Zitadel

What is Zitadel?

Zitadel is an open source identity and access management (IAM) platform that handles login, single sign-on, and authorization for your apps and APIs. Written in Go with a PostgreSQL backend, it gives you certified OpenID Connect, SAML, passkeys, and multi-factor auth as a service you host yourself or run on Zitadel Cloud.

What is Zitadel best for?

Zitadel is best for teams building multi-tenant B2B SaaS who want organizations, delegated admin, and per-tenant branding as first-class concepts rather than bolt-ons. Its API-first design (gRPC, ConnectRPC, and REST for every resource) and built-in event-sourced audit trail also suit developers automating identity infrastructure and organizations with strict compliance and auditability requirements.

What can Zitadel do?

• Standards-based SSO — certified OpenID Connect, OAuth 2.x, and SAML 2.0, plus LDAP connectivity for enterprise directories.
• Passwordless and MFA — passkeys (FIDO2/WebAuthn), OTP, U2F, and email/SMS second factors.
• Native multi-tenancy — B2B organizations with infrastructure-level separation, self-service registration, and delegated role management.
• Machine-to-machine auth — service accounts, token exchange, and impersonation for backend and automation flows.
• Complete audit trail — an event stream capturing the full mutation history of every object.
• Per-organization branding — custom domains, login themes, and policies scoped to each tenant.
• Deploy anywhere — Docker Compose, Kubernetes, or a managed cloud in US, EU, AU, and CH regions.

Where does Zitadel fall short?

Since v3, the main repository is licensed AGPL-3.0 (with Apache/MIT carve-outs for SDKs) rather than the permissive Apache 2.0 that Keycloak uses. If you modify Zitadel and offer it as a hosted service, the AGPL requires you to release your changes — or buy an enterprise license — which is a real consideration for commercial products embedding it.

Its ecosystem is also younger and smaller than Keycloak’s, so you’ll find fewer third-party guides, community extensions, and battle-tested integrations. And customization runs through Zitadel’s APIs and configuration rather than a pluggable extension system, so deeply bespoke authentication logic can be harder to graft on than with Keycloak’s SPI model.

Is Zitadel free?

Yes — self-hosting Zitadel is free and open source under AGPL-3.0; you run it on your own PostgreSQL and pay nothing for the software. Zitadel Cloud, the managed option, has a free tier ($0/month, up to 100 daily active users), a Pro plan from $100/month (up to 25,000 DAU with custom domain and a 99.5% uptime SLA), and custom Enterprise pricing for cloud or your own infrastructure.

What does Zitadel replace?

Zitadel is a self-hostable stand-in for hosted identity providers — an Auth0 alternative, an Okta alternative, and a Microsoft Entra ID alternative. It covers the same core ground — SSO, social and enterprise login, MFA, and user management — while keeping the data and deployment under your control. Among open source options it competes most directly with Keycloak and Authentik.

FAQ

Is Zitadel open source? Yes. The main repository is on GitHub under AGPL-3.0 (v3 onward), with Apache 2.0 and MIT exceptions for SDKs and selected directories. Earlier versions were Apache 2.0.

Can I self-host Zitadel for free? Yes. The self-hosted platform is free under AGPL-3.0. You provide the infrastructure — Zitadel plus PostgreSQL 14+ — via Docker Compose, Kubernetes, or a bare install, and pay only for hosting.

Is Zitadel a good Auth0 alternative? For teams that want to own their identity data and avoid per-user cloud pricing, yes — it delivers certified OIDC, SAML, passkeys, and native multi-tenant organizations. Auth0 still leads on breadth of prebuilt integrations and marketplace extensions.

What do I need to run Zitadel? A PostgreSQL 14+ database and a container runtime (Docker or Kubernetes). Zitadel’s Go binary is lightweight and runs without separate background workers, keeping the runtime footprint modest.