ZITADEL ORG

Identity infrastructure, simplified for you.

88 repos
477 followers
0 following

TypeScript 44%
Go 17%
Python 10%
PHP 6%
HTML 4%

The Identity Infrastructure for Developers ZITADEL is an open-source identity and access management platform built for teams that need more than basic auth. Whether you're securing a SaaS product, building…

The Identity Infrastructure for Developers

ZITADEL is an open-source identity and access management platform built for teams that need more than basic auth. Whether you're securing a SaaS product, building a B2B platform, or self-hosting a production IAM stack — ZITADEL gives you everything out of the box: SSO, MFA, Passkeys, OIDC, SAML, SCIM, and a battle-tested multi-tenancy model.

No vendor lock-in. No compromise on control. Just a robust, API-first identity platform you can own.

---

🏡 Website  |  💬 Chat  |  📋 Docs  |  🧑‍💻 Blog  |  📞 Contact

---

Why ZITADEL

We built ZITADEL to handle the hardest IAM challenges at scale — starting with multi-tenancy.

| | ZITADEL | FusionAuth | Keycloak | Auth0/Okta |
|---|---|---|---|---|
| Open-source | ✅ | ❌ | ✅ | ❌ |
| Self-hostable | ✅ | ✅ | ✅ | ❌ |
| Infrastructure-level tenants | ✅ Instances (High scale) | ✅ Tenants | 🟡 Realms (Scaling limits) | ❌ (Multi-tenant = multi-account) |
| B2B Organizations | ✅ Native & Unlimited | 🟡 via Entity Management | ✅ (Recent addition) | 🟡 (Plan/Account dependent) |
| Full audit trail | ✅ Comprehensive Event Stream* | 🟡 Audit logs | 🟡 Audit logs | 🟡 Audit logs |
| Passkeys (FIDO2) | ✅ | ✅ | ✅ | ✅ |
| Actions / webhooks | ✅ | ✅ | 🟡 via SPI | ✅ |
| API-first (gRPC + REST) | ✅ | 🟡 REST only | 🟡 REST only | 🟡 REST only |
| SaaS + self-host parity | ✅ | ✅ | ➖ N/A | ➖ N/A |

ZITADEL Cloud and self-hosted ZITADEL run the same codebase.

Key differentiators for architects:

Relational core, event-driven soul — every mutation is written as an immutable event for a complete, API-accessible audit trail. Unlike systems that log only select activities, ZITADEL provides a comprehensive event stream that can be audited or streamed to external systems via Webhooks.
Strict multi-tenant hierarchy — Identity System → Organizations → Projects, with isolated data and policy scoping at multiple levels
API-first design — every resource and action is available via connectRPC, gRPC, and HTTP/JSON APIs
Zero-downtime updates and horizontal scalability without external session stores

---

Get Started in 3 Minutes

👉 Quick Start Guide

ZITADEL Self-Hosted

bash
# Docker Compose — up and running in under 3 minutes
curl -LO https://raw.githubusercontent.com/zitadel/zitadel/main/deploy/compose/docker-compose.yml \
  &amp;&amp; curl -LO https://raw.githubusercontent.com/zitadel/zitadel/main/deploy/compose/.env.example \
  &amp;&amp; cp .env.example .env \
  &amp;&amp; docker compose up -d --wait

Full deployment guides:

> Need professional support for your self-hosted deployment? Contact us.

ZITADEL Cloud (SaaS)

Start for free at zitadel.com — no credit card required. Available in US · EU · AU · CH. Pay-as-you-go pricing.

---

Integrate with the V2 API

ZITADEL exposes every capability over a typed API. Here's how to create a user with the V2 REST API:

bash
curl -X POST https://$ZITADEL_DOMAIN/v2/users/human \
  -H &quot;Authorization: Bearer $ACCESS_TOKEN&quot; \
  -H &quot;Content-Type: application/json&quot; \
  -d &#39;{
    &quot;username&quot;: &quot;[email protected]&quot;,
    &quot;profile&quot;: { &quot;givenName&quot;: &quot;Alice&quot;, &quot;familyName&quot;: &quot;Smith&quot; },
    &quot;email&quot;: { &quot;email&quot;: &quot;[email protected]&quot;, &quot;sendCode&quot;: {} }
  }&#39;

Explore the full API reference — including connectRPC and gRPC transports — or jump straight to quickstart examples.

---

Features

Authentication

Single Sign On (SSO) · Username/Password · Passkeys (FIDO2 / WebAuthn)
MFA: OTP, U2F, OTP Email, OTP SMS
LDAP · Enterprise IdPs and social logins
OpenID Connect certified · SAML 2.0 · Device authorization
Machine-to-machine: JWT Profile, PAT, Client Credentials
Token exchange and impersonation
Custom sessions for flows beyond OIDC/SAML
Hosted Login V2

Multi-Tenancy

Identity brokering with pre-built IdP templates
Customizable B2B onboarding with self-service for customers
Delegated role management to third parties
Domain discovery

Integration

gRPC, connectRPC, and REST APIs for every resource
Actions: webhooks, custom code, token enrichment
RBAC · SCIM 2.0 Server
Audit log and SOC/SIEM integration
SDKs and example apps

Self-Service & Admin

Self-registration with email/phone verification
Administration Console for orgs and projects
Custom branding per organization

Deployment

PostgreSQL (≥ 14) · Zero-downtime updates · High scalability

Track upcoming features on our roadmap and follow our changelog for recent updates.

---

Showcase

Login V2

Our new, fully customizable login experience — documentation

---

Adopters & Ecosystem

Used in production by organizations worldwide. See the full [Adopters list](./ADOPTERS.md) — and add yours by submitting a pull request.

SDKs: All supported languages and frameworks
Examples: Clone and use our examples

---

How To Contribute

ZITADEL is built in the open and welcoming to contributions of all kinds.

📖 Read the [Contribution Guide](./CONTRIBUTING.md) to get started
💬 Join the conversation on Discord
🐛 Report bugs or request features via GitHub Issues

Contributors

Made with contrib.rocks.

---

Security

Security policy: [SECURITY.md](./SECURITY.md)

Vulnerability Disclosure Policy — how to responsibly report security issues.

Technical Advisories are published for major issues that could impact security or stability in production.

License

[AGPL-3.0](./LICENSE) — see [LICENSING.md](./LICENSING.md) for the full licensing policy, including Apache 2.0 and MIT exceptions for specific directories.