# Authentik & Access
**Who can use this:** Everyone.
[`https://auth.necc.me`](https://auth.necc.me)
### 1. What is Authentik?
**Authentik** is the central security hub for this server. Think of it as your **universal key**.
Instead of creating a separate username and password for every tool (like **Forgejo** for code, **Immich** for photos, **Vaultwarden** for passwords), you log in **once** with Authentik. It then securely tells every other service who you are. This means:
- You only remember **one password**.
- Your **Multi-Factor Authentication (MFA)** works everywhere automatically.
- If you ever lose your password, you only need to reset it in one place.
### 2. How to Log In to Services
When you open a service, you will be asked to log in.
**Always use your Authentik account.**
Different software projects use different technical names for this "single login" feature. You might see buttons labeled:
- **SSO** (Single Sign-On)
- **OIDC** (OpenID Connect)
- **OAuth2** / **OAuth**
- **OpenID**
- **Federated Login**
- **Login with Provider**
- **Sign in with...**
**Don't be confused by the names!** They all mean the same thing here: *"Click this to use your main server account."*
**Important Warning:** I have tried to make SSO the only option, but unfortunately, **not all services support this perfectly**. Some applications might still show a standard "Username/Password" box with the option for SSO somewhere on the page.
- **DO NOT** create a new password or enter your Authentik password in these boxes.
- **LOOK** for a small link or button nearby saying "Log in with SSO," "Use External Provider," "OIDC," or similar as explained above.
### 3. Who Can Access What?
Not all services are available to everyone. Think of each service as a **private room** in a big house.
- Even if you have a key to the front door (your Authentik account), you can only enter rooms where you have been invited.
- Some tools are only for specific family members, friends, or project groups.
- **If you try to access a service and get an error** (like "Access Denied" or "Unauthorized"), it means you are not on the list for that specific room.
- **To get access:** Simply **contact the owner**. Tell me which service you need, and I may add you to the list.