What it is

Zitadel is an open-source identity and access management platform written in Go and released under the AGPL-3.0 license. It lives in the open-source IAM ecosystem and provides identity infrastructure for developers who need to operate an authentication and authorization layer themselves.

The project addresses the problem of building a production identity stack for SaaS products, B2B platforms, and self-hosted applications without relying only on basic login screens. It provides single sign-on, multi-factor authentication, passkeys, OAuth 2.0, OpenID Connect, SAML, SCIM, and multi-tenancy through an API-first design.

Key capabilities

• Zitadel supports single sign-on, multi-factor authentication, and passkeys, with FIDO2 listed as a project topic.
• It provides OAuth 2.0, OpenID Connect, and SAML flows for authentication and authorization across applications.
• It includes SCIM and a strict multi-tenant hierarchy that scopes data and policy from the identity system to organizations and projects.
• It writes every mutation as an immutable event, giving an API-accessible audit trail that webhooks can stream to external systems.
• It exposes resources through connectRPC, gRPC, and HTTP/JSON APIs, including a V2 REST API example for creating a human user.
• It supports zero-downtime updates and horizontal scaling without external session stores.

Who uses it and how

• Teams building SaaS products use Zitadel to manage organizations, projects, and tenant-scoped policies instead of implementing custom authentication infrastructure.
• B2B platforms use the native multi-tenant model to separate customer organizations and users within one identity system.
• Developers integrate login, user management, and authorization through the V2 REST API, gRPC, or connectRPC endpoints.
• Operators deploy Zitadel with Docker Compose or Kubernetes, or they use ZITADEL Cloud in the United States, European Union, Australia, or Switzerland.
• Operators use the event stream and webhooks to review authentication and identity changes in external systems.

Getting started

Self-hosted users can download the Docker Compose file and .env.example, copy it to .env, and run docker compose up -d --wait. The README also points to Kubernetes guides and a hosted ZITADEL Cloud option.

When to use it — and when not to

Zitadel fits teams that want an open-source, self-hostable IAM platform with multi-tenant organizations, event-based auditing, API-first administration, and the same codebase in ZITADEL Cloud and self-hosted deployments. It may be less suitable for teams that prefer only a hosted identity service or that want to avoid operating a Go-based, AGPL-3.0 platform whose repository metadata shows 1,171 open issues and zero contributors. Compared with FusionAuth, Keycloak, Auth0, and Okta in the README table, Zitadel emphasizes open-source self-hosting, infrastructure-level tenants, native B2B organizations, and an event stream.

# Docker Compose — up and running in under 3 minutes
curl -LO https://raw.githubusercontent.com/zitadel/zitadel/main/deploy/compose/docker-compose.yml \
  && curl -LO https://raw.githubusercontent.com/zitadel/zitadel/main/deploy/compose/.env.example \
  && cp .env.example .env \
  && docker compose up -d --wait

curl -X POST https://$ZITADEL_DOMAIN/v2/users/human \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "username": "[email protected]",
    "profile": { "givenName": "Alice", "familyName": "Smith" },
    "email": { "email": "[email protected]", "sendCode": {} }
  }'