diff --git a/authentik/core/tests/test_models.py b/authentik/core/tests/test_models.py
index cb04446328..513452808c 100644
--- a/authentik/core/tests/test_models.py
+++ b/authentik/core/tests/test_models.py
@@ -1,11 +1,14 @@
 """authentik core models tests"""
 from time import sleep
+from typing import Callable, Type
 
 from django.test import TestCase
 from django.utils.timezone import now
 from guardian.shortcuts import get_anonymous_user
 
-from authentik.core.models import Token
+from authentik.core.models import Provider, Source, Token
+from authentik.flows.models import Stage
+from authentik.lib.utils.reflection import all_subclasses
 
 
 class TestModels(TestCase):
@@ -24,3 +27,40 @@ class TestModels(TestCase):
         )
         sleep(0.5)
         self.assertFalse(token.is_expired)
+
+
+def source_tester_factory(test_model: Type[Stage]) -> Callable:
+    """Test source"""
+
+    def tester(self: TestModels):
+        model_class = None
+        if test_model._meta.abstract:
+            model_class = test_model.__bases__[0]()
+        else:
+            model_class = test_model()
+        model_class.slug = "test"
+        self.assertIsNotNone(model_class.component)
+        _ = model_class.ui_login_button
+        _ = model_class.ui_user_settings
+
+    return tester
+
+
+def provider_tester_factory(test_model: Type[Stage]) -> Callable:
+    """Test provider"""
+
+    def tester(self: TestModels):
+        model_class = None
+        if test_model._meta.abstract:
+            model_class = test_model.__bases__[0]()
+        else:
+            model_class = test_model()
+        self.assertIsNotNone(model_class.component)
+
+    return tester
+
+
+for model in all_subclasses(Source):
+    setattr(TestModels, f"test_model_{model.__name__}", source_tester_factory(model))
+for model in all_subclasses(Provider):
+    setattr(TestModels, f"test_model_{model.__name__}", provider_tester_factory(model))
diff --git a/authentik/flows/tests/test_stage_model.py b/authentik/flows/tests/test_stage_model.py
index fe887ee89d..05db743f65 100644
--- a/authentik/flows/tests/test_stage_model.py
+++ b/authentik/flows/tests/test_stage_model.py
@@ -16,17 +16,14 @@ def model_tester_factory(test_model: Type[Stage]) -> Callable:
     """Test a form"""
 
     def tester(self: TestModels):
-        try:
-            model_class = None
-            if test_model._meta.abstract:
-                model_class = test_model.__bases__[0]()
-            else:
-                model_class = test_model()
-            self.assertTrue(issubclass(model_class.type, StageView))
-            self.assertIsNotNone(test_model.component)
-            _ = test_model.ui_user_settings
-        except NotImplementedError:
-            pass
+        model_class = None
+        if test_model._meta.abstract:
+            model_class = test_model.__bases__[0]()
+        else:
+            model_class = test_model()
+        self.assertTrue(issubclass(model_class.type, StageView))
+        self.assertIsNotNone(test_model.component)
+        _ = test_model.ui_user_settings
 
     return tester
 
diff --git a/authentik/sources/plex/migrations/0001_initial.py b/authentik/sources/plex/migrations/0001_initial.py
index 16032d37b0..c5b87959bb 100644
--- a/authentik/sources/plex/migrations/0001_initial.py
+++ b/authentik/sources/plex/migrations/0001_initial.py
@@ -1,4 +1,4 @@
-# Generated by Django 3.2 on 2021-05-02 12:34
+# Generated by Django 3.2 on 2021-05-03 18:59
 
 import django.contrib.postgres.fields
 import django.db.models.deletion
@@ -10,7 +10,7 @@ class Migration(migrations.Migration):
     initial = True
 
     dependencies = [
-        ("authentik_core", "0019_source_managed"),
+        ("authentik_core", "0020_source_user_matching_mode"),
     ]
 
     operations = [
@@ -28,11 +28,20 @@ class Migration(migrations.Migration):
                         to="authentik_core.source",
                     ),
                 ),
-                ("client_id", models.TextField()),
+                (
+                    "client_id",
+                    models.TextField(
+                        default="yOuPQQvgNfBGreZZ38WoOY1d3qk3Xso2AuQHi6RG",
+                        help_text="Client identifier used to talk to Plex.",
+                    ),
+                ),
                 (
                     "allowed_servers",
                     django.contrib.postgres.fields.ArrayField(
-                        base_field=models.TextField(), size=None
+                        base_field=models.TextField(),
+                        default=list,
+                        help_text="Which servers a user has to be a member of to be granted access. Empty list allows every server.",
+                        size=None,
                     ),
                 ),
             ],
@@ -42,4 +51,27 @@ class Migration(migrations.Migration):
             },
             bases=("authentik_core.source",),
         ),
+        migrations.CreateModel(
+            name="PlexSourceConnection",
+            fields=[
+                (
+                    "usersourceconnection_ptr",
+                    models.OneToOneField(
+                        auto_created=True,
+                        on_delete=django.db.models.deletion.CASCADE,
+                        parent_link=True,
+                        primary_key=True,
+                        serialize=False,
+                        to="authentik_core.usersourceconnection",
+                    ),
+                ),
+                ("plex_token", models.TextField()),
+                ("identifier", models.TextField()),
+            ],
+            options={
+                "verbose_name": "User Plex Source Connection",
+                "verbose_name_plural": "User Plex Source Connections",
+            },
+            bases=("authentik_core.usersourceconnection",),
+        ),
     ]
diff --git a/authentik/sources/plex/migrations/0002_plexsourceconnection.py b/authentik/sources/plex/migrations/0002_plexsourceconnection.py
deleted file mode 100644
index 3f139a0ff7..0000000000
--- a/authentik/sources/plex/migrations/0002_plexsourceconnection.py
+++ /dev/null
@@ -1,38 +0,0 @@
-# Generated by Django 3.2 on 2021-05-03 17:06
-
-import django.db.models.deletion
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0020_source_user_matching_mode"),
-        ("authentik_sources_plex", "0001_initial"),
-    ]
-
-    operations = [
-        migrations.CreateModel(
-            name="PlexSourceConnection",
-            fields=[
-                (
-                    "usersourceconnection_ptr",
-                    models.OneToOneField(
-                        auto_created=True,
-                        on_delete=django.db.models.deletion.CASCADE,
-                        parent_link=True,
-                        primary_key=True,
-                        serialize=False,
-                        to="authentik_core.usersourceconnection",
-                    ),
-                ),
-                ("plex_token", models.TextField()),
-                ("identifier", models.TextField()),
-            ],
-            options={
-                "verbose_name": "User Plex Source Connection",
-                "verbose_name_plural": "User Plex Source Connections",
-            },
-            bases=("authentik_core.usersourceconnection",),
-        ),
-    ]
diff --git a/authentik/sources/plex/models.py b/authentik/sources/plex/models.py
index 4ad8d0901b..f7d48a1466 100644
--- a/authentik/sources/plex/models.py
+++ b/authentik/sources/plex/models.py
@@ -9,6 +9,7 @@ from rest_framework.serializers import BaseSerializer
 from authentik.core.models import Source, UserSourceConnection
 from authentik.core.types import UILoginButton
 from authentik.flows.challenge import Challenge, ChallengeTypes
+from authentik.providers.oauth2.generators import generate_client_id
 
 
 class PlexAuthenticationChallenge(Challenge):
@@ -21,8 +22,20 @@ class PlexAuthenticationChallenge(Challenge):
 class PlexSource(Source):
     """Authenticate against plex.tv"""
 
-    client_id = models.TextField()
-    allowed_servers = ArrayField(models.TextField())
+    client_id = models.TextField(
+        default=generate_client_id(),
+        help_text=_("Client identifier used to talk to Plex."),
+    )
+    allowed_servers = ArrayField(
+        models.TextField(),
+        default=list,
+        help_text=_(
+            (
+                "Which servers a user has to be a member of to be granted access. "
+                "Empty list allows every server."
+            )
+        ),
+    )
 
     @property
     def component(self) -> str:
diff --git a/authentik/sources/plex/plex.py b/authentik/sources/plex/plex.py
index c51ef83bfa..ba39997abb 100644
--- a/authentik/sources/plex/plex.py
+++ b/authentik/sources/plex/plex.py
@@ -1,9 +1,9 @@
 """Plex Views"""
 from urllib.parse import urlencode
 
-import requests
 from django.http.request import HttpRequest
 from django.http.response import Http404, HttpResponse
+from requests import Session
 from requests.exceptions import RequestException
 from structlog.stdlib import get_logger
 
@@ -25,7 +25,7 @@ class PlexAuth:
     def __init__(self, source: PlexSource, token: str):
         self._source = source
         self._token = token
-        self._session = requests.Session()
+        self._session = Session()
         self._session.headers.update(
             {"Accept": "application/json", "Content-Type": "application/json"}
         )
diff --git a/web/src/flows/sources/plex/API.ts b/web/src/flows/sources/plex/API.ts
index a3dc2306fa..be7a46d597 100644
--- a/web/src/flows/sources/plex/API.ts
+++ b/web/src/flows/sources/plex/API.ts
@@ -67,7 +67,7 @@ export class PlexAPIClient {
             reject: (e: Error) => void
         ) => {
             try {
-                const response = await PlexAPIClient.pinStatus(clientIdentifier, id)
+                const response = await PlexAPIClient.pinStatus(clientIdentifier, id);
 
                 if (response) {
                     resolve(response);
diff --git a/web/src/locales/en.po b/web/src/locales/en.po
index 40906aa586..b958c8b020 100644
--- a/web/src/locales/en.po
+++ b/web/src/locales/en.po
@@ -156,6 +156,10 @@ msgstr "Allow users to use Applications based on properties, enforce Password Cr
 msgid "Allowed count"
 msgstr "Allowed count"
 
+#: src/pages/sources/plex/PlexSourceForm.ts:119
+msgid "Allowed servers"
+msgstr "Allowed servers"
+
 #: src/pages/sources/saml/SAMLSourceForm.ts:144
 msgid "Allows authentication flows initiated by the IdP. This can be a security risk, as no validation of the request ID is done."
 msgstr "Allows authentication flows initiated by the IdP. This can be a security risk, as no validation of the request ID is done."
@@ -282,6 +286,7 @@ msgid "Authentication"
 msgstr "Authentication"
 
 #: src/pages/sources/oauth/OAuthSourceForm.ts:189
+#: src/pages/sources/plex/PlexSourceForm.ts:149
 #: src/pages/sources/saml/SAMLSourceForm.ts:245
 msgid "Authentication flow"
 msgstr "Authentication flow"
@@ -395,8 +400,8 @@ msgstr "Binding Type"
 msgid "Build hash: {0}"
 msgstr "Build hash: {0}"
 
-#: src/pages/sources/SourcesListPage.ts:103
-#: src/pages/sources/SourcesListPage.ts:105
+#: src/pages/sources/SourcesListPage.ts:104
+#: src/pages/sources/SourcesListPage.ts:106
 msgid "Built-in"
 msgstr "Built-in"
 
@@ -544,6 +549,7 @@ msgstr "Click to copy token"
 
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:107
 #: src/pages/providers/oauth2/OAuth2ProviderViewPage.ts:99
+#: src/pages/sources/plex/PlexSourceForm.ts:113
 msgid "Client ID"
 msgstr "Client ID"
 
@@ -744,8 +750,8 @@ msgstr "Copy Key"
 #: src/pages/providers/ProviderListPage.ts:116
 #: src/pages/providers/RelatedApplicationButton.ts:27
 #: src/pages/providers/RelatedApplicationButton.ts:35
-#: src/pages/sources/SourcesListPage.ts:113
-#: src/pages/sources/SourcesListPage.ts:122
+#: src/pages/sources/SourcesListPage.ts:114
+#: src/pages/sources/SourcesListPage.ts:123
 #: src/pages/stages/StageListPage.ts:119
 #: src/pages/stages/StageListPage.ts:128
 #: src/pages/stages/invitation/InvitationListPage.ts:77
@@ -842,7 +848,7 @@ msgstr "Create provider"
 #: src/pages/policies/PolicyListPage.ts:136
 #: src/pages/property-mappings/PropertyMappingListPage.ts:125
 #: src/pages/providers/ProviderListPage.ts:119
-#: src/pages/sources/SourcesListPage.ts:125
+#: src/pages/sources/SourcesListPage.ts:126
 #: src/pages/stages/StageListPage.ts:131
 msgid "Create {0}"
 msgstr "Create {0}"
@@ -898,7 +904,7 @@ msgstr "Define how notifications are sent to users, like Email or Webhook."
 #: src/pages/policies/PolicyListPage.ts:115
 #: src/pages/property-mappings/PropertyMappingListPage.ts:104
 #: src/pages/providers/ProviderListPage.ts:98
-#: src/pages/sources/SourcesListPage.ts:94
+#: src/pages/sources/SourcesListPage.ts:95
 #: src/pages/stages/StageListPage.ts:110
 #: src/pages/stages/invitation/InvitationListPage.ts:68
 #: src/pages/stages/prompt/PromptListPage.ts:87
@@ -1008,7 +1014,7 @@ msgstr "Disable Static Tokens"
 msgid "Disable Time-based OTP"
 msgstr "Disable Time-based OTP"
 
-#: src/pages/sources/SourcesListPage.ts:63
+#: src/pages/sources/SourcesListPage.ts:64
 msgid "Disabled"
 msgstr "Disabled"
 
@@ -1049,7 +1055,7 @@ msgstr "Each provider has a different issuer, based on the application slug."
 #: src/pages/providers/oauth2/OAuth2ProviderViewPage.ts:128
 #: src/pages/providers/proxy/ProxyProviderViewPage.ts:127
 #: src/pages/providers/saml/SAMLProviderViewPage.ts:121
-#: src/pages/sources/SourcesListPage.ts:82
+#: src/pages/sources/SourcesListPage.ts:83
 #: src/pages/sources/ldap/LDAPSourceViewPage.ts:105
 #: src/pages/sources/oauth/OAuthSourceViewPage.ts:125
 #: src/pages/sources/saml/SAMLSourceViewPage.ts:111
@@ -1086,7 +1092,7 @@ msgstr "Edit User"
 msgid "Either no applications are defined, or you don't have access to any."
 msgstr "Either no applications are defined, or you don't have access to any."
 
-#: src/flows/stages/identification/IdentificationStage.ts:138
+#: src/flows/stages/identification/IdentificationStage.ts:146
 #: src/pages/events/TransportForm.ts:46
 #: src/pages/stages/identification/IdentificationStageForm.ts:81
 #: src/pages/user-settings/UserDetailsPage.ts:71
@@ -1099,7 +1105,7 @@ msgstr "Email"
 msgid "Email address"
 msgstr "Email address"
 
-#: src/flows/stages/identification/IdentificationStage.ts:145
+#: src/flows/stages/identification/IdentificationStage.ts:153
 msgid "Email or username"
 msgstr "Email or username"
 
@@ -1136,6 +1142,7 @@ msgstr "Enable this if you don't want to use this provider as a proxy, and want
 #: src/pages/policies/PolicyBindingForm.ts:199
 #: src/pages/sources/ldap/LDAPSourceForm.ts:69
 #: src/pages/sources/oauth/OAuthSourceForm.ts:115
+#: src/pages/sources/plex/PlexSourceForm.ts:102
 #: src/pages/sources/saml/SAMLSourceForm.ts:69
 msgid "Enabled"
 msgstr "Enabled"
@@ -1145,6 +1152,7 @@ msgid "Enrollment"
 msgstr "Enrollment"
 
 #: src/pages/sources/oauth/OAuthSourceForm.ts:210
+#: src/pages/sources/plex/PlexSourceForm.ts:170
 #: src/pages/sources/saml/SAMLSourceForm.ts:266
 #: src/pages/stages/identification/IdentificationStageForm.ts:106
 msgid "Enrollment flow"
@@ -1357,16 +1365,19 @@ msgid "Flow Overview"
 msgstr "Flow Overview"
 
 #: src/pages/sources/oauth/OAuthSourceForm.ts:185
+#: src/pages/sources/plex/PlexSourceForm.ts:145
 #: src/pages/sources/saml/SAMLSourceForm.ts:220
 msgid "Flow settings"
 msgstr "Flow settings"
 
 #: src/pages/sources/oauth/OAuthSourceForm.ts:207
+#: src/pages/sources/plex/PlexSourceForm.ts:167
 #: src/pages/sources/saml/SAMLSourceForm.ts:263
 msgid "Flow to use when authenticating existing users."
 msgstr "Flow to use when authenticating existing users."
 
 #: src/pages/sources/oauth/OAuthSourceForm.ts:228
+#: src/pages/sources/plex/PlexSourceForm.ts:188
 #: src/pages/sources/saml/SAMLSourceForm.ts:284
 msgid "Flow to use when enrolling new users."
 msgstr "Flow to use when enrolling new users."
@@ -1410,7 +1421,7 @@ msgstr "Force the user to configure an authenticator"
 msgid "Forgot password?"
 msgstr "Forgot password?"
 
-#: src/flows/stages/identification/IdentificationStage.ts:124
+#: src/flows/stages/identification/IdentificationStage.ts:132
 msgid "Forgot username or password?"
 msgstr "Forgot username or password?"
 
@@ -1510,6 +1521,7 @@ msgstr "Hide managed mappings"
 #: src/pages/providers/saml/SAMLProviderForm.ts:177
 #: src/pages/sources/ldap/LDAPSourceForm.ts:167
 #: src/pages/sources/ldap/LDAPSourceForm.ts:193
+#: src/pages/sources/plex/PlexSourceForm.ts:132
 #: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts:114
 #: src/pages/stages/identification/IdentificationStageForm.ts:85
 #: src/pages/stages/password/PasswordStageForm.ts:86
@@ -1692,9 +1704,13 @@ msgstr "Let the user identify themselves with their username or Email address."
 msgid "Library"
 msgstr "Library"
 
+#: src/pages/sources/plex/PlexSourceForm.ts:137
+msgid "Load servers"
+msgstr "Load servers"
+
 #: src/elements/table/Table.ts:120
-#: src/flows/FlowExecutor.ts:167
-#: src/flows/FlowExecutor.ts:213
+#: src/flows/FlowExecutor.ts:168
+#: src/flows/FlowExecutor.ts:216
 #: src/flows/access_denied/FlowAccessDenied.ts:27
 #: src/flows/stages/authenticator_static/AuthenticatorStaticStage.ts:43
 #: src/flows/stages/authenticator_totp/AuthenticatorTOTPStage.ts:33
@@ -1705,7 +1721,7 @@ msgstr "Library"
 #: src/flows/stages/consent/ConsentStage.ts:28
 #: src/flows/stages/dummy/DummyStage.ts:27
 #: src/flows/stages/email/EmailStage.ts:26
-#: src/flows/stages/identification/IdentificationStage.ts:171
+#: src/flows/stages/identification/IdentificationStage.ts:179
 #: src/flows/stages/password/PasswordStage.ts:31
 #: src/flows/stages/prompt/PromptStage.ts:126
 #: src/pages/applications/ApplicationViewPage.ts:43
@@ -1750,6 +1766,8 @@ msgstr "Loading"
 #: src/pages/sources/oauth/OAuthSourceForm.ts:177
 #: src/pages/sources/oauth/OAuthSourceForm.ts:205
 #: src/pages/sources/oauth/OAuthSourceForm.ts:226
+#: src/pages/sources/plex/PlexSourceForm.ts:165
+#: src/pages/sources/plex/PlexSourceForm.ts:186
 #: src/pages/sources/saml/SAMLSourceForm.ts:126
 #: src/pages/sources/saml/SAMLSourceForm.ts:240
 #: src/pages/sources/saml/SAMLSourceForm.ts:261
@@ -1780,7 +1798,7 @@ msgstr "Log the currently pending user in."
 msgid "Login password is synced from LDAP into authentik automatically. Enable this option only to write password changes in authentik back to LDAP."
 msgstr "Login password is synced from LDAP into authentik automatically. Enable this option only to write password changes in authentik back to LDAP."
 
-#: src/flows/stages/identification/IdentificationStage.ts:183
+#: src/flows/stages/identification/IdentificationStage.ts:191
 msgid "Login to continue to {0}."
 msgstr "Login to continue to {0}."
 
@@ -1913,11 +1931,12 @@ msgstr "Monitor"
 #: src/pages/providers/saml/SAMLProviderForm.ts:53
 #: src/pages/providers/saml/SAMLProviderImportForm.ts:38
 #: src/pages/providers/saml/SAMLProviderViewPage.ts:66
-#: src/pages/sources/SourcesListPage.ts:51
+#: src/pages/sources/SourcesListPage.ts:52
 #: src/pages/sources/ldap/LDAPSourceForm.ts:54
 #: src/pages/sources/ldap/LDAPSourceViewPage.ts:64
 #: src/pages/sources/oauth/OAuthSourceForm.ts:100
 #: src/pages/sources/oauth/OAuthSourceViewPage.ts:64
+#: src/pages/sources/plex/PlexSourceForm.ts:87
 #: src/pages/sources/saml/SAMLSourceForm.ts:54
 #: src/pages/sources/saml/SAMLSourceViewPage.ts:66
 #: src/pages/stages/StageListPage.ts:65
@@ -1957,7 +1976,7 @@ msgstr "NameID Policy"
 msgid "NameID Property Mapping"
 msgstr "NameID Property Mapping"
 
-#: src/flows/stages/identification/IdentificationStage.ts:119
+#: src/flows/stages/identification/IdentificationStage.ts:127
 msgid "Need an account?"
 msgstr "Need an account?"
 
@@ -2348,7 +2367,7 @@ msgstr "Post binding"
 msgid "Post binding (auto-submit)"
 msgstr "Post binding (auto-submit)"
 
-#: src/flows/FlowExecutor.ts:255
+#: src/flows/FlowExecutor.ts:258
 msgid "Powered by authentik"
 msgstr "Powered by authentik"
 
@@ -2412,6 +2431,7 @@ msgstr "Property mappings used to user creation."
 #: src/pages/providers/proxy/ProxyProviderForm.ts:123
 #: src/pages/providers/saml/SAMLProviderForm.ts:78
 #: src/pages/sources/oauth/OAuthSourceForm.ts:122
+#: src/pages/sources/plex/PlexSourceForm.ts:109
 #: src/pages/sources/saml/SAMLSourceForm.ts:76
 msgid "Protocol settings"
 msgstr "Protocol settings"
@@ -2602,7 +2622,7 @@ msgstr "Retry Task"
 msgid "Retry authentication"
 msgstr "Retry authentication"
 
-#: src/flows/FlowExecutor.ts:145
+#: src/flows/FlowExecutor.ts:146
 msgid "Return"
 msgstr "Return"
 
@@ -2710,7 +2730,7 @@ msgstr "Select all rows"
 msgid "Select an identification method."
 msgstr "Select an identification method."
 
-#: src/flows/stages/identification/IdentificationStage.ts:134
+#: src/flows/stages/identification/IdentificationStage.ts:142
 msgid "Select one of the sources below to login."
 msgstr "Select one of the sources below to login."
 
@@ -2722,6 +2742,10 @@ msgstr "Select users to add"
 msgid "Select which scopes can be used by the client. The client stil has to specify the scope to access the data."
 msgstr "Select which scopes can be used by the client. The client stil has to specify the scope to access the data."
 
+#: src/pages/sources/plex/PlexSourceForm.ts:131
+msgid "Select which server a user has to be a member of to be allowed to authenticate."
+msgstr "Select which server a user has to be a member of to be allowed to authenticate."
+
 #: src/pages/events/RuleForm.ts:92
 msgid "Select which transports should be used to notify the user. If none are selected, the notification will only be shown in the authentik UI."
 msgstr "Select which transports should be used to notify the user. If none are selected, the notification will only be shown in the authentik UI."
@@ -2820,7 +2844,7 @@ msgstr "Show matched user"
 msgid "Shown as the Title in Flow pages."
 msgstr "Shown as the Title in Flow pages."
 
-#: src/flows/stages/identification/IdentificationStage.ts:120
+#: src/flows/stages/identification/IdentificationStage.ts:128
 msgid "Sign up."
 msgstr "Sign up."
 
@@ -2854,16 +2878,17 @@ msgstr "Skip path regex"
 #: src/pages/flows/FlowForm.ts:94
 #: src/pages/sources/ldap/LDAPSourceForm.ts:60
 #: src/pages/sources/oauth/OAuthSourceForm.ts:106
+#: src/pages/sources/plex/PlexSourceForm.ts:93
 #: src/pages/sources/saml/SAMLSourceForm.ts:60
 msgid "Slug"
 msgstr "Slug"
 
-#: src/flows/FlowExecutor.ts:138
+#: src/flows/FlowExecutor.ts:139
 msgid "Something went wrong! Please try again later."
 msgstr "Something went wrong! Please try again later."
 
 #: src/pages/providers/ProviderListPage.ts:91
-#: src/pages/sources/SourcesListPage.ts:87
+#: src/pages/sources/SourcesListPage.ts:88
 msgid "Source"
 msgstr "Source"
 
@@ -2872,11 +2897,11 @@ msgid "Source {0}"
 msgstr "Source {0}"
 
 #: src/interfaces/AdminInterface.ts:20
-#: src/pages/sources/SourcesListPage.ts:30
+#: src/pages/sources/SourcesListPage.ts:31
 msgid "Sources"
 msgstr "Sources"
 
-#: src/pages/sources/SourcesListPage.ts:33
+#: src/pages/sources/SourcesListPage.ts:34
 msgid "Sources of identities, which can either be synced into authentik's database, like LDAP, or can be used by users to authenticate and enroll themselves, like OAuth and social logins"
 msgstr "Sources of identities, which can either be synced into authentik's database, like LDAP, or can be used by users to authenticate and enroll themselves, like OAuth and social logins"
 
@@ -3073,6 +3098,7 @@ msgstr "Successfully created service-connection."
 
 #: src/pages/sources/ldap/LDAPSourceForm.ts:47
 #: src/pages/sources/oauth/OAuthSourceForm.ts:51
+#: src/pages/sources/plex/PlexSourceForm.ts:60
 #: src/pages/sources/saml/SAMLSourceForm.ts:47
 msgid "Successfully created source."
 msgstr "Successfully created source."
@@ -3209,6 +3235,7 @@ msgstr "Successfully updated service-connection."
 
 #: src/pages/sources/ldap/LDAPSourceForm.ts:44
 #: src/pages/sources/oauth/OAuthSourceForm.ts:48
+#: src/pages/sources/plex/PlexSourceForm.ts:57
 #: src/pages/sources/saml/SAMLSourceForm.ts:44
 msgid "Successfully updated source."
 msgstr "Successfully updated source."
@@ -3464,7 +3491,7 @@ msgstr "Transports"
 #: src/pages/policies/PolicyListPage.ts:57
 #: src/pages/property-mappings/PropertyMappingListPage.ts:55
 #: src/pages/providers/ProviderListPage.ts:54
-#: src/pages/sources/SourcesListPage.ts:52
+#: src/pages/sources/SourcesListPage.ts:53
 #: src/pages/stages/prompt/PromptForm.ts:97
 #: src/pages/stages/prompt/PromptListPage.ts:48
 msgid "Type"
@@ -3543,7 +3570,7 @@ msgstr "Up-to-date!"
 #: src/pages/providers/oauth2/OAuth2ProviderViewPage.ts:118
 #: src/pages/providers/proxy/ProxyProviderViewPage.ts:117
 #: src/pages/providers/saml/SAMLProviderViewPage.ts:111
-#: src/pages/sources/SourcesListPage.ts:69
+#: src/pages/sources/SourcesListPage.ts:70
 #: src/pages/sources/ldap/LDAPSourceViewPage.ts:95
 #: src/pages/sources/oauth/OAuthSourceViewPage.ts:115
 #: src/pages/sources/saml/SAMLSourceViewPage.ts:101
@@ -3646,7 +3673,7 @@ msgstr "Update details"
 #: src/pages/policies/PolicyListPage.ts:80
 #: src/pages/property-mappings/PropertyMappingListPage.ts:69
 #: src/pages/providers/ProviderListPage.ts:76
-#: src/pages/sources/SourcesListPage.ts:72
+#: src/pages/sources/SourcesListPage.ts:73
 #: src/pages/stages/StageListPage.ts:88
 #: src/pages/users/UserActiveForm.ts:41
 msgid "Update {0}"
@@ -3750,7 +3777,7 @@ msgstr "User/Group Attribute used for the user part of the HTTP-Basic Header. If
 msgid "Userinfo URL"
 msgstr "Userinfo URL"
 
-#: src/flows/stages/identification/IdentificationStage.ts:142
+#: src/flows/stages/identification/IdentificationStage.ts:150
 #: src/pages/stages/identification/IdentificationStageForm.ts:78
 #: src/pages/user-settings/UserDetailsPage.ts:57
 #: src/pages/users/UserForm.ts:47
@@ -3903,7 +3930,7 @@ msgstr "When selected, incoming assertion's Signatures will be validated against
 msgid "When this option is enabled, all executions of this policy will be logged. By default, only execution errors are logged."
 msgstr "When this option is enabled, all executions of this policy will be logged. By default, only execution errors are logged."
 
-#: src/flows/FlowExecutor.ts:134
+#: src/flows/FlowExecutor.ts:135
 msgid "Whoops!"
 msgstr "Whoops!"
 
diff --git a/web/src/locales/pseudo-LOCALE.po b/web/src/locales/pseudo-LOCALE.po
index 857a494bcc..117acd43b3 100644
--- a/web/src/locales/pseudo-LOCALE.po
+++ b/web/src/locales/pseudo-LOCALE.po
@@ -156,6 +156,10 @@ msgstr ""
 msgid "Allowed count"
 msgstr ""
 
+#: src/pages/sources/plex/PlexSourceForm.ts:119
+msgid "Allowed servers"
+msgstr ""
+
 #: src/pages/sources/saml/SAMLSourceForm.ts:144
 msgid "Allows authentication flows initiated by the IdP. This can be a security risk, as no validation of the request ID is done."
 msgstr ""
@@ -278,6 +282,7 @@ msgid "Authentication"
 msgstr ""
 
 #: src/pages/sources/oauth/OAuthSourceForm.ts:189
+#: src/pages/sources/plex/PlexSourceForm.ts:149
 #: src/pages/sources/saml/SAMLSourceForm.ts:245
 msgid "Authentication flow"
 msgstr ""
@@ -391,8 +396,8 @@ msgstr ""
 msgid "Build hash: {0}"
 msgstr ""
 
-#: src/pages/sources/SourcesListPage.ts:103
-#: src/pages/sources/SourcesListPage.ts:105
+#: src/pages/sources/SourcesListPage.ts:104
+#: src/pages/sources/SourcesListPage.ts:106
 msgid "Built-in"
 msgstr ""
 
@@ -538,6 +543,7 @@ msgstr ""
 
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:107
 #: src/pages/providers/oauth2/OAuth2ProviderViewPage.ts:99
+#: src/pages/sources/plex/PlexSourceForm.ts:113
 msgid "Client ID"
 msgstr ""
 
@@ -738,8 +744,8 @@ msgstr ""
 #: src/pages/providers/ProviderListPage.ts:116
 #: src/pages/providers/RelatedApplicationButton.ts:27
 #: src/pages/providers/RelatedApplicationButton.ts:35
-#: src/pages/sources/SourcesListPage.ts:113
-#: src/pages/sources/SourcesListPage.ts:122
+#: src/pages/sources/SourcesListPage.ts:114
+#: src/pages/sources/SourcesListPage.ts:123
 #: src/pages/stages/StageListPage.ts:119
 #: src/pages/stages/StageListPage.ts:128
 #: src/pages/stages/invitation/InvitationListPage.ts:77
@@ -836,7 +842,7 @@ msgstr ""
 #: src/pages/policies/PolicyListPage.ts:136
 #: src/pages/property-mappings/PropertyMappingListPage.ts:125
 #: src/pages/providers/ProviderListPage.ts:119
-#: src/pages/sources/SourcesListPage.ts:125
+#: src/pages/sources/SourcesListPage.ts:126
 #: src/pages/stages/StageListPage.ts:131
 msgid "Create {0}"
 msgstr ""
@@ -892,7 +898,7 @@ msgstr ""
 #: src/pages/policies/PolicyListPage.ts:115
 #: src/pages/property-mappings/PropertyMappingListPage.ts:104
 #: src/pages/providers/ProviderListPage.ts:98
-#: src/pages/sources/SourcesListPage.ts:94
+#: src/pages/sources/SourcesListPage.ts:95
 #: src/pages/stages/StageListPage.ts:110
 #: src/pages/stages/invitation/InvitationListPage.ts:68
 #: src/pages/stages/prompt/PromptListPage.ts:87
@@ -1000,7 +1006,7 @@ msgstr ""
 msgid "Disable Time-based OTP"
 msgstr ""
 
-#: src/pages/sources/SourcesListPage.ts:63
+#: src/pages/sources/SourcesListPage.ts:64
 msgid "Disabled"
 msgstr ""
 
@@ -1041,7 +1047,7 @@ msgstr ""
 #: src/pages/providers/oauth2/OAuth2ProviderViewPage.ts:128
 #: src/pages/providers/proxy/ProxyProviderViewPage.ts:127
 #: src/pages/providers/saml/SAMLProviderViewPage.ts:121
-#: src/pages/sources/SourcesListPage.ts:82
+#: src/pages/sources/SourcesListPage.ts:83
 #: src/pages/sources/ldap/LDAPSourceViewPage.ts:105
 #: src/pages/sources/oauth/OAuthSourceViewPage.ts:125
 #: src/pages/sources/saml/SAMLSourceViewPage.ts:111
@@ -1078,7 +1084,7 @@ msgstr ""
 msgid "Either no applications are defined, or you don't have access to any."
 msgstr ""
 
-#: src/flows/stages/identification/IdentificationStage.ts:138
+#: src/flows/stages/identification/IdentificationStage.ts:146
 #: src/pages/events/TransportForm.ts:46
 #: src/pages/stages/identification/IdentificationStageForm.ts:81
 #: src/pages/user-settings/UserDetailsPage.ts:71
@@ -1091,7 +1097,7 @@ msgstr ""
 msgid "Email address"
 msgstr ""
 
-#: src/flows/stages/identification/IdentificationStage.ts:145
+#: src/flows/stages/identification/IdentificationStage.ts:153
 msgid "Email or username"
 msgstr ""
 
@@ -1128,6 +1134,7 @@ msgstr ""
 #: src/pages/policies/PolicyBindingForm.ts:199
 #: src/pages/sources/ldap/LDAPSourceForm.ts:69
 #: src/pages/sources/oauth/OAuthSourceForm.ts:115
+#: src/pages/sources/plex/PlexSourceForm.ts:102
 #: src/pages/sources/saml/SAMLSourceForm.ts:69
 msgid "Enabled"
 msgstr ""
@@ -1137,6 +1144,7 @@ msgid "Enrollment"
 msgstr ""
 
 #: src/pages/sources/oauth/OAuthSourceForm.ts:210
+#: src/pages/sources/plex/PlexSourceForm.ts:170
 #: src/pages/sources/saml/SAMLSourceForm.ts:266
 #: src/pages/stages/identification/IdentificationStageForm.ts:106
 msgid "Enrollment flow"
@@ -1349,16 +1357,19 @@ msgid "Flow Overview"
 msgstr ""
 
 #: src/pages/sources/oauth/OAuthSourceForm.ts:185
+#: src/pages/sources/plex/PlexSourceForm.ts:145
 #: src/pages/sources/saml/SAMLSourceForm.ts:220
 msgid "Flow settings"
 msgstr ""
 
 #: src/pages/sources/oauth/OAuthSourceForm.ts:207
+#: src/pages/sources/plex/PlexSourceForm.ts:167
 #: src/pages/sources/saml/SAMLSourceForm.ts:263
 msgid "Flow to use when authenticating existing users."
 msgstr ""
 
 #: src/pages/sources/oauth/OAuthSourceForm.ts:228
+#: src/pages/sources/plex/PlexSourceForm.ts:188
 #: src/pages/sources/saml/SAMLSourceForm.ts:284
 msgid "Flow to use when enrolling new users."
 msgstr ""
@@ -1402,7 +1413,7 @@ msgstr ""
 msgid "Forgot password?"
 msgstr ""
 
-#: src/flows/stages/identification/IdentificationStage.ts:124
+#: src/flows/stages/identification/IdentificationStage.ts:132
 msgid "Forgot username or password?"
 msgstr ""
 
@@ -1502,6 +1513,7 @@ msgstr ""
 #: src/pages/providers/saml/SAMLProviderForm.ts:177
 #: src/pages/sources/ldap/LDAPSourceForm.ts:167
 #: src/pages/sources/ldap/LDAPSourceForm.ts:193
+#: src/pages/sources/plex/PlexSourceForm.ts:132
 #: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts:114
 #: src/pages/stages/identification/IdentificationStageForm.ts:85
 #: src/pages/stages/password/PasswordStageForm.ts:86
@@ -1684,9 +1696,13 @@ msgstr ""
 msgid "Library"
 msgstr ""
 
+#: src/pages/sources/plex/PlexSourceForm.ts:137
+msgid "Load servers"
+msgstr ""
+
 #: src/elements/table/Table.ts:120
-#: src/flows/FlowExecutor.ts:167
-#: src/flows/FlowExecutor.ts:213
+#: src/flows/FlowExecutor.ts:168
+#: src/flows/FlowExecutor.ts:216
 #: src/flows/access_denied/FlowAccessDenied.ts:27
 #: src/flows/stages/authenticator_static/AuthenticatorStaticStage.ts:43
 #: src/flows/stages/authenticator_totp/AuthenticatorTOTPStage.ts:33
@@ -1697,7 +1713,7 @@ msgstr ""
 #: src/flows/stages/consent/ConsentStage.ts:28
 #: src/flows/stages/dummy/DummyStage.ts:27
 #: src/flows/stages/email/EmailStage.ts:26
-#: src/flows/stages/identification/IdentificationStage.ts:171
+#: src/flows/stages/identification/IdentificationStage.ts:179
 #: src/flows/stages/password/PasswordStage.ts:31
 #: src/flows/stages/prompt/PromptStage.ts:126
 #: src/pages/applications/ApplicationViewPage.ts:43
@@ -1742,6 +1758,8 @@ msgstr ""
 #: src/pages/sources/oauth/OAuthSourceForm.ts:177
 #: src/pages/sources/oauth/OAuthSourceForm.ts:205
 #: src/pages/sources/oauth/OAuthSourceForm.ts:226
+#: src/pages/sources/plex/PlexSourceForm.ts:165
+#: src/pages/sources/plex/PlexSourceForm.ts:186
 #: src/pages/sources/saml/SAMLSourceForm.ts:126
 #: src/pages/sources/saml/SAMLSourceForm.ts:240
 #: src/pages/sources/saml/SAMLSourceForm.ts:261
@@ -1772,7 +1790,7 @@ msgstr ""
 msgid "Login password is synced from LDAP into authentik automatically. Enable this option only to write password changes in authentik back to LDAP."
 msgstr ""
 
-#: src/flows/stages/identification/IdentificationStage.ts:183
+#: src/flows/stages/identification/IdentificationStage.ts:191
 msgid "Login to continue to {0}."
 msgstr ""
 
@@ -1905,11 +1923,12 @@ msgstr ""
 #: src/pages/providers/saml/SAMLProviderForm.ts:53
 #: src/pages/providers/saml/SAMLProviderImportForm.ts:38
 #: src/pages/providers/saml/SAMLProviderViewPage.ts:66
-#: src/pages/sources/SourcesListPage.ts:51
+#: src/pages/sources/SourcesListPage.ts:52
 #: src/pages/sources/ldap/LDAPSourceForm.ts:54
 #: src/pages/sources/ldap/LDAPSourceViewPage.ts:64
 #: src/pages/sources/oauth/OAuthSourceForm.ts:100
 #: src/pages/sources/oauth/OAuthSourceViewPage.ts:64
+#: src/pages/sources/plex/PlexSourceForm.ts:87
 #: src/pages/sources/saml/SAMLSourceForm.ts:54
 #: src/pages/sources/saml/SAMLSourceViewPage.ts:66
 #: src/pages/stages/StageListPage.ts:65
@@ -1949,7 +1968,7 @@ msgstr ""
 msgid "NameID Property Mapping"
 msgstr ""
 
-#: src/flows/stages/identification/IdentificationStage.ts:119
+#: src/flows/stages/identification/IdentificationStage.ts:127
 msgid "Need an account?"
 msgstr ""
 
@@ -2340,7 +2359,7 @@ msgstr ""
 msgid "Post binding (auto-submit)"
 msgstr ""
 
-#: src/flows/FlowExecutor.ts:255
+#: src/flows/FlowExecutor.ts:258
 msgid "Powered by authentik"
 msgstr ""
 
@@ -2404,6 +2423,7 @@ msgstr ""
 #: src/pages/providers/proxy/ProxyProviderForm.ts:123
 #: src/pages/providers/saml/SAMLProviderForm.ts:78
 #: src/pages/sources/oauth/OAuthSourceForm.ts:122
+#: src/pages/sources/plex/PlexSourceForm.ts:109
 #: src/pages/sources/saml/SAMLSourceForm.ts:76
 msgid "Protocol settings"
 msgstr ""
@@ -2594,7 +2614,7 @@ msgstr ""
 msgid "Retry authentication"
 msgstr ""
 
-#: src/flows/FlowExecutor.ts:145
+#: src/flows/FlowExecutor.ts:146
 msgid "Return"
 msgstr ""
 
@@ -2702,7 +2722,7 @@ msgstr ""
 msgid "Select an identification method."
 msgstr ""
 
-#: src/flows/stages/identification/IdentificationStage.ts:134
+#: src/flows/stages/identification/IdentificationStage.ts:142
 msgid "Select one of the sources below to login."
 msgstr ""
 
@@ -2714,6 +2734,10 @@ msgstr ""
 msgid "Select which scopes can be used by the client. The client stil has to specify the scope to access the data."
 msgstr ""
 
+#: src/pages/sources/plex/PlexSourceForm.ts:131
+msgid "Select which server a user has to be a member of to be allowed to authenticate."
+msgstr ""
+
 #: src/pages/events/RuleForm.ts:92
 msgid "Select which transports should be used to notify the user. If none are selected, the notification will only be shown in the authentik UI."
 msgstr ""
@@ -2812,7 +2836,7 @@ msgstr ""
 msgid "Shown as the Title in Flow pages."
 msgstr ""
 
-#: src/flows/stages/identification/IdentificationStage.ts:120
+#: src/flows/stages/identification/IdentificationStage.ts:128
 msgid "Sign up."
 msgstr ""
 
@@ -2846,16 +2870,17 @@ msgstr ""
 #: src/pages/flows/FlowForm.ts:94
 #: src/pages/sources/ldap/LDAPSourceForm.ts:60
 #: src/pages/sources/oauth/OAuthSourceForm.ts:106
+#: src/pages/sources/plex/PlexSourceForm.ts:93
 #: src/pages/sources/saml/SAMLSourceForm.ts:60
 msgid "Slug"
 msgstr ""
 
-#: src/flows/FlowExecutor.ts:138
+#: src/flows/FlowExecutor.ts:139
 msgid "Something went wrong! Please try again later."
 msgstr ""
 
 #: src/pages/providers/ProviderListPage.ts:91
-#: src/pages/sources/SourcesListPage.ts:87
+#: src/pages/sources/SourcesListPage.ts:88
 msgid "Source"
 msgstr ""
 
@@ -2864,11 +2889,11 @@ msgid "Source {0}"
 msgstr ""
 
 #: src/interfaces/AdminInterface.ts:20
-#: src/pages/sources/SourcesListPage.ts:30
+#: src/pages/sources/SourcesListPage.ts:31
 msgid "Sources"
 msgstr ""
 
-#: src/pages/sources/SourcesListPage.ts:33
+#: src/pages/sources/SourcesListPage.ts:34
 msgid "Sources of identities, which can either be synced into authentik's database, like LDAP, or can be used by users to authenticate and enroll themselves, like OAuth and social logins"
 msgstr ""
 
@@ -3065,6 +3090,7 @@ msgstr ""
 
 #: src/pages/sources/ldap/LDAPSourceForm.ts:47
 #: src/pages/sources/oauth/OAuthSourceForm.ts:51
+#: src/pages/sources/plex/PlexSourceForm.ts:60
 #: src/pages/sources/saml/SAMLSourceForm.ts:47
 msgid "Successfully created source."
 msgstr ""
@@ -3201,6 +3227,7 @@ msgstr ""
 
 #: src/pages/sources/ldap/LDAPSourceForm.ts:44
 #: src/pages/sources/oauth/OAuthSourceForm.ts:48
+#: src/pages/sources/plex/PlexSourceForm.ts:57
 #: src/pages/sources/saml/SAMLSourceForm.ts:44
 msgid "Successfully updated source."
 msgstr ""
@@ -3452,7 +3479,7 @@ msgstr ""
 #: src/pages/policies/PolicyListPage.ts:57
 #: src/pages/property-mappings/PropertyMappingListPage.ts:55
 #: src/pages/providers/ProviderListPage.ts:54
-#: src/pages/sources/SourcesListPage.ts:52
+#: src/pages/sources/SourcesListPage.ts:53
 #: src/pages/stages/prompt/PromptForm.ts:97
 #: src/pages/stages/prompt/PromptListPage.ts:48
 msgid "Type"
@@ -3531,7 +3558,7 @@ msgstr ""
 #: src/pages/providers/oauth2/OAuth2ProviderViewPage.ts:118
 #: src/pages/providers/proxy/ProxyProviderViewPage.ts:117
 #: src/pages/providers/saml/SAMLProviderViewPage.ts:111
-#: src/pages/sources/SourcesListPage.ts:69
+#: src/pages/sources/SourcesListPage.ts:70
 #: src/pages/sources/ldap/LDAPSourceViewPage.ts:95
 #: src/pages/sources/oauth/OAuthSourceViewPage.ts:115
 #: src/pages/sources/saml/SAMLSourceViewPage.ts:101
@@ -3634,7 +3661,7 @@ msgstr ""
 #: src/pages/policies/PolicyListPage.ts:80
 #: src/pages/property-mappings/PropertyMappingListPage.ts:69
 #: src/pages/providers/ProviderListPage.ts:76
-#: src/pages/sources/SourcesListPage.ts:72
+#: src/pages/sources/SourcesListPage.ts:73
 #: src/pages/stages/StageListPage.ts:88
 #: src/pages/users/UserActiveForm.ts:41
 msgid "Update {0}"
@@ -3738,7 +3765,7 @@ msgstr ""
 msgid "Userinfo URL"
 msgstr ""
 
-#: src/flows/stages/identification/IdentificationStage.ts:142
+#: src/flows/stages/identification/IdentificationStage.ts:150
 #: src/pages/stages/identification/IdentificationStageForm.ts:78
 #: src/pages/user-settings/UserDetailsPage.ts:57
 #: src/pages/users/UserForm.ts:47
@@ -3891,7 +3918,7 @@ msgstr ""
 msgid "When this option is enabled, all executions of this policy will be logged. By default, only execution errors are logged."
 msgstr ""
 
-#: src/flows/FlowExecutor.ts:134
+#: src/flows/FlowExecutor.ts:135
 msgid "Whoops!"
 msgstr ""