Zitadel

Zitadel is a cloud-native identity and access management platform from Zitadel AG that provides OIDC, OAuth 2.0, SAML 2.0, passkeys, and multi-tenant organization management in a single Go binary. The architecture is event-sourced — every state change is an immutable event in a Postgres event log — with a gRPC and OpenAPI surface for programmatic management.

What it does

Zitadel operates as an identity provider for applications that speak OIDC, OAuth 2.0, or SAML 2.0. It issues ID tokens and access tokens, exposes JWKS endpoints for signature validation, handles authorization code and PKCE flows, and supports device code and refresh token grants.

User management covers registration, email and phone verification, password reset, account recovery, and configurable password policies. MFA options include TOTP, SMS, email codes, and WebAuthn passkeys. Social login federates with external IdPs (Google, GitHub, Microsoft, and custom OIDC providers).

The multi-tenant model is organization-first: each organization has its own users, projects, roles, and settings, with cross-organization federation available for enterprise tenants. SCIM provisioning automates user lifecycle from external directories.

Licensing

Apache 2.0 across the product. Zitadel AG operates Zitadel Cloud as a managed hosting option; the self-hosted binary is functionally complete.

Deployment

Single Go binary or Docker container plus Postgres. CockroachDB is supported for multi-region deployments. No Java application server, servlet container, or separate cache tier.

Limitations

• Multi-tenancy is organization-first, which fits SaaS vendors and B2B platforms naturally but requires mapping for pure flat employee-directory use cases.
• The admin UI is capable and improving; teams migrating from Auth0 or Okta sometimes find specific workflows less polished.
• Ecosystem integrations and community examples are smaller than Keycloak's due to Keycloak's longer history.
• Governance is single-vendor rather than foundation-based (Zitadel AG maintains the project); organizations weighing long-term OSS stability typically consider the vendor's commercial model alongside the license.