Follow Authentik’s guide for integrating Immich:
See also
However, under the “Immich configuration”, step 2 lists the wrong Issuer URL to use. Instead, get the OpenID Configuration URL from the Applications → Providers → Overview menu in Authentik and set it to that.
See also:
I learned this from Lobidu: https://github.com/immich-app/immich/discussions/24071#discussioncomment-15324106