README

The Identity Infrastructure for Developers

ZITADEL is an open-source identity and access management platform built for teams that need more than basic auth. Whether you're securing a SaaS product, building a B2B platform, or self-hosting a production IAM stack — ZITADEL gives you everything out of the box: SSO, MFA, Passkeys, OIDC, SAML, SCIM, and a battle-tested multi-tenancy model.

No vendor lock-in. No compromise on control. Just a robust, API-first identity platform you can own.

🏡 Website | 💬 Chat | 📋 Docs | 🧑‍💻 Blog | 📞 Contact

Why ZITADEL

We built ZITADEL to handle the hardest IAM challenges at scale — starting with multi-tenancy.

	ZITADEL	FusionAuth	Keycloak	Auth0/Okta
Open-source	✅	❌	✅	❌
Self-hostable	✅	✅	✅	❌
Infrastructure-level tenants	✅ Instances (High scale)	✅ Tenants	🟡 Realms (Scaling limits)	❌ (Multi-tenant = multi-account)
B2B Organizations	✅ Native & Unlimited	🟡 via Entity Management	✅ (Recent addition)	🟡 (Plan/Account dependent)
Full audit trail	✅ Comprehensive Event Stream*	🟡 Audit logs	🟡 Audit logs	🟡 Audit logs
Passkeys (FIDO2)	✅	✅	✅	✅
Actions / webhooks	✅	✅	🟡 via SPI	✅
API-first (gRPC + REST)	✅	🟡 REST only	🟡 REST only	🟡 REST only
SaaS + self-host parity	✅	✅	➖ N/A	➖ N/A

ZITADEL Cloud and self-hosted ZITADEL run the same codebase.

Key differentiators for architects:

Relational core, event-driven soul — every mutation is written as an immutable event for a complete, API-accessible audit trail. Unlike systems that log only select activities, ZITADEL provides a comprehensive event stream that can be audited or streamed to external systems via Webhooks.
Strict multi-tenant hierarchy — Identity System → Organizations → Projects, with isolated data and policy scoping at multiple levels
API-first design — every resource and action is available via connectRPC, gRPC, and HTTP/JSON APIs
Zero-downtime updates and horizontal scalability without external session stores

Get Started in 3 Minutes

👉 Quick Start Guide

ZITADEL Self-Hosted

bash

# Docker Compose — up and running in under 3 minutes
curl -LO https://raw.githubusercontent.com/zitadel/zitadel/main/deploy/compose/docker-compose.yml \
  && curl -LO https://raw.githubusercontent.com/zitadel/zitadel/main/deploy/compose/.env.example \
  && cp .env.example .env \
  && docker compose up -d --wait

Full deployment guides:

Need professional support for your self-hosted deployment? Contact us.

ZITADEL Cloud (SaaS)

Start for free at zitadel.com — no credit card required. Available in US · EU · AU · CH. Pay-as-you-go pricing.

Integrate with the V2 API

ZITADEL exposes every capability over a typed API. Here's how to create a user with the V2 REST API:

bash

curl -X POST https://$ZITADEL_DOMAIN/v2/users/human \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "username": "[email protected]",
    "profile": { "givenName": "Alice", "familyName": "Smith" },
    "email": { "email": "[email protected]", "sendCode": {} }
  }'

Explore the full API reference — including connectRPC and gRPC transports — or jump straight to quickstart examples.

Features

Authentication

Single Sign On (SSO) · Username/Password · Passkeys (FIDO2 / WebAuthn)
MFA: OTP, U2F, OTP Email, OTP SMS
LDAP · Enterprise IdPs and social logins
OpenID Connect certified · SAML 2.0 · Device authorization
Machine-to-machine: JWT Profile, PAT, Client Credentials
Token exchange and impersonation
Custom sessions for flows beyond OIDC/SAML
Hosted Login V2

Multi-Tenancy

Identity brokering with pre-built IdP templates
Customizable B2B onboarding with self-service for customers
Delegated role management to third parties
Domain discovery

Integration

gRPC, connectRPC, and REST APIs for every resource
Actions: webhooks, custom code, token enrichment
RBAC · SCIM 2.0 Server
Audit log and SOC/SIEM integration
SDKs and example apps

Self-Service & Admin

Self-registration with email/phone verification
Administration Console for orgs and projects
Custom branding per organization

Deployment

PostgreSQL (≥ 14) · Zero-downtime updates · High scalability

Track upcoming features on our roadmap and follow our changelog for recent updates.

Showcase

Our new, fully customizable login experience — documentation

Adopters & Ecosystem

Used in production by organizations worldwide. See the full Adopters list — and add yours by submitting a pull request.

SDKs: All supported languages and frameworks
Examples: Clone and use our examples

How To Contribute

ZITADEL is built in the open and welcoming to contributions of all kinds.

📖 Read the Contribution Guide to get started
💬 Join the conversation on Discord
🐛 Report bugs or request features via GitHub Issues

Contributors

Made with contrib.rocks.

Security

Security policy: SECURITY.md

Vulnerability Disclosure Policy — how to responsibly report security issues.

Technical Advisories are published for major issues that could impact security or stability in production.

License

AGPL-3.0 — see LICENSING.md for the full licensing policy, including Apache 2.0 and MIT exceptions for specific directories.