Zitadel
zitadel · Identity & access
GitHub stars
15,472Awaiting first sync
No measured star history yet
What is Zitadel?
ZITADEL handles logins for the apps and products you build, so your team does not have to write its own user system. It covers single sign-on, passkeys and multi-factor login, and works with the standards most business software already supports. Its organisation model suits companies that sell to other businesses and need to keep each customer's users apart.
ZITADEL is an identity and access management platform for securing apps, SaaS products and B2B platforms. It provides single sign-on, multi-factor login, passkeys, OpenID Connect, SAML 2.0 and SCIM, with a multi-tenant model of organisations and projects. Every change is stored as an event for a full audit trail, and every resource has an API.
Core capabilities
- Supports SSO, passkeys, OTP and U2F login, LDAP and social logins.
- Certified OpenID Connect provider with SAML 2.0 and a SCIM 2.0 server.
- Separates customers into organisations with their own users, roles and branding.
Login methods and standards
ZITADEL supports username and password, passkeys based on FIDO2 and WebAuthn, and multi-factor login with OTP, U2F, email codes and SMS codes. It is a certified OpenID Connect provider and also supports SAML 2.0, with device authorisation for TVs and command-line tools. Users can sign in through LDAP, enterprise identity providers or social logins. Token exchange and impersonation are available for support and delegation cases.
- Passkeys
- MFA
- OIDC
- SAML
- SSO
Organisations, audit trail and APIs
Data is arranged in a hierarchy of identity system, organisations and projects, with policies set at several levels. Each organisation can have its own branding, roles and self-service onboarding for B2B customers. Every change is stored as an immutable event that can be read through the API or sent to external systems. All resources can be managed through gRPC, connectRPC and REST APIs.
- Multi-tenancy
- B2B
- Audit trail
- SCIM
- API
Run it yourself under AGPL-3.0
The official Docker Compose file runs the ZITADEL API, the Next.js login UI, a Traefik proxy and PostgreSQL, and Kubernetes guides are also published. Redis can be added for caching, and the API can be scaled to several replicas. Before first start you set a 32-character master key, which cannot be changed later. ZITADEL is licensed under AGPL-3.0, with some client and docs folders under Apache-2.0 or MIT, and ZITADEL Cloud is a separate hosted service with free and paid plans.
- Self-hosted
- Docker Compose
- Kubernetes
- PostgreSQL
- AGPL-3.0
Where it fits
Use cases
- 01
Add login and sign-up to your own product
Create a project in the Administration Console and register your app as an OIDC or SAML application. Use the Hosted Login V2 for sign-in, self-registration with email or phone verification, and passkeys. The SDKs and example apps show how to connect common languages and frameworks.
- 02
Give each business customer its own space
Create an organisation for every customer, each with its own users, roles and custom branding. Customers can bring their own identity provider through identity brokering, and domain discovery sends users to the right organisation. Delegated role management lets a customer's admins manage their own people.
- 03
Send identity events to your security tools
ZITADEL writes every change as an immutable event, which forms its audit trail. Stream these events to an external SOC or SIEM tool, or use Actions to call webhooks and enrich tokens. Service accounts can sign in with JWT profile, personal access tokens or client credentials for machine-to-machine access.