infrastructure and therefore where the reports come from. The security-adjacent items — X-Forwarded-For parsing, expression context isolation, a shorter default token life — are hardening rather than capability.
◆ Prediction
Patch releases on a fresh major usually run in a short series, so a 2026.8.2 with the remaining outpost reports is the likely next entry. The tag body links to docs rather than describing anything, so nothing further is stated.
Oh Dear
5.0INFRA · APIS
The monitoring account is becoming something an agent operates, not just a dashboard someone reads.
◆ Current state
Oh Dear is an uptime and site-health monitoring service shipping a dated changelog most weeks, with each release mixing new capability, security work and fixes. The MCP server is the thread running through all of it: monitor create, update and delete arrived in May, tag groups and notification routing in June, and the August release extends it across downtime, check summaries, domain intelligence, maintenance windows, check state, status page updates, notification destinations, scheduled tasks, Broken Links, Application Health and account management. Around that sit steady monitoring improvements — consecutive-failure thresholds for sitemap alerts, raw JSON bodies in HTTP checks, better handling of out-of-order scheduled-task pings.
◆ Where it's heading
Two things are being built at once and they depend on each other. The MCP surface keeps widening until an assistant can run the account end to end, and the authorization model keeps being tightened to make that safe — API token scoping, permission checks on monitor-modifying tools, access controls on the new write tools, sessions invalidated on password change. Each release moves both. Underneath, the business plumbing is being tidied in public too: legacy pricing shown on the plan chooser, corrected affiliate terms, an agency-focused pricing structure, AI wizard placeholder monitors excluded from usage limits.
◆ Prediction
Expect the MCP tool surface to keep filling in the remaining corners of the product and the permission model to keep pace with it, and expect the November Slack connection deprecation already being warned about in-app to produce a migration release before then.
Alternatives to authentik and Oh Dear
Other Infra & APIs products tracked by Sparkpulse, ranked by recent ship velocity. Each card links to a full editorial trajectory and lets you pivot into a head-to-head comparison with either authentik or Oh Dear.
Warp
The essay series keeps running ahead of the products it describes.
Node-RED
Both lines patch on the same day, and the reverted JSONata upgrade finally sticks.
werf
The 3.x line finally ships function: authenticated secret writes and render patches.
Infisical
Folder-level RBAC lands, and approvals finally get a webhook to talk to.
Retool
Retool posts one-line changelog entries, and its agent work is the only visible thread
See all authentik alternatives → · See all Oh Dear alternatives →
Recent activity from authentik and Oh Dear
Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.
- 1d agoauthentik2026.8.1 patches proxy outposts, header parsing, and expressions
- 4d agoOh DearMCP tools extended across maintenance, status pages and account management
- 11d agoOh DearAPI token scoping and MCP permission checks tightened
- 14d agoauthentikauthentik 2026.8 goes GA with Actors and domain-joined Agents ⚡
- 19d agoOh DearRecovery notifications restored after performance delta alerts
- 22d agoauthentikauthentik 2026.8.0-rc7 lands Actors, enterprise Agents, and CAS sources
- 25d agoOh DearJSON request bodies in HTTP checks; AI monitoring moves to the Laravel AI SDK
- 29d agoauthentik2026.8.0-rc6: flaky test and CI metadata fixes
- 29d agoauthentik2026.8.0-rc5: release plumbing only
- 1mo agoauthentik2026.8.0-rc4: fix-only candidate
- 1mo agoOh DearApplication Health metadata limit doubled; scheduled-task ping fixes
- 1mo agoOh DearAgency pricing introduced; Forge import moves to scoped API v2 tokens
Frequently asked questions
What is the difference between authentik and Oh Dear?
They serve adjacent needs but don't currently overlap on shipped themes. authentik is currently shipping more aggressively (velocity 6.3 vs 5.0), with 1 editorial sparks in the last 30 days against 0. See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.
Is authentik better than Oh Dear?
Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. authentik is currently shipping more aggressively (velocity 6.3 vs 5.0), with 1 editorial sparks in the last 30 days against 0. For your specific use case, the alternatives sections above list other Infra & APIs products to evaluate alongside.
What are the best alternatives to authentik?
Top authentik alternatives in Infra & APIs are ranked by recent ship velocity. Browse the "authentik alternatives" section above for the current picks, or visit /alternatives/authentik for the full list with editorial commentary on each.
What are the best alternatives to Oh Dear?
Top Oh Dear alternatives in Infra & APIs are ranked by recent ship velocity. Browse the "Oh Dear alternatives" section above for the current picks, or visit /alternatives/ohdear for the full list with editorial commentary on each.