Proposed pattern: external media verification service for Authentik flows

[Darius-Vallejo]

Hi Authentik maintainers 👋

I’m exploring an external integration pattern for media-based verification
(voice biometrics, document OCR, facial recognition) that Authentik doesn’t natively support today.

Problem
Authentik currently doesn’t provide native media verification stages (e.g. voice biometrics, document OCR, face checks).
Some users solve this by embedding logic in custom stages or external scripts, but that quickly becomes hard to maintain.

Instead of adding this to Authentik core, I'm building a separate gateway that integrates via
Expression Policies and uses the Claim Check pattern for media handling.

High-level idea

• Authentik frontend requests a presigned upload URL
• Client uploads media directly to S3/MinIO
• Authentik policy calls an external /verify endpoint with a reference
• The gateway downloads the object and routes it to a processor (voice.*, ocr.*, face.*)
• Policy receives {valid, confidence} and decides the flow outcome

This avoids:

• Storing large media in Authentik
• Blocking request threads
• Tight coupling between Authentik and biometric vendors

Reference implementation (early-stage)

I published an early MVP here:
👉 https://github.com/Darius-Vallejo/authentik-media-gateway

It’s intentionally external and designed as a reference architecture, not a plugin.

Questions for the community

1. From your experience, are Expression Policies the right integration point for this kind of verification?
2. Are there better hooks/stages in flows where this pattern fits more naturally?
3. Any gotchas around request timeouts, retries, or async behavior I should be aware of?
4. Would this be something worth documenting as an official integration pattern (even if not core)?

Not asking for Authentik to support this directly... just looking for feedback from people who know the internals better than I do.

Thanks for any guidance 🙏