Delegated access management

Hosted Login

Multifactor Authentication

Passwordless Authentication

Audit Trail

Identity Brokering

Platform

Service Accounts

Features

Easy integration

B2B (Business to Business)

Self Service

Existing identities

Secure authentication

Use Cases

Learn how to install, setup, and use ZITADEL.

Documentation

ZITADEL Cloud

Self-hosting

Trust center

Examples and Guides

Github Repository

Develop

Get Started

Contribute

Roadmap

Changelog

About Us

Jobs

Contact

Company

Read the blog

Sign up

Login

Pricing

Blog

A common task for many developer and security-centric teams is to provide an identity and access management (IAM) service.  Whether that component only consists of a sign-up form and a login page or a more complex infrastructure, the number one priority is always to provide a seamless functionality for your users.  Failure in implementation can have severe consequences. To reduce your risk and feel confident in your IAM platform, partnering seasoned professionals in the space ensures success.

Companies looking for authentication servers have the option to consider the solutions available in the market or build it themselves.  As each option presents its own set of benefits and drawbacks, teams are often overwhelmed to make the right choice.  In this article, we will cover the key pros and cons of each of the two options that help companies make the right decision for both short-term and long-term benefits.

### Benefits of a Custom-built Platform
1.  Built to your needs: Custom-built IAM platforms can be tailored to your organization's specific requirements.  With a custom solution, you have complete control over the user experience and the technology choices. You can design authentication flows that align with your brand and user journey, creating a seamless experience that doesn't feel disconnected from the rest of your application. This customization extends to crucial workflows like user onboarding, password resets, and permission management—all of which can be optimized for your specific use cases rather than following a generic approach.
2. Enterprise Integrations: Enterprise environments often present complex integration challenges that off-the-shelf IAM solutions struggle to address effectively. A custom-built IAM platform can be architected from the ground up to integrate seamlessly with your existing technology ecosystem, regardless of its complexity or uniqueness.
Legacy systems present a particular advantage for custom solutions. While many modern IAM platforms have limited support for older technologies or protocols, a custom solution can be built to bridge these gaps. Whether you're dealing with mainframe applications, custom LDAP schemas, or proprietary single sign-on systems developed in-house decades ago, a custom solution can be tailored to interface with these systems without compromise.
3. Control Over Data and Infrastructure: A custom-built IAM platform puts you in the driver's seat when it comes to data sovereignty and infrastructure decisions. This complete control means your organization retains ownership of user credentials, access patterns, and authentication logs—data that is often among the most sensitive your company manages.
For organizations in regulated industries such as healthcare, finance, or government, this control can become crucial. Custom solutions allow you to construct specific data residency requirements, ensuring user information never leaves particular geographic boundaries or jurisdictions. You can also implement custom encryption schemes that go beyond standard offerings, creating multiple layers of protection for particularly sensitive identity data.
4. No Vendor Lock-in: Building your own IAM platform frees your organization from the constraints of vendor dependencies. This independence means you're not tied to a particular company's business decisions, product roadmap, or pricing strategies. If a vendor decides to sunset a feature your business relies on or dramatically increases licensing costs, organizations using off-the-shelf solutions may find themselves scrambling to adapt.
Custom solutions also shield you from the impacts of acquisitions and mergers in the IAM market, which can often lead to discontinued products or significant changes in service quality and support. With your own platform, you maintain continuity regardless of market fluctuations.
5. Customized Compliance Implementation: Regulatory compliance requirements for identity management vary significantly across industries and regions. A custom IAM platform allows you to design compliance features that precisely address your specific regulatory landscape without unnecessary overhead.
For example, a custom platform can be built with GDPR's right to be forgotten as a core architectural principle rather than an afterthought. Healthcare organizations can design authentication workflows that inherently enforce HIPAA requirements. Financial institutions can implement multi-factor authentication schemas that directly align with specific banking regulations in their operating regions.
### Drawbacks of a Custom-built IAM Platform
While the benefits of custom-built IAM solutions are compelling, they come with significant challenges that organizations must carefully consider. The reality is that identity management is a specialized field requiring deep expertise in security, performance optimization, and regulatory compliance. Building your own platform means taking on the full burden of these complexities—often pulling focus and resources away from your core business objectives. The following drawbacks highlight why many organizations ultimately find that the apparent freedom of a custom solution can become a costly constraint.
1. Security Issues: A significant risk of building your own authentication server lies in its generally higher probability of security issues, which is usually due to a disproportionate time spent on building and not security implementation. Since keeping your users’ data safe is among the greatest responsibilities of the platform and the primary task of an IAM , it is essential to make sure an adequately established security system is given. One of the most obvious advantages specialized vendors have over DIY developers is the possession of a dedicated team with cybersecurity and software engineering expertise. The members of these teams can utilize their knowledge to create the best possible security system based on their diverse experiences.
IAM vendors commonly offer advanced security features, such as support for multi-factor authentication (MFA) and security keys (Yubikey etc.). Another security aspect where third-party IAM solutions prevail is pattern recognition: they can prevent attacks more easily due to their large user base, whereas a custom-made solution does not possess enough data to recognize suspicious patterns.
Keeping up with authentication best practices and standards becomes another insurmountable task for custom-built platforms, whereas IAM vendors can ensure compliance and adherence to standards.
2. Cost of Maintenance: Contrary to popular belief, you will likely find that building your own authentication server is not cheaper in the long run. While you might initially save money, that will quickly be compensated by the cost of development, maintenance, troubleshooting, upgrades, and the resources themselves that are needed for these procedures. Furthermore, you might find that unexpected expenses arise later on in your software’s lifetime: while initially you will likely implement a simple username + password login system, due to the high security requirements of a well-functioning authentication solution, you will most likely need to expand it with more complex features (f.e. Multi-Factor-Authentication, passwordless login options and more social logins).  Also, since your primary business is likely in an unrelated field to the IAM itself, the inevitable shift in your working context would entail additional costs. When considering a custom-built solution, it is therefore beneficial to evaluate if the needed investments over the lifetime of your product are ultimately less than the amount you would have to pay for the one-time fee of the purchasable alternative.  
Add in the scale by a factor of (n) to address a multi-tenancy requirement for each customer with their own settings, and the cost of maintenance grows exponentially.
3. Expensive, in all aspects: When creating anything from scratch, you should probably reckon with a lengthy production process. This not only delays the “time to value” of your business-critical applications as you first need to build the IAM platform before you can make your application available to your users.  This also applies to developing a service; given that authentication solutions require lots of API programming and complicated security features, fully building one might take at least a year as a full-time job. Since this service will handle sensitive data, the development of an adequately functioning security system also involves constant testing and optimizing, which should not be neglected to save time. The need for custom features also extends to the product phases well beyond the initial development: keeping your application functional and up to date requires you to additionally establish a maintenance system that will serve this purpose. Using an already established IAM solution would therefore likely save you several years of time, and money spent on essential resources.

![](https://cdn.sanity.io/images/y3uu7rkl/production/deeec64e2aa7e46f68c8de9addac4090ae2f3c80-2940x1656.png)
*Calculations based on our analysis*
### Benefits of Buying an IAM Platform
While custom-built IAM solutions offer some advantages, after examining the complex challenges of building one, it becomes clear why many organizations ultimately choose to purchase a dedicated IAM platform from specialized vendors. These purpose-built solutions offer numerous advantages that directly address the pain points of custom development.
1. Industry-Leading Security Expertise: Specialized IAM vendors focus exclusively on identity security, employing teams of security experts who dedicate their careers to staying ahead of emerging threats. This concentrated expertise translates into robust security practices that would be difficult for most organizations to replicate internally. Professional IAM solutions typically offer:
Regular security audits and penetration testing with third party partners
Rapid response and mitigation of vulnerabilities
Advanced threat detection and prevention capabilities
Compliance with the latest security standards and best practices and certifications
2. Faster Time to Market: Implementing a pre-built IAM solution dramatically accelerates your deployment timeline. What can typically take months or years to develop in-house can often be set up in weeks or even days with a vendor solution. This quick implementation means:
Your core products and services launch faster
Security enhancements reach your users more quickly
Development resources stay focused on your business differentiators
You realize return on investment sooner
3. Reduced Total Cost of Ownership: While the upfront licensing costs of purchased IAM solutions are visible line items in your budget, they typically represent a fraction of the total cost of building and maintaining a custom platform especially if you factor in the development time. A comprehensive IAM solution hence eliminates:
* Development costs for initial implementation of the security features
* Ongoing expenses for security updates and patching
* Infrastructure and operational overhead, especially for SaaS users
* Costs associated with specialized security talent acquisition and retention
* Expenses related to compliance certification and auditing

![](https://cdn.sanity.io/images/y3uu7rkl/production/6b2ba627a001746cc86e4499c29d15ae5f898fc1-2940x1648.png)

4. Continuous Innovation Without Internal Resources: Professional IAM vendors continuously improve their platforms, incorporating new authentication methods, security enhancements, and usability features as they emerge in the market. This ongoing innovation happens without draining your internal resources, allowing you to:
* Benefit from industry advancements automatically
* Support new standards and protocols without additional development
* Offer cutting-edge security features to your users
* Stay competitive with larger organizations that have more resources
5. Scalability and Reliability: Enterprise-grade IAM platforms are built from the ground up to handle massive scale with exceptional reliability. These solutions typically offer:
* High-availability architectures with redundancy built in
* Elastic scaling to handle usage spikes
* Global distribution for performance optimization
* Proven reliability under extreme load conditions
* Comprehensive monitoring and alerting options
6. Simplified Compliance Management: Managing compliance across multiple regulations (GDPR, HIPAA, SOC2, ISO27001, etc.) requires significant expertise and ongoing attention. Dedicated IAM platforms typically:
* Maintain compliance certifications so you don't have to
* Provide detailed audit logs and reporting
* Offer pre-built compliance frameworks for various industries
* Stay updated with evolving regulatory requirements
* Simplify your compliance audits with ready documentation
7. Professional Support and Expertise On-Demand: When issues arise (as they inevitably do), having access to specialized support can mean the difference between minor inconvenience and major business disruption. Established IAM vendors provide:
* 24/7 technical support from identity specialists
* Comprehensive documentation and implementation guides
* Professional services for complex deployments
* User community and knowledge sharing
* Training and certification programs


![](https://cdn.sanity.io/images/y3uu7rkl/production/18106bcce85f266ce752a3e24d3d7cba3b115fd6-2940x1654.png)

### Bringing the Best of Both Worlds with Zitadel 
Zitadel delivers enterprise-grade identity and access management without the development overhead of building your own solution from scratch. Unlike custom-built IAM systems that require significant engineering resources, ongoing maintenance, and security expertise, Zitadel provides a battle-tested, comprehensive solution out of the box. 
With Zitadel, organizations gain immediate access to modern authentication protocols, multi-tenancy support, robust user management, and authorization controls —all while avoiding the hidden costs, security vulnerabilities, and compliance challenges that often plague homegrown IAM implementations. By choosing Zitadel, your team can focus on core business objectives rather than reinventing complex identity infrastructure.
1. Developer-first, multi-tenant platform: As a developer-first multi-tenant platform, Zitadel gives you custom-level control with turnkey implementation - offering intuitive APIs, comprehensive SDKs, and detailed documentation that drastically reduces development resources while supporting complex multi-organization structures that would typically require months of custom coding. You can even build your own custom login UI using Zitadel's APIs while relying on its battle-tested security and standards implementation behind the scenes.
2. Flexible deployment: Zitadel offers the data sovereignty of custom solutions without the infrastructure burden. You have the ability to choose between the convenience of Zitadel Cloud with its zero-maintenance approach or the control of self-hosting in your own infrastructure - either way, you maintain full ownership of your identity data without the ongoing operational costs of a custom-built IAM platform.
3. Extensibility and Enterprise Integrations: Zitadel delivers adaptability at the level of a custom-built solution without the associated complexity of a custom-built IAM solution. Its extensive extensibility and enterprise integrations ensure seamless connection to your existing ecosystem through webhooks, actions, and pre-built connectors for enterprise systems, allowing for the same customization you get from building in-house without forking code, managing separate codebases, or compromising security.
### Get Started
Get started with  Zitadel, the comprehensive, ready-to-deploy Identity and Access Management platform  rather than building one from scratch. We offer the ideal authentication platform with flexible pricing, a variety of deployment options, extensive features, enterprise-grade security, and unlimited identities across all instances.

Have questions about authentication or anything else? Connect with us on the [Zitadel Discord Server](https://zitadel.com/chat). You can also find us on [LinkedIn](https://www.linkedin.com/company/zitadel/), [GitHub](https://github.com/caos/zitadel), [Bluesky](https://bsky.app/profile/zitadel.com), [Twitter](https://twitter.com/zitadel) or through our [website](https://zitadel.com/).

If you appreciate our work, please consider [giving us a star on GitHub](https://github.com/zitadel/zitadel). We value your support!

The Zitadel Identity and Access Management (IAM) platform offers a turnkey enterprise-grade platform for cloud-native organizations looking to move away from a custom-built IAM platform with modules that are expensive to maintain.

Stop Building and Maintaining Frankenstein IAM Platforms

When choosing the right authentication provider for your application it can be hard to narrow down one that works not just for your organization internally but also for your customer and partners. Recognizing the diverse needs of a modern identity management system that is both flexible and secure can become an overwhelming task, especially in a market that offers a plethora of alternatives. That’s why it is important to understand the value proposition of the vendor offerings and evaluate how they fit your organizational requirements.

In this article, we will compare and contrast two open source alternatives - Keycloak and Zitadel.

## What is Keycloak and Zitadel
### Keycloak
Keycloak is an Open Source Identity and Access Management platform built for the foundational commercial solution “Red Hat Single Sign-On” that serves both the Business to Business (B2B) and Business to Consumer (B2C) markets. Keycloak was initially developed by WildFly, a division of Red Hat and was adopted to the [Cloud Native Computing Foundation](https://www.cncf.io/projects/keycloak/) (CNCF) on April 10, 2023 as an incubation project. Keycloak has been maintained by the CNCF community ever since. It brings functions like identity-brokering, multi-factor / passwordless authentication, access management, OpenID Connect, OAuth 2.0, SAML 2.0, and to some degree, multi-tenancy.

### Zitadel
Zitadel is an API-first identity platform that is built for developers. It offers easier integration into your tech stack to support the authentication, authorization, and self-service needs.  Extended as an open source and a commercial solution, it also provides a long-term audit trail out-of-the-box to ensure the security and compliance posture for your organization. Zitadel provides free and cloud subscription tiers, along with a self-hosted version for organizations that require complete data ownership. Zitadel’s comprehensive identity platform supports business-to-business (B2B) use cases including multi-tenancy, identity brokering, multi-factor or passwordless authentication, delegated access management, and in-context audit trail. Zitadel supports the standard integration protocols such as OpenID Connect, SAML 2.0, and OAuth 2.0.

## Main Differences
### Source Code
Keycloak leverages the open source friendly Apache 2.0 license on their platform repository. This license is catered towards community support and common across the open source  landscape. Up to version 2, Zitadel leveraged the Apache 2.0 license but will transition to the GNU Affero General Public License v3.0 (AGPL-3.0) with the upcoming version 3. The AGPL license ensures that any modifications to Zitadel need to be made available to the community. This creates a more reciprocal relationship between Zitadel and organizations that leverage and build upon our platform. It protects the open nature of our project while encouraging contributions back to the community.

For most of Zitadel’s community, this change will have minimal impact:

* **For end-users**: If you are only using Zitadel as an identity platform, the license change doesn't affect you.
* **For contributors**: Your future contributions will be licensed under AGPL-3.0 and we will introduce a contributor license agreement (CLA).
* **For service providers**: If you modify Zitadel and provide it as a service to others, you'll need to make your modifications available under the AGPL-3.0 license.
* **For developers**: If you are using our Examples, Libraries, SDKs, APIs, do not worry we will keep those under their existing license.

Our commercial licensing options remain available for organizations that require different terms. Please reach out to us if you have any questions about licensing, we have compiled a detailed [blog post](https://zitadel.com/blog/apache-to-agpl) and an [FAQ](https://zitadel.com/license-faq) for you.

### Operating Model
Self-hosting is easy with either Keycloak and Zitadel. While choosing a platform is important, both solutions have the ability to use custom-built operators for Kubernetes to install and operate the Identity and Access Management (IAM) solution. 

In addition, Zitadel offers the ability to run your instance in the cloud, managed by Zitadel directly. There is a wide range of managed service providers for Keycloak from managed instances to extensions.

If you are evaluating between cloud or self-hosting options, we recently wrote a blog post laying out the pros and cons of the [self-hosting and cloud approaches](https://zitadel.com/blog/cloud-or-selfhosted).

### Pricing
With open source as a driving force for Keycloak and Zitadel, the code is freely available on GitHub. However in the case of Keycloak, the community is the only contributor to their product ecosystem. Red Hat does offer a paid service “Red Hat Single Sign-On” leveraging Keycloak. 

Zitadel’s pricing model is tailored to your organization’s needs, focusing on three core elements: Support Level Agreements (SLA), Daily Active Users (DAUs), and Technical Account Management (TAM). We include essential features such as multifactor authentication and passkeys at no additional cost, and we don’t charge based on the total number of users stored in your system.

### Project Structure
Zitadel has a unique way to group clients that belong to the same security context into what we call “Project”. Projects help users bundle together clients, for example a web-application and a mobile-application, that share the same authorization mechanics. This ensures developers see consistent results across all clients without needing to manually configure audience scopes. The project allows you to delegate the access control and permission management to a third party. More details on how our “project grants” work [are here](https://zitadel.com/docs/apis/resources/mgmt/project-grants).

Keycloak historically has used a tenancy model that was constructed around the idea of realms as means of separation of concern for close to all resources, including users, clients, roles, policies and so on. In the summer of 2024, Keycloak announced a change in their project structure with the addition of [Organizations](https://www.keycloak.org/2024/06/announcement-keycloak-organizations). This enables support for multi-tenancy through the Organization management model and its inherent members.

### Self-service
Keycloak and Zitadel both offer extensive self-service capabilities including user profile management, access control delegation, and the ability for business customers to configure their own identity providers.

### Data Residency
Both Zitadel and Keycloak empower organizations with data residency through their self hosted solutions. With Zitadel, enterprise customers choose self-hosted deployments to maintain maximum control over their infrastructure and data governance. 

For strict data residency requirements, Zitadel supports regional cloud hosting and self-hosted deployments, giving organizations complete control over their data location and security protocols. Zitadel offers flexible data residency options with hosting regions in the United States, Europe, Switzerland, or Australia. Keycloak also has unaffiliated third parties that offer cloud hosting for prospective customers.

### Location Of Incorporation
Keycloak is a CNCF steered project which is not incorporated per se. They rely on their distributed developer community to maintain and drive their open source project forward. With headquarters in the United States and a principal office in Switzerland, Zitadel provides flexible contracting options through its dual-entity structure. Organizations serving European Union customers can contract through Zitadel's Swiss entity, leveraging Switzerland's data protection adequacy status granted by the European Commission. This simplifies EU data transfer compliance compared to the more complex requirements for US-based providers.

### Extensibility
Keycloak’s extensibility relies on Service Provider Interfaces (SPI) to fill customers' technical needs; otherwise custom code becomes a necessity.  This creates the risk of maintaining and upgrading Keycloak's environment.

Zitadel’s event-driven architecture enables organizations to customize workflows by responding to any authentication or audit event. The Zitadel platform’s [Session API](https://zitadel.com/docs/apis/v2) and Login Experience features offer extensive customization options for both functionality and branding to align with your organization’s requirements. As a fast-growing open-source company, Zitadel rapidly incorporates customer feedback through strategic partnerships and contributions on GitHub.

![](https://cdn.sanity.io/images/y3uu7rkl/production/e49d52a11a0387798a318d1eabcaf8d2d25adea4-1024x768.png)

## What’s Next for Zitadel: Development Priorities for 2025
Zitadel maintains a [public product roadmap](https://zitadel.com/roadmap) and operates with full transparency as an open-source platform. It includes significant feature releases planned for platform development and performance optimization in 2025.

* **Performance Optimization**: Comprehensive platform-wide performance enhancements that focus on core authentication service response times, API endpoint optimization across new and existing services, enhanced resource management efficiency, and improved system scalability. 
* **TypeScript Login with OIDC**: A new, highly customizable login interface for our customers, built in with [TypeScript and OpenID Connect](https://zitadel.com/blog/typescript-login) support. Self-hosting customers will soon be able to use the hosted login option with OIDC.
* **User Schema Management**: This feature offers [advanced user profile customization](https://github.com/zitadel/zitadel/issues/8140) enabling granular control over field management permissions between users and administrators. 
* **Configurable Caching System**: Beta release of [flexible caching](https://zitadel.com/docs/self-hosting/manage/cache) infrastructure supporting Redis integration for improved object lookup performance.
*  **SCIM Interoperability**: This is [the implementation](https://github.com/zitadel/zitadel/issues/8140) of System for Cross-domain Identity Management (SCIM) protocol for automated user provisioning, synchronization, and lifecycle management across external systems. 
*  **Actions Framework v2**: This feature offers [enhanced extensibility framework](https://github.com/orgs/zitadel/projects/6/views/1?pane=issue&itemId=50259306&issue=zitadel%7Czitadel%7C7235) supporting custom triggers and executions through API endpoints for advanced workflow customization. 
*  **User Group Authorization**: The implementation of [user group management](https://github.com/orgs/zitadel/projects/6/views/1?pane=issue&itemId=48898543&issue=zitadel%7Czitadel%7C5822) capabilities enable efficient authorization management at scale, expanding beyond individual user permissions. 

## Decision Framework: Selecting Zitadel for your Identity Needs
Zitadel is particularly suitable for organizations that prioritize these capabilities:

**Security and Control**:
Your organization requires complete control over infrastructure through self-hosting options, and you need robust data protection measures. Zitadel’s staff publish and fix security issues across the Zitadel ecosystem. Unlike Keycloak which is reliant on the good will of the community members. This presents the opportunity to feel confident in Zitadel's comprehensive audit trails that provide detailed long-term tracking of all authentication and authorization activities.

**Business Architecture**:
Zitadel excels in multi-tenant environments, making it ideal for organizations managing multiple client organizations or separate business units. Zitadel’s B2B-focused approach is designed to handle complex organizational relationships and hierarchies.

**Technology Philosophy**:
If your organization values open-source solutions, Zitadel offers full transparency and the ability to customize the platform to your needs. It is built on cloud-native and serverless principles, making it a natural fit for modern, scalable architectures.

**Community Engagement**:
As an open-source platform, Zitadel welcomes direct contributions from its user community. This means you can actively participate in improving the platform and adapting it to meet emerging needs in identity management.

## Let’s Make Your Identity Management Easier!
Transform your organization’s authentication and access control with Zitadel. Connect with our team to:
* Assess your current identity infrastructure needs
* Design a tailored implementation strategy
* Learn how to scale seamlessly as your organization grows

Book a consultation today to start your journey towards simplified, secure identity management.
<CTA
	label={'Book a Consultation'}
	href={'https://meetings-eu1.hubspot.com/jason-burkhead/zitadel-discovery-call'}
	external={false}
	layout={'primary'}
	noreferrer={false}
	align={'center'}
/>

*Please [share your feedback](mailto:hi@zitadel.com) to ensure this guide remains accurate and valuable for the community. Your insights help us maintain the quality and relevance of our documentation.*



Understanding why Zitadel best fits your organization in comparison to Keycloak will ensure a streamlined deployment and authentication experience for your organization and customers.

Zitadel vs. Keycloak: What makes Zitadel the best Keycloak alternative

Last week marked an incredible milestone for our team and community:
* We announced [Zitadel Version 3](https://zitadel.com/blog/zitadel-v3-announcement) 
* 🎉⭐️Zitadel crossed  10,000 stars on GitHub! 🎉⭐️ 

Achieving 10,000 stars on GitHub is more than just a number to us—it represents the trust, support, and enthusiasm of thousands of developers who believe in our vision for a modern identity platform.

Zitadel is the leading provider of cloud-native identity infrastructure solutions.  Its platform offers a comprehensive suite of tools for multi-tenant, authentication, authorization, and user management.  Designed for scalability, flexibility, and security, Zitadel empowers organizations to protect their cloud infrastructure and applications across the globe. 
### Our Journey to the first 10,000 stars
When we first launched Zitadel as an open-source project, we already embarked on a clear mission: to create a secure, scalable, and developer-friendly identity and access management platform that would simplify authentication and identity management for modern applications especially in multi-tenant scenarios. What began as a small team's passion project has blossomed into a thriving ecosystem of contributors, users, and advocates.
Our journey hasn't always been straightforward. From our initial commit to reaching our first 100 stars took a lot of dedication and persistence and we fully celebrated our first 1,000 stars as a major achievement, never imagining we'd be here today, announcing this new milestone that puts us among the top open-source identity projects globally.

![](https://cdn.sanity.io/images/y3uu7rkl/production/2acac30edb656e48d5734613f9a992662f9750ad-3628x940.png)

### Community Spotlight
None of this would have been possible without our incredible community. From the developer who fixed that critical bug at 2 AM to the companies that have built their entire identity infrastructure on Zitadel, every contribution has mattered for our ongoing success.

![](https://cdn.sanity.io/images/y3uu7rkl/production/4b0ce733f8e6d6f37ad78c9e772ce6e27afe9ecb-2116x1144.png)

-----

*“Zitadel powers our lab initiative by enabling rapid, secure prototyping with its modern, open source identity management platform. Its multi-tenant design and expansive ecosystem make it the ideal partner for testing our next-generation SaaS solutions, positioning itself as a dynamic alternative to traditional giants like Azure Active Directory. Backed by an engaged community and a forward-thinking team, Zitadel not only safeguards our ideas but also accelerates innovation across the board, ensuring that security remains our top priority. There is just no excuses to not using it :-)”
Florent Cenedese, Principal Solution Architect*

*“Zitadel’s domain expertise drives effortless scaling for startups and enterprises. Its event-driven, event-sourced architecture delivers robust scalability, extensibility, reliability, and thorough auditability—supported by a sustainable business model for the free and open source community”
Yordis Prieto, Principal Software Engineer*

-----

### Technical Evolution
Our codebase and architecture has evolved significantly since our initial release.  Our platform has transformed into a highly scalable, cloud-native platform that can handle millions of authentication requests while maintaining sub-100ms response times and we see this proven in customer hosting multiple millions of tenants in Zitadel.

Some of the most impactful technical achievements:
* Transitioning to resources based APIs for easier integration
* Implementing event sourcing as the basis for robust audit trails and event driven integrations with actions
* Updating actions into an extensibility framework that allows customer full control over each http request and event 
* Expanding our protocol support beyond OIDC and OAuth2 to include SAML, WebAuthn, SCIM and LDAP
* Building a comprehensive set of API that developers can even use to build their own login ui

We made all these improvements while maintaining our commitment to security—undergoing regular penetration testing and security audits to ensure we're providing a solution our users can trust with their most sensitive data.
### Lessons Learned
Building an open-source project at this scale has taught us valuable lessons:
* **Documentation matters deeply.** Some of our most appreciated contributions haven't been code but clear, thorough documentation that makes complex identity concepts accessible.
* **Community feedback is gold.** Our best features often came from community suggestions, and our most significant improvements stemmed from user feedback.
* **Balancing innovation with stability is an art.** We've learned to maintain a stable core while allowing for experimentation in new features.
* **Security is never "done."** We've built security into every aspect of our development process, from design to deployment.
* **Open source is about people, not just code.** Building relationships with our contributors and users has been as important as building the product itself.
### Looking Forward
Reaching this milestone matters beyond the satisfaction of seeing a big number on GitHub.  A developer-first, open-source identity solution is the future; it enables enterprises with a choice.  A choice between self-hosted or cloud solution, a choice between open source and commercial offering, and a choice between building and managing a custom-build platform vs. buying one that offers flexibility and control without the burden of engineering efforts.

In the identity space, this achievement puts Zitadel in the top tier of open-source projects—a significant accomplishment for a specialized security tool in a field dominated by much broader infrastructure projects.

While we're taking a moment to celebrate, we're even more excited about what's next in 2025:
* **Performance Optimization:** Comprehensive platform-wide performance enhancements that focus on core authentication service response times, API endpoint optimization across new and existing services, enhanced resource management efficiency, and improved system scalability. 
* **TypeScript Login with OIDC:** A new, highly customizable login interface for our customers, built in with [TypeScript and OpenID Connect](https://zitadel.com/blog/typescript-login) support. Self-hosting customers will soon be able to use the hosted login option with OIDC.
* **User Schema Management:** This feature offers [advanced user profile customization](https://github.com/zitadel/zitadel/issues/8140) enabling granular control over field management permissions between users and administrators. 
* **Configurable Caching System:** Beta release of [flexible caching](https://zitadel.com/docs/self-hosting/manage/cache) infrastructure supporting Redis integration for improved object lookup performance.  
* **SCIM Integration:** This is [the implementation](https://github.com/zitadel/zitadel/issues/8140) of System for Cross-domain Identity Management (SCIM) protocol for automated user provisioning, synchronization, and lifecycle management across external systems. 
* **Actions Framework v2:** This feature offers [enhanced extensibility framework](https://github.com/orgs/zitadel/projects/6/views/1?pane=issue&itemId=50259306&issue=zitadel%7Czitadel%7C7235) supporting custom triggers and executions through API endpoints for advanced workflow customization. 
* **User Group Authorization:** The implementation of [user group management](https://github.com/orgs/zitadel/projects/6/views/1?pane=issue&itemId=48898543&issue=zitadel%7Czitadel%7C5822) capabilities enable efficient authorization management at scale, expanding beyond individual user permissions.

Our vision remains consistent: to be the most developer-friendly, secure identity platform that grows with your needs from side project to scale-up.
### Thank You!
This milestone belongs to everyone who has been part of the Zitadel journey:
* Our 54 code contributors who have submitted everything from typo fixes to major feature implementations
* The companies who have sponsored development or provided resources
* The thousands of developers who have chosen Zitadel for their projects
* The investors who continue to support Zitadel’s growth and success 
* Everyone who has reported bugs, suggested improvements, or simply spread the word

### Join Us As We Build the Future of Identity
If you are not yet part of the Zitadel community, there has never been a better time to join:
* [Star us](https://github.com/zitadel/zitadel) on GitHub (if you haven't already!)
* Check out our [documentation](https://docs.zitadel.com/) to get started
* Join our [Discord community](https://zitadel.com/chat) to connect with other users and our team
* [Contribute](https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md) to the codebase—we welcome contributions of all sizes
* Join our [upcoming AMA](https://discord.gg/jRA3nhv8?event=1344022255759528027) with our CEO, Florian Dorster, on Discord

![](https://cdn.sanity.io/images/y3uu7rkl/production/494896893ec4af602036b3dae7b88f51050b0f05-800x320.png)

Whether you are building a personal project or enterprise-scale software, we are honored to help secure your applications and manage your users' identities.

Here's to the next 10,000 stars and beyond! 🚀

![](https://cdn.sanity.io/images/y3uu7rkl/production/ceb66bc9ab5d1dbc9bcc6b6183a73dcc2f16ae10-1200x627.png)




Zitadel Identity and Access Management (IAM) platform celebrates the milestone for the open source project reaching 10,000 github stars.

Thank you for 10,000 Stars!

At Zitadel, open source is more than just a development model; it's fundamental to our identity. We firmly believe in the power of community-driven development and the unparalleled innovation that it fosters. Our commitment to open source is unwavering, and as our project experiences significant growth, we are proactively adapting our approach to ensure Zitadel's enduring vibrancy and sustainability.

Today, we are sharing our decision to transition Zitadel to the GNU Affero General Public License (AGPL) 3.0. This decision reflects our dedication to providing a secure and transparent identity management platform while ensuring the project's long-term sustainability.
#### Why Open Source?
We strongly believe that the open source ethos provides significant value through increased transparency and security.  Unlike "security by obscurity," open source allows for inspection and verification.

Inspection allows you to thoroughly examine the code, verify the build pipeline, and ensure that the artifacts running in your environment originate from the authentic source while verification allows you to conduct "open-box" security testing, similar to the approach taken by G.E. ([1](https://github.com/zitadel/zitadel/security/advisories/GHSA-f3gh-529w-v32x), [2](https://github.com/zitadel/zitadel/security/advisories/GHSA-hr5w-cwwq-2v4m), [3](https://github.com/zitadel/zitadel/security/advisories/GHSA-mq4x-r2w3-j7mr)), without needing to navigate complex hurdles.

To maintain these benefits and ensure Zitadel's continued development, we have chosen AGPL 3.0.  We often describe our philosophy as "Code or Contribution": to build a valuable project for everyone, we need either community contributions of time and effort, or the resources to hire people to invest their time. The AGPL 3.0 license allows us to strike a crucial balance by:
* Protecting our investment: It ensures that those who commercially leverage Zitadel, especially when offering it as a managed service, contribute back to the community by sharing their modifications.
* Encouraging community engagement: It keeps the core of Zitadel free and open source, actively promoting collaboration and innovation within our growing community.
#### Embracing Sustainability Through Reciprocity
Open source thrives when there is a healthy ecosystem of contribution.  After careful consideration, we believe AGPL 3.0 helps us foster this balance by strengthening the commons and supporting community collaboration.

Strengthening the commons ensures that improvements to Zitadel—especially when offered as a service, flow back to the community, and enriches the ecosystem for everyone.  And supporting community collaboration ensures that Zitadel remains free and open source, continuing to foster the collaborative spirit that has driven our growth.

We see this as embodying the spirit of "Code or Contribution"—recognizing that a healthy open source ecosystem needs either code contributions or support that enables us to sustain development.
#### What is Changing?
Core (our backend), Console, and the Hosted-Login are moving to AGPL 3.0

Proto Service Definitions, APIs, and SDKs remain under Apache 2.0 to avoid virality concerns

Examples, Docs, Helm-chart, Terraform remain under Apache 2.0, with documentation potentially moving to CC-BY-SA4

Contributor License Agreement (CLA): We will implement a CLA to ensure legal clarity.
#### What Remains the Same: Enhanced Security and Transparency
The value you receive from Zitadel remains the same: a secure and transparent product. 

With open source and the AGPL 3.0, you will continue to benefit from:
* **Enhanced Security:** Open source fosters a community-driven approach to identifying and addressing potential vulnerabilities. You aren't relying on "security by obscurity" but on the power of collaborative scrutiny. You can inspect the code, the pipeline, and verify the artifacts.
* **Transparency and Trust:** You have the freedom to inspect the codebase, ensuring that what you deploy is exactly what was built. This transparency builds trust and empowers you to conduct thorough security assessments. You can also do an "open-box" security testing approach without obstacles.
#### Choosing the License
We gave considerable thought to various licensing options before zeroing in on AGPL 3.0.
1. **Apache 2.0:** While this license has served us well and fostered wide adoption, we observed that it sometimes creates an imbalance where commercial use doesn't always lead to reciprocal contribution.
2. **Open Core:** While popular, this approach often creates complex boundaries between open and proprietary features.  Even mature projects like GitLab have faced challenges with this model.
3. **Source-available:** These licenses limit certain freedoms that we believe are important to our mission of providing accessible security tools.
4. **Proprietary:** This would fundamentally conflict with our open source values and community focus.

AGPL 3.0 provides a balanced path forward that preserves the openness we value while encouraging a sustainable ecosystem around Zitadel.
#### Why Now?
2024 has been a remarkable year for Zitadel's growth, both as an open source project and as a solution for organizations of all sizes.  This success brings responsibility—to ensure that Zitadel can continue to evolve and innovate for years to come.

We observed that our current licensing approach sometimes enables using Zitadel's value without corresponding contribution back to its sustainability.  This transition aims to create a balanced relationship that ensures Zitadel's long-term health for everyone's benefit.
#### Understanding AGPL 3.0 in Practice
We want to be clear about how we interpret AGPL 3.0:
* **API usage:** Using Zitadel's APIs without modifying the code doesn't trigger reciprocal requirements.
* **Derivative works:** Creating derivatives using AGPL 3.0 components requires sharing those works under the same license.
* **Distribution:** Sharing unmodified Zitadel is generally permissible.
*Disclaimer: This information is not legal advice. We encourage consulting with your legal counsel for your specific use case.*
#### Commercial Licensing Options
We understand that AGPL 3.0 may not align with every organization's needs.  For those scenarios, we are offering commercial licensing options with additional flexibility, including a free tier.  Please [contact us](mailto:product@zitadel.com) to discuss these alternatives.

We believe this evolution will help Zitadel flourish as a sustainable open-source project, continuing to provide robust and secure identity management solutions that benefit the entire community.
#### The How
We are committed to a thoughtful and transparent transition through clear communication and gradual implementation. 

We will keep our community informed throughout the process with clear and consistent communications.  We will continue to update these [FAQs](https://zitadel.com/license-faq); however, you can also contact us [via email](mailto:product@zitadel.com), on [GitHub](https://github.com/zitadel/zitadel/discussions/9529), or on [Discord](http://zitadel.com/chat) at any time.

With gradual implementation, only new code contributions will use AGPL 3.0 while existing code remains under its original license.

Our goal is to ensure that your questions and concerns are resolved and you have a clear transition path to adopt the license change.
#### Timeline
The license change will take effect with the official release of Zitadel v3.0, scheduled for March 31, 2025.  All previous versions will maintain their original licensing terms.
#### Questions and Support
We will continue to publish and update a Q&A resource during our transition to address common questions about how this might affect different projects and use cases. Please [reach out to us](mailto:product@zitadel.com) with any questions at any time.

I will also be [hosting an AMA (ask me anything) session](https://discord.com/events/927474939156643850/1344022255759528027) on Discord on **March 25 at 15:00 UTC |  08:00 US Pacific** to help answer questions from the community.

We are committed to ensuring Zitadel's long-term sustainability as a leading open-source identity management platform. This license change is a significant step toward that goal, allowing us to continue delivering a secure, transparent, and innovative product.

Zitadel aims to build a sustainable ecosystem and business as it continues to stay committed to open with a license change from Apache 2.0 to AGPL 3.0.

Strengthening Our Open Source Foundation: Moving to AGPL 3.0

## Introduction
As Zitadel continues to evolve, we are excited to announce several significant changes coming with the release of Zitadel v3.  Our team has been working diligently to enhance Zitadel’s sustainability, performance, and developer experience.  

Today, we are sharing three major updates: 
1. Our transition to AGPL 3.0 license
2. A completely streamlined release process
3. Discontinuation of CockroachDB support

All these changes reflect our ongoing commitment to maintaining a robust, open-source identity and access management (IAM) platform while ensuring its long-term sustainability and focusing our resources where they deliver the most value.
### License Change
With Zitadel v3, we are transitioning from Apache 2.0 to the GNU Affero General Public License v3.0 (AGPL-3.0). This decision was not made lightly, but after careful consideration, we believe AGPL better aligns with our vision for Zitadel's future.
#### Why AGPL 3.0?
The AGPL license ensures that any modifications to Zitadel used to provide a service need to be made available to the community.  This creates a more reciprocal relationship between Zitadel and organizations that leverage and build upon our platform.  It protects the open nature of our project while encouraging contributions back to the community.
#### What This Means for You
For most users and contributors, this change will have minimal impact:
* **For end-users:** If you are only using Zitadel as an identity platform, the license change doesn't affect you.
* **For contributors:** Your future  contributions will be licensed under AGPL-3.0 and we will introduce a contributor license agreement (CLA).
* **For service providers:** If you modify Zitadel and provide it as a service to others, you'll need to make your modifications available under the AGPL-3.0 license.
* **For developers:** If you are using our Examples, Libraries, SDKs, APIs, do not worry we will keep those under their existing license.

Our commercial licensing options remain available for organizations that require different terms. Please reach out to us if you have any questions about licensing.

If you have more questions we compiled a detailed [blog post](https://zitadel.com/blog/apache-to-agpl) and an [FAQ](https://zitadel.com/license-faq) for you.

I will also be hosting a Community Office Hours session on [Discord](https://discord.com/events/927474939156643850/1344022255759528027) on **March 25 at 15:00 UTC |  08:00 US Pacific** to help answer questions from the community.

### Release Streamlining
We are excited to announce a completely revamped “fast release” process that will bring new Zitadel features to you more quickly and make updates more manageable for our users.
#### What’s Changing
We are introducing a process that's more agile and responsive to user needs.  Instead of our current approach that can result in larger releases with many changes at once, we are moving to:
* Major releases (v3, v4, etc.) every 3 months
* New minor releases (v3.1.0, v3.2.0, etc.) every 2 weeks
* Patch releases  (v3.0.1, v3.1.1, etc.) whenever needed, particularly for bug fixes
* Release candidates (RC) before each major release that you can test before production
* Creation of a new release branch after each release while approved PRs are merged into the main branch for the next release
* Backward compatibility between minor releases
#### Benefits
These improvements translate to tangible benefits:
* Features are available fast for testing while the release schedule clearly indicates when a version is ready for production deployments
* Opportunity to test release candidates in your environment before production releases
* More predictable planning for your upgrade cycles
* Faster security patches and bug fixes when needed

For organizations using Zitadel in production, this means less operational overhead and more reliable planning for upgrades.

_This process is also detailed in [this GitHub announcement](https://github.com/zitadel/zitadel/discussions/9417) in our repo._
### Discontinuing CockroachDB Support
After careful consideration, we have made the decision to discontinue support for CockroachDB in Zitadel v3 and beyond.

While CockroachDB is an excellent distributed SQL database, supporting multiple database backends has increased our maintenance burden and complicated our testing matrix. By focusing on a single primary database technology, we can:
* Deliver well optimized performance
* Provide more database-specific features
* Simplify our codebase and reduce potential bugs
* Concentrate our resources on core feature development

_This has been detailed in [this GitHub issue](https://github.com/zitadel/zitadel/issues/9414)._
#### Alternatives and Migration Path
Moving forward, Zitadel will standardize on PostgreSQL as our recommended database backend. For existing CockroachDB users, we have prepared a [migration guide](https://zitadel.com/docs/self-hosting/manage/cli/mirror) to help you transition smoothly.  We will provide more detailed instructions specific to the CockroachDB to PostgreSQL migration in our documentation following the release of Zitadel Version 3.
#### Support During Transition
We understand this change may impact your operations. To ease the transition, CockroachDB support will continue in maintenance mode for Zitadel v2.x until September 30, 2025.  Our team is ready to assist with migration questions; please feel free to respond to [this GitHub issue](https://github.com/zitadel/zitadel/issues/9414) or post a question on [Discord](https://zitadel.com/chat).
### What Do These Changes Mean?
#### Immediate Actions
If you're currently using Zitadel, here's what you should do:
1. Review our licensing [FAQ](https://zitadel.com/license-faq) to learn if and how the license change to AGPL 3.0  affects your use case
2. If you are using CockroachDB, start [planning your migration](https://zitadel.com/docs/self-hosting/manage/cli/mirror) to PostgreSQL
3. Test the v3 release candidates in your non-production environments when available
#### Long-term Benefits
These changes, while significant, set the foundation for Zitadel's continued growth and improvement with a more sustainable open-source model, fast and plannable development cycles, improved performance and reliability, and simplified maintenance and upgrades.
#### Looking Forward
Zitadel v3 represents more than just these changes—it is a significant step forward for our platform.  With these foundational improvements in place, we are excited to focus on new capabilities:
* Enhanced developer experience with improved APIs and SDKs
* More advanced authentication options
* Deeper integration capabilities
* Expanded compliance certifications
* Improved performance and scalability

We are also expanding opportunities for community involvement. If you are interested in contributing to Zitadel, now is an [excellent time to get involved](https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md)!
### Conclusion
The changes announced today—our move to AGPL-3.0, streamlined release process, and focused database support—represent our commitment to building a sustainable, high-quality identity platform that meets the needs of modern organizations.

We deeply appreciate your support as we continue to evolve Zitadel. Your feedback and contributions have been invaluable in shaping our direction.
For more information about these changes, please visit our documentation, join our community Discord, or reach out to our team directly. We're here to answer your questions and help ensure a smooth transition to Zitadel v3.
Thank you for being part of the Zitadel community!

Have questions or concerns? Join the discussion on [Discord](https://discord.com/channels/927474939156643850/1349516328867729498) or [contact us](mailto:product@zitadel.com) directly.

As Zitadel continues to evolve, the team announced several significant changes coming with the release of Zitadel v3, including a licensing update, streamlined releases, and standardization on PostgreSQL

Zitadel v3: AGPL License, Streamlined Releases, and Platform Updates

When choosing the right authentication provider for your application it can be hard to narrow down one that works not just for your organization internally but also for your customer and partners. Recognizing the diverse needs of a modern identity management system that is both flexible and secure can become an overwhelming task, especially in a market that offers a plethora of alternatives. That’s why it is important to understand the value proposition of the vendor offerings and evaluate how they fit your organizational requirements.

In this article, we will do a quick comparison of the two alternatives - Auth0 by Okta and Zitadel.

# Introduction: Auth0 (by Okta) and Zitadel
## Auth0 by Okta
Auth0 by Okta (referred to as Auth0 in the rest of the article), is a well-reputed Identity and Access Management solution. It historically has had a strong developer focus and supports a variety of use-cases and integrations. Auth0 is a pure SaaS-oriented, closed-source platform. You have the option to get dedicated setups referred to as "private cloud" that reside on popular hyperscalers. The pricing is oriented around tiers and monthly active users with a free tier for small scale developer projects. Auth0 supports the standard integration protocols like OpenID Connect, SAML 2.0 and WS-Fed.
## Zitadel
Zitadel is an API-first identity platform that is built for developers. It offers easier integration into your tech stack to support the authentication, authorization, and self-service needs.  Offered as an open source and a commercial solution, it also provides a long-term audit trail out-of-the-box to ensure the security and compliance posture for your organization. Zitadel is offered in free and cloud subscription tiers, along with a self-hosted version for organizations that require complete data ownership. Zitadel’s comprehensive identity platform supports business-to-business (B2B) use cases including multi-tenancy, identity brokering, multi-factor or passwordless authentication, delegated access management, and in-context audit trail. Zitadel supports the standard integration protocols such as OpenID Connect, SAML 2.0, and OAuth 2.0.
## Core Differences
### Source Code
Auth0 and Zitadel have quite a big difference in regard to their position of publicizing their source code. Auth0 is closed source project and Zitadel is an open source project. Up to version 2, Zitadel leveraged the Apache 2.0 license but will  transition to the GNU Affero General Public License v3.0 (AGPL-3.0) with the upcoming version 3. The AGPL license ensures that any modifications to Zitadel need to be made available to the community. This creates a more reciprocal relationship between Zitadel and organizations that leverage and build upon our platform. It protects the open nature of our project while encouraging contributions back to the community.

For most of Zitadel’s community, this change will have minimal impact:

**For end-users**: If you are only using Zitadel as an identity platform, the license change doesn't affect you.
**For contributors**: Your future contributions will be licensed under AGPL-3.0 and we will introduce a contributor license agreement (CLA).
**For service providers**: If you modify Zitadel and provide it as a service to others, you'll need to make your modifications available under the AGPL-3.0 license.
**For developers**: If you are using our Examples, Libraries, SDKs, APIs, do not worry we will keep those under their existing license.

Our commercial licensing options remain available for organizations that require different terms. Please reach out to us if you have any questions about licensing, we have compiled a detailed [blog post](https://zitadel.com/blog/apache-to-agpl) and an [FAQ](https://zitadel.com/license-faq) for you.
### Operating Model
While Auth0 operates in a SaaS model with the option to get a private cloud system on one of the well-known hyperscalers, Zitadel operates under an [Open SaaS ideology](https://digitalassetmanagementnews.org/features/the-rise-of-open-saas-and-its-implications-for-digital-asset-management/) (SaaS built with OSS). As an open-source solution, Zitadel can be self-hosted, giving organizations complete control over their data and infrastructure. Zitadel also offers the ability to run a dedicated instance or support to our customers who are in need to self host. If you are trying to decide between cloud or self-hosting, we recently wrote a blog post laying out the pros and cons of [self-hosting and a cloud approach](https://zitadel.com/blog/cloud-or-selfhosted). 
### Pricing
Auth0 offers by default a “Monthly Active User” pricing strategy. A common frustration for customers is that Auth0 bases its billing on peak usage rather than actual real-time consumption, which usually results in unanticipated costs. This, in combination with the need to pay extra for security features like multi-factor authentication makes it a costlier option. The user-based pricing offers an easier starting point but the fact that critical security features are only available in higher tiers hides the true cost for production-ready scenarios.

Zitadel’s pricing model is tailored to your organization’s needs, focusing on three core elements: Support Level Agreements (SLA), Daily Active Users (DAUs), and Technical Account Management (TAM). We include essential features such as multifactor authentication and passkeys at no additional cost, and we don’t charge based on the total number of users stored in your system. 
### Project Structure
Zitadel has a unique way to group clients that belong to the same security context into what we call “Project”. Projects help users bundle together clients, for example a web-application and a mobile-application, that share the same authorization mechanics. This ensures developers see consistent results across all clients without needing to manually configure audience scopes. The project allows you to delegate the access control and permission management to a third party. More details on how our “project grants” work [are here](https://zitadel.com/docs/apis/resources/mgmt/project-grants). 

Auth0 currently lacks functionality to manage applications as a cohesive group.
### Self Service
While Auth0 provides authentication interfaces for sign-up, login and password reset, it lacks broader self-service capabilities such as user profile page or ability to manage users as business partners. In contrast, Zitadel offers comprehensive  self-service capabilities including user profile management, access control delegation, and the ability for business customers to configure their own identity providers.
### Data Residency
When creating an Auth0 tenant, you must select one of four geographic regions for data storage:  US, Europe, Japan, or Australia. Auth0’s region selection is not easily modifiable after initial setup, and this single-region architecture may increase latency for customers accessing services from other geographic regions.

Zitadel offers flexible data residency options with hosting regions the United States, Europe, Switzerland, or Australia. Organizations can deploy multiple instances across different regions to optimize global coverage. For strict data residency requirements, Zitadel supports regional cloud hosting and self-hosted deployments, giving organizations complete control over their data location and security protocols. Many of our enterprise customers choose self-hosted deployments to maintain maximum control over their infrastructure and data governance. 
### Location of Incorporation
Auth0, incorporated in the United States, was acquired in 2021 by Okta which is also incorporated in the United States. With headquarters in the United States and a principal office in Switzerland, Zitadel provides flexible contracting options through its dual-entity structure. Organizations serving European Union customers can contract through Zitadel's Swiss entity, leveraging Switzerland's data protection adequacy status granted by the European Commission. This simplifies EU data transfer compliance compared to the more complex requirements for US-based providers.
### Extensibility
Zitadel and Auth0 both have Actions to support extensibility through debugging and logging capabilities. Zitadel’s event-driven architecture enables organizations to customize workflows by responding to any authentication or audit event. The Zitadel platform’s Session API and Login Experience features offer extensive customization options for both functionality and branding to align with your organization’s requirements. As a fast-growing open-source company, Zitadel rapidly incorporates customer feedback through strategic partnerships and contributions on GitHub.
![](https://cdn.sanity.io/images/y3uu7rkl/production/e912fbcd18d080b3749cc3646171bdb1e8714f55-1024x768.png)

## What’s Next for Zitadel: Development Priorities for 2025
Zitadel maintains a [public product roadmap](https://zitadel.com/roadmap) and operates with full transparency as an open-source platform. It includes significant feature releases planned for platform development and performance optimization in 2025.  
### Performance Optimization:
Comprehensive platform-wide performance enhancements that focus on core authentication service response times, API endpoint optimization across new and existing services, enhanced resource management efficiency, and improved system scalability. 
### TypeScript Login with OIDC: 
A new, highly customizable login interface for our customers, built in with [TypeScript and OpenID Connect](https://zitadel.com/blog/typescript-login) support. Self-hosting customers will soon be able to use the hosted login option with OIDC.
### User Schema Management: 
This feature offers [advanced user profile customization](https://zitadel.com/blog/end-of-year-product-wrap-up#:~:text=informed%20through%20our-,GitHub%20Product%20Roadmap%20Epic,-.) enabling granular control over field management permissions between users and administrators. 
### Configurable Caching System: 
Beta release of [flexible caching infrastructure](https://zitadel.com/docs/self-hosting/manage/cache) supporting Redis integration for improved object lookup performance.  
### SCIM Integration: 
This is the [implementation](https://github.com/zitadel/zitadel/issues/8140) of System for Cross-domain Identity Management (SCIM) protocol for automated user provisioning, synchronization, and lifecycle management across external systems. 
### Actions Framework v2: 
This [feature](https://github.com/orgs/zitadel/projects/6/views/1?pane=issue&itemId=50259306&issue=zitadel%7Czitadel%7C7235) offers enhanced extensibility framework supporting custom triggers and executions through API endpoints for advanced workflow customization. 
### User Group Authorization: 
The implementation of [user group management](https://github.com/orgs/zitadel/projects/6/views/1?pane=issue&itemId=48898543&issue=zitadel%7Czitadel%7C5822) capabilities enable efficient authorization management at scale, expanding beyond individual user permissions. 
## Decision Framework: 
Zitadel is particularly suitable for organizations that prioritize these capabilities:
### Security and Control:
Your organization requires complete control over infrastructure through self-hosting options, and you need robust data protection measures. Zitadel’s comprehensive audit trails provide detailed long-term tracking of all authentication and authorization activities.

### Business Architecture:
Zitadel excels in multi-tenant environments, making it ideal for organizations managing multiple client organizations or separate business units. Zitadel’s B2B-focused approach is designed to handle complex organizational relationships and hierarchies.

### Technology Philosophy:
If your organization values open-source solutions, Zitadel offers full transparency and the ability to customize the platform to your needs. It is built on cloud-native and serverless principles, making it a natural fit for modern, scalable architectures.

### Community Engagement:
As an open-source platform, Zitadel welcomes direct contributions from its user community. This means you can actively participate in improving the platform and adapting it to meet emerging needs in identity management.
## Take Control of your Identity Infrastructure
Transform your organization’s identity, authentication, and access control with Zitadel.  Connect with our team to:
* Assess your current identity infrastructure needs
* Design a tailored implementation strategy
* Learn how to scale seamlessly as your organization grows

Book a consultation today to start your journey towards simplified, secure identity management.
<CTA
	label={'Book a Consultation'}
	href={'https://meetings-eu1.hubspot.com/jason-burkhead/zitadel-discovery-call'}
	external={false}
	layout={'primary'}
	noreferrer={false}
	align={'center'}
/>

Please [share your feedback](mailto:hi@zitadel.com) to ensure this guide remains accurate and valuable for the community. Your insights help us maintain the quality and relevance of our documentation.



Understanding why Zitadel is the best Auth0 (by Okta) alternative and how it best fits your organization in comparison to Auth0 will ensure a streamlined deployment and authentication experience for your organization and customers.

Zitadel vs Auth0: The Definitive Comparison for Enterprise Identity Infrastructure


At Zitadel every customer is granted their own virtual instance with unlimited identities that allows them to fully configure their instance to their needs. This includes choosing a deployment option which is most suitable for the unique needs, security requirements, budget, and resources of each individual organization.

Unlike most Identity and Access Management (IAM) offerings available today (such as Auth0 by Okta, Keycloak, etc.) Zitadel officially offers flexible deployment options – to deploy in Zitadel Cloud or to self-host in your preferred location. In this article, we will discuss our Cloud and self-hosted options to help you find the right solution for your project or business.

## Convenience and Speed-to-Market: Zitadel Cloud

### Pros:

Our public cloud option is ideal for any user who is intrigued by the idea of a hosted deployment model that is ready-to-use the moment you obtain it. Unlike the self-hosted alternative, Zitadel Cloud is pre-configured and automated, saving you the time and money spent on implementing, managing, and maintaining your platform. A virtual instance will automatically upgrade with new product improvements and security fixes without your intervention.

You also do not have to worry about expanding your infrastructure when your service gains new customers or sees usage spikes. Zitadel Cloud can help scale and handle resource allocation for you. A notable benefit also lies in the possibility of choosing a region that works best for your project to stay close to your users. The Zitadel platform is built to manage traffic from a global audience or constrain data to only a certain location, depending on your organization's needs. Both scenarios are possible through Zitadel Cloud, while we optimize and guarantee low latencies and high availability.

With the Zitadel Cloud, you also benefit from the operational security aspects, such as Distributed Denial of Service (DDoS) attack protection and automated certificate management. Zitadel is an open source platform and has the same open source releases available to both our cloud and self hosted environments. We take security seriously and go above-and-beyond so we take pride in publishing the results of our [penetration tests](https://zitadel.com/blog/pentest-results-h1-2021) done by external auditors, as soon as we mitigate issues.

As a “cherry on top”, we offer a true pay-as-you-go subscription method to keep the total cost of ownership (TCO) affordable to even strict budgets.

### Cons:

There are certain weaknesses relying on a Cloud deployment, which are easily outweighed by the convenience of a pay-as-you-go subscription for most customers. While most customers are satisfied with our infrastructure in terms of cloud provider and data location options, some want to choose their own infrastructure providers or data location. In this case self-hosting is the best option (we also partner with managed service providers in some areas if a dedicated instance of Zitadel is the preferred option). Both options are also viable in case a customer requires more flexibility of upgrade cycles or backup frequencies.

A common weakness in today's software is supply chain risk, where our open source model provides extraordinary transparency of code, dependencies, and processes, yet a customer relies on the quality of our technical and organizational measures to manage information security. We are continuously improving our information security and are ISO27001 certified. If your organization requires complete control over the technical and organizational measures, you should choose to self-host Zitadel.

Another challenge in a Cloud deployment lies in its less flexible options out of the box. While companies mostly offer a wide variety of templates to choose from, their number can't compete with the infinite customization possibilities that come with building your own platform. We do not recommend building your own identity management system, rather we promote our platform approach where customers can easily extend functionality of the platform by loosely coupling new components. This is supported by [Zitadel’s API-first approach](https://zitadel.com/docs/apis/introduction), SDK's in [various languages](https://zitadel.com/docs/sdk-examples/introduction), and programmatic extensibility through [Zitadel Actions](https://zitadel.com/docs/guides/manage/console/actions).

The summed-up benefits of Zitadel Cloud include:

- Receive a pre-configured and implemented platform – no need to bother with updates, backups, maintenance, and troubleshooting
- Operational security provided
- Automated backups and updates
- Availability guarantees and automatic scaling
- “Pay as you go” model with low total cost of ownership
- Choose the region that works best for you
- Technical support from the creators - we are here to help

## Complete Control: Self-hosted

### Pros:

Unlike Zitadel Cloud, the self-hosted version is hosted by you on your infrastructure. In the case of Zitadel, companies or individuals can deploy Zitadel on their preferred cloud provider or install it as an on-premise solution; Both of these options allow our customers to take full control over all aspects, instead of having to rely on our infrastructure and our technical and organizational processes. Zitadel is based on cloud-native principles and is designed to be deployed as containers, which makes it straightforward to run and operate on almost any platform.

Self-hosting is a great choice if you have the resources to set up and host your own Zitadel instances on custom infrastructure with your company's needs in mind. If implemented correctly, the features of a self-hosted platform even have the potential to surpass the security possibilities of Zitadel Cloud, making it an ideal alternative for firms working with sensitive data.

The key benefits of self-hosting include:

- Manage your platform with full control in your own cloud or hardware
- Be in control of your technical and organizational measures
- Fully customizable platform
- Self-hosting organizations can get commercial technical support with an SLA
- Highest possible security, if implemented accordingly

### Cons:

The setup cost and maintenance are often downsides of self-hosting, we recommend choosing this solution if your company already possesses internal resources to handle the hosting and is ready to pay the investment and upkeep. While we at Zitadel are happy to help with any issues, “support” still needs to be considered especially around the technical aspects of self-hosting. The responsibility of adequately hosting the platform lies solely in the hands of the company.

We also tend to discourage self-hosting your identity platform without an in-depth IT-knowledge. As the security measures must be manually installed and maintained, mistakes in the implementation can potentially lead to inadequate protection from intruders.

<figure>
  <img
    src="/blog/2025-02-04-zitadelcloudvsselfhosting.png"
    width="100%"
    alt="Figure 1: Benefits of Zitadel Cloud vs. Zitadel Self-Hosted"
  />
</figure>

## Which option to choose?

While both deployment options have their respective advantages, the self-hosted alternative will most likely benefit companies that aim to fulfill some very specific requirements or compliance goals. If your organization lacks internal staff with in-depth IT knowledge, the serious dangers of faulty implementation are not worth risking. The advantages of Zitadel Cloud outweigh those of self-hosted options for most organizations and are therefore generally the recommended path to take. For easier decision-making, we created this simplistic chart as a guide:

<figure>
  <img
    src="/blog/2025-02-04-cloudselfhostdecisionchart.png"
    width="100%"
    alt="Figure 2:  Handy Reference Chart to Decide if Zitadel Cloud or Zitadel Self-Hosted is the Right Choice"
  />
</figure>

Whether you choose to use Zitadel Cloud or host Zitadel yourself, Zitadel ensures the best possible deployment experience with its flexible pricing options, comprehensive set of features, guaranteed high security, and unlimited identities for all options. In the future, you can also decide to migrate from Zitadel Cloud to hosting it yourself.

Should you have questions regarding Zitadel Cloud, self-hosting, or any other related (or unrelated) topics, feel free to contact us anytime on our Zitadel [Discord Server](https://zitadel.com/chat), our [Bluesky](https://bsky.app/profile/zitadel.bsky.social), [Twitter](https://twitter.com/zitadel), [Linkedin](https://www.linkedin.com/company/zitadel/) or [GitHub](https://github.com/zitadel/zitadel) pages, or on our [Website](https://zitadel.com/contact).

As you find the project helpful, please be sure to [give us a star over on GitHub](https://github.com/zitadel/zitadel/stargazers).


A blog post detailing the use cases that best suit a self-hosted vs. cloud model for an IAM Platform while demonstrating the flexibility offered by Zitadel

Zitadel Self-Hosted vs. Cloud: Making the Right Choice


We've developed a new TypeScript-based login system to streamline the authentication process for our customers. This solution offers a **flexible**, **customizable**, and **self-hostable** login experience.

By providing a ready-to-use login solution, we aim to reduce development time and effort for our customers. The open-source nature of the project allows for easy customization and adaptation to specific business needs.

Our immediate goal is to enable customers to self-host the login system. In the future, we plan to fully integrate this new login system into our cloud offering, providing a more robust and secure authentication experience. We plan to initiate the first cloud integration by the end of February. New customers will be automatically provisioned with the new cloud-based login. Existing customers will have the flexibility to migrate their entire instance or individual applications at their preferred time.

The new TypeScript login system offers several key improvements:

- **Leverages Modern Technology**: By utilizing our newly developed [session APIs](https://zitadel.com/docs/apis/resources/session_service_v2), we've significantly enhanced the security and performance of the authentication process.
- **Enhanced Features**: The system introduces new features such as user invitation flows and passkey-only authentication, providing greater flexibility and convenience for our users.
- **Improved Developer Experience**: The use of TypeScript, a widely adopted language in frontend development, makes the codebase more accessible and easier to contribute to. This encourages community involvement and fosters rapid development.

## Current State

Our primary goal for the TypeScript login system is to fully replace the existing login functionality within the current Zitadel version, which is shipped with Zitadel default. This will allow us to leverage the benefits of the new system, including its modular architecture and enhanced security features.

To achieve this, we are actively working on implementing the core features currently available in Zitadel, such as:

- **Authentication Methods**:
  - Username and Password
  - Passkeys
  - Multi-Factor Authentication (MFA)
  - External Identity Providers (OIDC, SAML, etc.)
- **OpenID Connect (OIDC) Compliance**: Adherence to the OIDC standard for seamless integration with various identity providers.
- **Customization**:
  - Branding options to match your organization's identity.
  - Flexible configuration settings to tailor the login experience.

The full feature list can be found [here](https://github.com/zitadel/typescript?tab=readme-ov-file#features-list).

As we continue to develop the TypeScript login system, we will provide regular updates on its progress and new capabilities.

<figure>
  <img
    src="/blog/2025-01-21-typescript-login-01.png"
    width="100%"
    alt="Login UI with authentication method loginname, Apple, Google OIDC, Google and GitLab"
  />
</figure>

## Limitations

For the first release we have excluded the following features:

- SAML 2.0 ([IdP](https://zitadel.com/docs/apis/saml/endpoints) & [SP](https://zitadel.com/docs/guides/integrate/identity-providers/mocksaml))
- [Generic JWT IDP](https://zitadel.com/docs/guides/integrate/identity-providers/jwt_idp)
- [LDAP IDP](https://zitadel.com/docs/guides/integrate/identity-providers/ldap)
- [Device Authorization Grants](https://zitadel.com/docs/guides/integrate/login/oidc/device-authorization)
- Timebased features
  - [Lockout Settings](https://zitadel.com/docs/guides/manage/console/default-settings#lockout)
  - [Password Expiry Settings](https://zitadel.com/docs/guides/manage/console/default-settings#password-expiry)
  - [Login Settings - Multifactor init prompt](https://zitadel.com/docs/guides/manage/console/default-settings#login-behavior-and-access)
  - [Force MFA on external authenticated users](https://zitadel.com/docs/guides/manage/console/default-settings#login-behavior-and-access)
- [Passkey](https://zitadel.com/docs/guides/manage/console/default-settings#passwordless)/[U2F Setup](https://zitadel.com/docs/guides/manage/console/default-settings#multifactor-mfa)
  As passkey and u2f is bound to a domain, it is important to notice, that setting up the authentication possibility in the ZITADEL management console (Self-service), will not work if the login runs on a different domain
- [Custom Login Texts](https://zitadel.com/docs/guides/manage/console/default-settings#login-interface-texts) configurations are not used in the typescript login, if you want to customize them, fork the repository and change the texts to you liking

## Beta Testing

The TypeScript login system is currently in the beta testing phase. Your feedback is highly valuable in helping us refine and improve this new solution.

At your convenience please open any issues faced on our [Typescript Login GitHub repository](https://github.com/zitadel/typescript) to report bugs or suggest enhancements while more general feedback can be shared directly to the [corresponding discord thread](https://discord.com/channels/927474939156643850/1329100936127320175/threads/1329827099606782093).
Your contributions will play a crucial role in shaping the future of our login system.
Thank you for your support!

### Steps to start testing

The simplest way to deploy the new login for yourself is by using the [“Deploy” button in our repository](https://github.com/zitadel/typescript?tab=readme-ov-file#deploy-to-vercel) to deploy the login directly to your Vercel.

1. [Create a service user (ZITADEL_SERVICE_USER_ID) with a PAT](https://zitadel.com/docs/guides/integrate/service-users/personal-access-token#create-a-service-user-with-a-pat) in your instance
2. Give the user IAM_LOGIN_CLIENT Permissions in the default settings (YOUR_DOMAIN/ui/console/instance?id=organizations)
   [https://zitadel.com/docs/guides/manage/console/managers](https://zitadel.com/docs/guides/manage/console/managers)
3. Deploy login to Vercel: You can do so, be directly clicking the “Deploy” button at the bottom of the readme in our [repository](https://github.com/zitadel/typescript)
   <figure>
     <img src="/blog/2025-01-21-typescript-login-02.png" width="100%" alt="Deploy to vercel button" />
   </figure>
4. If you have used the deploy button in the steps before, you will automatically be asked for this step. Enter the environment variables in Vercel
   - ZITADEL_SERVICE_USER_ID
   - PAT
   - ZITADEL_API_URL (Example: https://my-domain.zitadel.cloud, no trailing slash)
5. Add the domain where your login UI is hosted to the [trusted domains](https://zitadel.com/docs/apis/resources/admin/admin-service-add-instance-trusted-domain) in ZITADEL (Example: my-new-zitadel-login.vercel.app)
6. Use the new login in your application. To implement the new login, choose one of the following options:
   1. Enable the new login in your application configuration: Add the URL of your new login UI to your application’s settings. Zitadel will automatically redirect users to the new login if they attempt to use the old one.
   2. Enable the loginV2 feature on the instance:Activate the LoginV2 feature in your Zitadel instance and specify the URL of your new login. This will apply the new login for all applications configured under your Zitadel instance. Example: https://my-new-zitadel-login.vercel.app. More details: [Zitadel Documentation](https://zitadel.com/docs/apis/resources/feature_service_v2/feature-service-set-instance-features)
   3. Update the issuer URL in your application configuration: Change the issuer domain in your application configuration to match the new login domain.

For more information read our [Login V2 documentation](https://zitadel.com/docs/guides/integrate/login/hosted-login#hosted-login-version-2-beta)

## Important Notes

- **User Creation**: The new TypeScript login utilizes the Session and User V2 APIs. Note that the User V2 API introduces some changes compared to the V1 API. Ensure you create users using the new V2 API to maintain compatibility.
- **External Identity Providers (IDPs)**: To enable login with external identity providers, such as Google or Apple, follow our existing setup guides. Ensure that you use the following redirect URL: $YOUR-DOMAIN/idps/callback.
- **Passkey/U2F Authentication**: These authentication methods are domain-bound. Since your new login operates on a different domain than the previous one, existing passwordless authentication (e.g., fingerprint, Face ID) and U2F methods cannot be reused. Additionally, when managed through the Zitadel console, they will be tied to the old domain. Note: To avoid this issue, consider running the new login on a subdomain of your current instance (e.g., myinstance.zitadel.cloud and login.myinstance.zitadel.cloud).

## Customization / Feature requests

If you have specific customization needs beyond the current capabilities of the Typescript login offering, please follow one of these two options:

1. **Fork the Repository**: By forking the [Typescript Login](https://github.com/zitadel/typescript) repository on GitHub, you can directly modify the source code to implement your desired features. This offers maximum flexibility and control over the login system.
2. **Build Your Own Login UI**: For full customization control, you can leverage our Session API to build your own login interface. This allows you to create a fully tailored experience that aligns perfectly with your application's design and functionality. A detailed guide on how to use the Session API is available [here](https://zitadel.com/docs/guides/integrate/login-ui).

## Future plans

Our roadmap for the TypeScript login includes several exciting developments:

### Short-term Goals

- **Feature Parity**: We will continue to implement the missing features listed above to ensure seamless migration.
- **Multi-tenancy**: We will enable multi-tenancy to support our cloud offering, allowing new users to directly access the new login experience while existing customers can migrate at their own pace.

### Long-term Vision

- **Self-Service Components**: We plan to introduce self-service components for the users like profile management, making it easier for you to integrate these functionalities into your applications without relying on our full-fledged management console.
- **Enhanced Customization**: We will explore options to further customize the appearance of the login page, allowing you to tailor it to your specific branding and design preferences.

By focusing on these areas, we aim to provide a powerful, flexible, and customizable login solution that empowers your applications.

Now it’s your turn. Do you have any suggestions for [improvement](https://github.com/zitadel/typescript/issues/new?template=improvement.yaml) or [bug reports](https://github.com/zitadel/typescript/issues/new?template=bug.yaml)? Explore the [repository](https://github.com/zitadel/typescript) and share your feedback in our [discord thread](https://discord.com/channels/927474939156643850/1329100936127320175/threads/1329827099606782093).


We've developed a new TypeScript-based login system to streamline the authentication process for our customers.

Introducing our New TypeScript Login


As the snow falls outside here in Switzerland creating a winter wonderland, I am filled with pride looking at the past year’s milestones.  Zitadel has grown in such exciting ways — the features that have been deployed, the product roadmap, the collaboration with our vibrant developer community, partnering with customers from every walk of life, and last but not the least, getting incredible support from our investors.  Each person, team, GitHub comment to the pull requests, Discord discussion have shaped the path to where we stand today!  A heartfelt thank-you to everyone involved.   To say I am thrilled about our next growth phase in 2025 is an understatement! 
 
As we near the last few weeks of 2024, I want to take a minute to reflect and review some of the milestones that made this year one of our best yet!

Before I get to it, I wanted to share our upcoming Discord event on the Back-Channel Logout feature.  If you want to see how it can help you manage your user sessions throughout your identity infrastructure, [register and join us in Discord on December 11th](https://discord.gg/bnuAe2RX?event=1308899625041924127) where [Livio Spring](https://www.linkedin.com/in/liviospring/), Engineer and Co-founder, Zitadel, will give a live demo.

## Zitadel in 2024: Highlights 

- We are [proud to announce](/blog/zitadel-the-future-of-identity-infrastructure) our $9 Million Series A  round of funding in collaboration with Nexus Ventures and Floodgate to advance Cloud-Native Identity Infrastructure.

- We achieved our [ISO 27001 certification](/blog/zitadel-iso-27001-certified) further reinforcing our commitment to security through this internationally recognized standard that confirms our dedication to maintaining the highest levels of security for our customers' data. 

- Zitadel has grown to serve over 150 customers this year such as Klaviyo, Open Systems, Vector Solutions,  and Kaspar&!

- [Zitadel’s Discord Community](https://discord.gg/szfmzC2M) has grown by 93% in 2024 from 1,527 to 2,953 members

- [Zitadel’s Github Repository](https://github.com/zitadel/zitadel) continues to make traction with a 57% increase to 9,100+ Github Stars and another 57% increase of individual contributors to 220+ collaborators across all the Zitadel repositories. 

- Continuing to be a remote-first team, we came together twice this year — in [Italy](/blog/team-retreat-bologna) and [Switzerland](/blog/team-retreat-zurich) — for team get-togethers and planning forward as we level up Zitadel’s future!

## Zitadel in 2024: Product

Looking over the past year we released key features that helped customers across the board in the way they manage their identity infrastructure. 

- **Performance Improvements:** We prioritized stability and scalability enhancements in 2024 to set a solid foundation for our Self-Hosted and Cloud customers.  With some of our customers deploying as many as 2.3 million tenants to manage their identity infrastructure, performance is key.  These enhancements include latency, [benchmark testing](/docs/apis/benchmarks), and reliability on services such as token endpoint and new generation APIs like the [improvedPerformance](/docs/apis/resources/feature_service_v2/feature-service-set-instance-features) field.

- **Easier Integrations:** This allows admins to set up an application in their [framework and programming language of choice](/docs/sdk-examples/introduction) quickly.  Zitadel simplifies the process for the admin’s deployment process of client applications by enabling the use of default settings!

- **Using external SAML IdPs:** This enables admins to level up using external identity providers by defining the preferred nameID format and configuring user mapping in Zitadel based on attributes received from the external IdP.  [Learn more](/docs/guides/integrate/identity-providers/mocksaml) about building using external SAML IdPs.

- **Setting up Email Providers:** This was accelerated greatly thanks to our open source community.  This feature makes it easier to configure email delivery even faster within Zitadel through SMTP provider templates.  [These templates](/docs/guides/manage/console/default-settings#smtp) offer pre-defined settings for popular email service providers (ESPs) like Amazon SES, Mailgun, Mailjet, Postmark, Sendgrid, and a Generic SMTP option.

- **Managing OpenID Connect Signing Web Keys:** This became much easier with Zitadel taking the lead to create keys without expiry for each instance.  Now users can create, rotate, and disable signing Keys via API at your discretion as [documented here](/docs/guides/integrate/login/oidc/webkeys).

- **Organizational Metadata:** This allows developers to use the org’s metadata in the [complement token flow](/docs/apis/actions/complement-token) in Actions as well as include a user’s organization metadata into tokens that can be read by receiving applications. 

- **New Password Expiry:** Policies came out in mid-2024 to aid organizations to require users to change their passwords on a routine basis. [This feature](/docs/guides/manage/console/default-settings#password-expiry) can be used quickly through the Console UI at both instance and organization levels. 

- **New Sample Apps:** We prioritized building out sample apps in [VueJS](https://github.com/zitadel/zitadel-vue), [PHP](https://github.com/zitadel/example-symfony-oidc), and [Java](https://github.com/zitadel/zitadel-java) in the beginning of 2024 to make getting started with authentication and authorization easier with these specific examples and guides.

- **Back-Channel Logout:** This is a feature that resides on the server-side and does not require the user agent to be involved. Through [back-channel logout’s](/docs/guides/integrate/login/oidc/logout#back-channel-logout) ability it has the user logged out from all clients in the event that the authenticated session gets terminated. 

- **Four New Translations added to the Zitadel platform** with **Hungarian**, **Indonesian**, **Swedish**, and the latest being **Korean** thanks to the recent addition from our community contributor [Kim JeongHyeon](https://github.com/KimTibber)!

- **New Translations added to Upcoming Typescript Login** to include **German**, **Spanish**, **Italian**, and **English**.  If you’re not seeing the language of your choice, please request or collaborate with us directly on our [GitHub](https://github.com/zitadel/typescript/tree/main/apps/login/locales).

## Zitadel in 2025: Vision

For 2025, we are focusing on three key areas to enhance the Dev and SecOps experience:

- **A Seamless Onboarding Journey:**  Our goal is to make your first integration with Zitadel as smooth as possible.  We are working on intuitive APIs, comprehensive examples and SDKs, flexible user management tailored to your use case, and streamlined deployment and maintenance processes.

- **Enterprise-Grade Performance and Scalability:** We are committed to making Zitadel a highly scalable and performant identity infrastructure.  This includes linear scalability to meet your growing needs, easy upgrades for business continuity, and efficient user management with group administration and standardized provisioning/deprovisioning capabilities.

- **Proactive System Insights:** We empower you with the tools to proactively monitor and manage your Zitadel environment.  This includes seamless integration with your SOC/SIEM systems, real time system health insights, and user analytics to identify potential issues before they impact your customers.

## Zitadel in 2025: Product 

As we look to the future, we’ve got a wide range of exciting new features on the horizon! 

- **Performance Improvements:** This remains a top priority for the team as we continue to strengthen Zitadel’s core authentication capabilities, the platform’s existing & new API endpoints, and resource management across the board. 

- **New Typescript Login including OIDC:** This allows admins to enhance their Zitadel instance with a ready-to-deploy login that is highly customizable.  [Read the GitHub Product Roadmap Epic here](https://github.com/orgs/zitadel/projects/6/views/1?pane=issue&itemId=50833557&issue=zitadel%7Ctypescript%7C46).

- **User Schemas:** This feature offers flexibility when managing user details from user- and admin- perspective by allowing to define the fields that are allowed to be managed by a user and the ones that are to be managed by admin.  Stay informed through our [GitHub Product Roadmap Epic](https://github.com/zitadel/zitadel/issues/6433).

- **Configurable Cache Options:** This was the last beta feature of 2024 that enables speedy lookup of objects that are often needed by storing them in cache, like Redis.  [Take it for a spin](/docs/self-hosting/manage/cache) before it becomes generally available in 2025 and [share your feedback](https://discord.com/channels/927474939156643850/1309157792292012063/1309158011469692958).

- **SCIM (System for Cross-domain Identity Management):** This is the standard for inbound user-provisioning so other systems can automatically provision and manage users within Zitadel.  This allows creation, update, and deletion of users based on user data changes in the external system and streamlines user management across systems ensuring consistent user states. To dig deeper into this feature, read the [GitHub Product Roadmap Epic here](https://github.com/zitadel/zitadel/issues/8140).

- **Actions v2:**   This feature will allow you to extend Zitadel with custom executions and triggers through API endpoints as you look to make the most out of your Zitadel instance.  Check out the [GitHub Product Roadmap Epic](https://github.com/orgs/zitadel/projects/6/views/1?pane=issue&itemId=50259306&issue=zitadel%7Czitadel%7C7235) to find out more.

- **User Group Authorizations:** Through this feature Zitadel expands past the managing users individually and now offers groups to enable authorizations as a wider scale for user management. To follow along on this feature delivery in 2025, review the [GitHub Product Roadmap Epic](https://github.com/orgs/zitadel/projects/6/views/1?pane=issue&itemId=48898543&issue=zitadel%7Czitadel%7C5822).

## Community & Feedback Opportunities

As always, we appreciate and welcome your feedback.  It helps us shape our product roadmap and build a robust platform that caters to your needs: 

- If you are interested in a sneak peek at our User Schemas update, and would like to share your feedback, please email [Jim@Zitadel.com](mailto:Jim@Zitadel.com)

- Please share your feedback and experiences with our Community team by [scheduling some time here](https://calendar.app.google/UgTzLndLKKMk7BYp8)

- If you are using Zitadel today, please add yourself to the [Adopters](https://github.com/zitadel/zitadel/blob/main/ADOPTERS.md) list with a short description of your use case by opening a pull request and adding a section describing your usage of Zitadel.

- If you are interested in contributing to Zitadel, please review our [Contributing Guide](https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md) to collaborate with us.

Have a look at our great product enhancements of 2024 and what is ahead for 2025.

End Of Year Product Wrap Up 2024


As an open source organization with strong community roots, we want to ensure that the care, intention, and nurturing that we pour into our product is also reflected within our team. Back in May of 2023, we held our first retreat, taking initial steps towards becoming a fully remote, global company. Fast forward to November 2024, we’ve grown from a small unit to a team of almost 20 fully distributed professionals across the globe. Along the way, we’ve made meaningful strides towards curating a strong sense of belonging while cultivating our remote work culture. Our efforts really come to life at our biannual off-sites where we’re all able to reconnect in person. Off-sites are one of many ongoing cultural rituals that allow us to work on the four Cs:  Collaboration, communication, connection, and . . . carbs **(yes, seriously —  stay with me, more on this in a second)**. 
 
## Pre-Arrival

Three days before everyone was set to fly out, we found ourselves needing to make a 1000+ kilometer change to our plans (we originally planned to go to Valencia, Spain). With time against us, we had to quickly rebook flights, shift the location of our activities and accommodations — all of this in less than 1 week. With some team members up to 8000 km away, this last-minute change really tested our ability to be communicative and adaptable. (In hindsight, this felt like an almost impossible task but we did it!)

Despite this being a logistical nightmare & having tight timelines, we were really able to come together as a team and push this through to success on such short notice. Adding on to a whirlwind of a week, illnesses, personal emergencies, and hurdles popped up that threatened to fully derail our upcoming trip. What could have been the end of our plans gave us an opportunity to show how far we’ve come as a remote-first team. We were operating like a well-oiled machine—leadership quickly went to work preparing a compact action plan, while team members supported each other with rebooking flights and figuring out how to navigate locally. From the warm, sunny coastlines we planned to visit to the cool, cozy vibes of Zurich -  the chaos gave us the opportunity to not only show resilience through challenging circumstances but also our ability to adapt and thrive together. 
 
## Arrivals

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-01.jpg" width="100%" alt="Nine Zitadel staff members smiling and posing at a bar near the Zurich opera house, with drinks on the table." />
</figure>

With our travel toils behind us, we began our journey to Zurich. For those already stationed in Switzerland, getting to Zurich wasn’t too much of a hassle. For others, it meant 20+ hours of travel - an experience best summarized as "amazing, spectacular, 10/10, would do again". Can you hear the sarcasm? The excitement to meet our co-workers in person surpassed the jet lag & weariness with all of us finally uniting in the evening. With early arrivals already at the hotel and others still on the way, a smaller group of us met near the opera house, where the view of the water at sunset provided a stunning backdrop for some great photos. We all quickly caught up (and met some new teammates!) before continuing on a short walk to the jazzy, goat-themed Widder Bar where the rest of team Zitadel joined us.  

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-02.jpg" width="100%" alt="Table at Raclette Stube with wine glasses, a fondue pot, and plates of vegetables, meat, raclette, and potatoes." />
</figure>

Light banter, warm introductions, and plenty of jokes set the tone for our evening as we made our way to Raclette Stube. We all ate to our heart's content - with some of us experiencing raclette for the first time and others opting for the very classic fondue. After the night's festivities, most of us felt like we turned into a ball of cheese.

That first evening together melted away the strain of those last minute changes, leaving us recharged & ready to dive head first into the rest of a very promising retreat.
 
## Activities & Exploration

After we settled in, our retreat really started on day 2 with a series of workshops led by some of our incredible internal subject matter experts.
Our new product marketing manager, Jim, opened up our sessions with an engaging discussion around our documentation and how it is crucial to your (yes, you, dear reader) Zitadel experience. Following Jim, our head of sales, Jason, broke down the sales process for our engineering team - delving into our processes, how we map customer needs while giving us a quick overview of negotiation tactics, and relationship building.

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-03.jpg" width="100%" alt="Zitadel staff in a meeting room, attentively watching Jason, the head of sales, present his workshop." />
</figure>

Next, Silvan and Max came in with well crafted & informative workshops focused on engineering. Silvan, through a hilarious presentation, provided much needed insights into Zitadel’s performance and detailed next steps on how we plan to improve it. Max gave a detailed overview of the new Typescript login, its implementation, and how it fits into creating an exceptional user experience. Our workshop series ended with our CEO, Florian, breaking down venture capital and offering a clear picture of where we currently are as a company [(check out our latest funding announcement!)](https://zitadel.com/blog/zitadel-the-future-of-identity-infrastructure)

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-04.jpg" width="100%" alt="Group hiking with those at the front smiling at the camera, while others straggle behind, surrounded by lush greenery." />
</figure>

With our workshops wrapped up, we took a casual stroll through Zurich that included us raiding Migros and Coop (a Swiss rite of passage). We tested our limits with an “intense” hike (spoiler: some of us fumbled on the beginner trail and felt winded at the end of it). The stunning views, adorable cows, and fresh air made every step of that hike worth it.

In the days that followed, we explored Lucerne where some of us shopped for souvenirs, crossed Kapellbrücke (with Florian providing important historical context), and wrapped up that day with a breathtaking ride up Pilatus. Of course, more souvenirs were added to our suitcases by the end of that Lucerne day trip.

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-05.jpg" width="100%" alt="Group exiting the Lindt chocolate factory with the factory sign partially visible in the background." />
</figure>

We can't forget to mention one of the most delicious parts of our trip: our visit to the Lindt chocolate factory. We experienced (and ate) a key piece of Swiss history, with some of it ending up in our jackets & bags at the end of the day. 
 
## Wrapping Up

This was a trip filled with fresh energy, joy, collaboration, and a reinforced sense of belonging. We all had the chance to strengthen our existing relationships (and build new ones!) - From celebrating promotions, to learning through in-depth internal workshops, and getting a thorough workout in Zurich - This trip was a memorable experience that left us all inspired and more than excited to continue growing. 

💜 **Here are some staff quotes from the trip:**  

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-06.jpg" width="100%" alt="Jim and Stefan sitting in the hotel lobby playing Magic: The Gathering, with cards spread across the table and drinks nearby." />
</figure>

"Our team retreat in Zurich was fantastic! It was refreshing to connect with everyone on a personal level. My highlight was those late-night Magic the Gathering sessions with Jim and Stefan – it had been 10 years since I'd played, and the competitive spirit with plenty of laughs was the perfect way to unwind and bond! Beyond the fun, it was inspiring to see how strong our company culture has become. As a remote company, these connections are crucial, and it's clear that even with the team nearly doubling in size, newcomers feel welcomed and supported. That creates such a positive and productive environment, no matter where we're working from. I can't wait for our next retreat!"
-**Florian Forster, CEO**

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-07.jpg" width="100%" alt="Lindt chocolate factory sign prominently displayed on the factory's exterior." />
</figure>

“It was great to show everyone our beautiful country and where the whole story of Zitadel started. I always love to explore something unique for the place we visit, and the Home of Chocolate was just amazing. Even if it was waaaay too much chocolate. :) Getting to know everyone in person is always my favorite part of the team retreat, and I am sure this makes a big difference for our daily remote work.”
-**Fabienne Bühler, CPO**

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-08.jpg" width="100%" alt="Zitadel staff in a meeting room, attentively watching Jim, the product marketing manager, present his workshop." />
</figure>

“It was a lovely offsite that hit all the points you hope for out of a team coming together, from long term strategy discussions to rapport building amongst the crew. It’s exciting to have a strong alignment closing out 2024 and going into 2025!”
-**Jim Morrison, Product Marketing Manager**

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-09.jpg" width="100%" alt="Team walking through Lucerne, passing buildings with signs for 'Pilatus', 'Victorinox', and 'La Fenice Steakhouse'." />
</figure>

“The Zurich retreat was an extraordinary experience, one that will forever be etched in my memory. To gather with colleagues from across the globe, to see familiar faces, and meet new ones, was truly inspiring. The days were filled with insightful discussions, thought-provoking presentations, and collaborative problem-solving. Yet, the moments outside of the formal agenda also truly resonated with me. The casual conversations, the shared laughter, the late-night card games with Magic the Gathering– these were the moments that forged deeper bonds and strengthened our team. The opportunity to explore the beauty of Switzerland was an added bonus. Whether it was a leisurely stroll through the city or a breathtaking hike in the mountains, each excursion offered a chance to unwind, recharge, and appreciate the simple joys of life. I’m incredibly grateful for the experience and can’t wait to reconnect with my colleagues at the next retreat.”
-**Stefan Benz, Software Engineer**

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-10.jpg" width="100%" alt="Small group of Zitadel engineers casually chatting near picnic-style seats at an outdoor restaurant." />
</figure>

"I cherished the in-person conversations and unforgettable moments with these amazing people. The presentations, even though they were in the morning, were a valuable source of knowledge about others' work, making this retreat a truly unique experience."
-**Silvan Reusser, Software Engineer**


Discover how our fourth team retreat in Zurich turned last-minute challenges into opportunities for collaboration, connection, and cultural exploration.

Hopp Schwiiz - Company retreat V4


### Advancing the future of identity infrastructure to a cloud-native, multi-tenant, and developer-friendly platform.

Modern organizations have a complex landscape of interconnected systems, spanning hybrid and multi-cloud environments and serverless architectures. To succeed, businesses must constantly adapt their security and identity management strategies to improve developer productivity and user experience across multiple systems. This, however, presents significant challenges. Data ownership and security, the complexities of SSO and MFA, developer-friendly APIs and SDKs, and customization to specific use cases are major concerns that can hinder innovation, slow down time-to-market, and impact customer satisfaction."

### Announcing our Series A Funding Update

Through our collective experiences, we learned that the current solutions for Identity and Access Management and Identity Infrastructure fall short in many different areas. Driven by a shared vision to build a modern identity infrastructure platform, Fabienne, Max, and I, along with a talented group of engineers, founded Zitadel four years ago.

![zitadel raises 9 million series a](/blog/2024-11-20-zitadel-the-future-of-identity-infrastructure.png)

We're thrilled to announce today that [we've raised $9 million in Series A funding](https://www.prnewswire.com/news-releases/zitadel-raises-9-million-series-a-to-advance-cloud-native-identity-infrastructure-302311461.html) to further our mission of building a modern identity infrastructure platform. This investment, led by Nexus Ventures with continued participation from Floodgate, will enable us to accelerate development and bring Zitadel to even more organizations. We're incredibly grateful for the ongoing support of our investors and partners, who share our passion for creating a secure and developer-friendly identity solution.

### What makes Zitadel a great Identity Platform

#### Architectural Innovation

Zitadel is built as a cloud-native infrastructure project that leverages modern technologies to ensure a platform that scales with customers' needs. What sets Zitadel apart is its **unique event-sourced architecture**, where every change in the system is captured as an immutable event. This not only provides a **complete audit log** but also allows customers to **subscribe to real-time changes** within their Zitadel. Built with the help of Go, NextJs, Angular, Postgres and Redis, Zitadel is designed to be highly scalable, resilient, and secure. Our multi-tenant architecture allows us to support customers of all sizes, from small businesses to large enterprises. And our API-first approach makes it easy to integrate Zitadel with your existing applications and workflows.

![Architectural Innovation](/blog/2024-11-20-zitadel-the-future-of-identity-infrastructure-overview.png)

#### Flexible Authentication and Login options

Passwordless authentication along with enterprise or social logins are quickly becoming the de facto standards in identity security. Zitadel supports these and provides a customizable log-in experience for businesses that would like to either embed their login workflow, passkeys, or build a completely custom login experience for their project.

#### Built for Multi-tenancy

Multi-tenancy is a fundamental capability of the Zitadel platform, engineered to effortlessly support millions of tenants. This allows customers to manage a vast number of organizations and policies simultaneously, with the flexibility to handle diverse scenarios – from B2B and B2C to complex mixed setups with both. Customers can seamlessly extend the scope of their applications by adding new organizations and granting projects to them, all within a single, unified Zitadel instance. This scalability ensures that Zitadel can grow with your business, no matter how large or complex your needs become.

![Built for Multi-tenancy](/blog/2024-11-20-zitadel-the-future-of-identity-infrastructure-multitenancy.png)

#### Engineered for Developers

Zitadel is built with developers in mind, adopting an API-first approach. This means that every feature and function is accessible through well-defined and documented APIs. We offer both gRPC and REST APIs, giving you the flexibility to choose the best fit for your needs. This allows for seamless integration with your existing tech stack, regardless of your preferred programming languages or frameworks. Our comprehensive SDKs further simplify development, reducing the learning curve and accelerating your time to market.

With Zitadel's API-first approach, you can:

- **Automate user management:** Programmatically create, update, and delete users.
- **Customize authentication flows:** Integrate with your own login UIs or implement passwordless authentication.
- **Manage roles and permissions:** Fine-tune access control for your applications.
- **Extend Zitadel's functionality:** Build custom integrations with other services.

#### Enabling frictionless Security Operations

The Zitadel Identity Platform aims to empower security operators with critical capabilities such as secure login policies, audit and access events, etc. We are excited to grow our platform to extend this so the SecOps teams will be able to derive actionable insights through data aggregation, enabling them to monitor compliance and security across user behaviors and application usage patterns. By streamlining complex processes, security operators can leverage advanced usage analytics and threat intelligence capabilities, allowing them to focus on strategic security initiatives.

#### Continued Commitment to Open Source

Open source is at the heart of Zitadel and we firmly believe in the benefits that open source has. Our commitment to open source fosters innovation, encourages collaboration, and ensures that our platform remains adaptable and extensible. We invite everybody to join our thriving community, contribute to the project, and help shape the future of identity infrastructure.

<img src="/blog/2024-11-20-zitadel-the-future-of-identity-infrastructure-numbers.png" alt="Zitadel By The Numbers" />

### What’s Next

We are eager to set forth on the next part of our journey at Zitadel with our community. Check out our [documentation](https://zitadel.com/docs) or join us on [Discord](https://zitadel.com/chat). You can also stay informed of our updates by following us on your preferred social channel \- [LinkedIn](https://www.linkedin.com/company/zitadel/), [Twitter](https://x.com/zitadel), or [Bluesky](http://@zitadel.bsky.social).

Check out our [documentation](https://zitadel.com/docs)

Join us on [Discord](https://zitadel.com/chat), Follow us on [LinkedIn](https://www.linkedin.com/company/zitadel/), [Twitter](https://x.com/zitadel), or [Bluesky](http://@zitadel.bsky.social)


Zitadel raises $9 million in Series A to advance the future of identity infrastructure to a cloud-native, multi-tenant, and developer-friendly platform.

Zitadel: The Future of Identity Infrastructure


Imagine this: Dave, an IT manager, is responsible for overseeing access for multiple tenants within his company’s cloud service. He has User A from RetailCo and User B from FinanceCorp, both needing access to the same service but with completely different security requirements. User A prefers logging in with their Google account and demands strict password policies. User B uses their company’s Azure AD and requires multi-factor authentication. Dave thought managing a single organization was tough, but this? This is a whole new level of complexity.

As if that wasn't enough, Dave’s company is rapidly growing, introducing more customers from various industries, each with unique compliance and security requirements. Now he has User C from TechInnovators who needs passkeys for enhanced security, and User D from EduWorld demanding seamless SAML integration with their existing single sign-on system. The more tenants Dave’s company takes on, the more convoluted and headache-inducing his job becomes.


## Understanding Multi-Tenant IAM

Implementing multi-tenant Identity and Access management (IAM) systems can be complex, daunting, and filled with hidden challenges. Whether you're addressing the needs of B2B, B2C, or M2M (Machine-to-Machine) environments, multi-tenancy involves a single service instance serving multiple tenants, such as organizations or customers. This requires meticulous data and component segmentation based on service needs and data types. The chaos gets further compounded with individual compliance requirements. 

Consider a simple login screen—two input fields and a button. It looks straightforward, right? But this seemingly simple UI is just the tip of the iceberg. Behind the scenes, there's a multitude of complexities: username and password management, multi-factor authentication options (SMS codes, email codes, authenticator apps), passwordless authentication (face recognition, fingerprint scans), and identity brokering (social logins like Google, Apple, or Facebook).

On top of that, managing security settings, performing regular penetration testing, adhering to standards (such as SCIM, OAuth 2.0, and OpenID Connect), and obtaining certifications (like ISO and SOC 2) add layers of complexity. This is especially true when these features must be replicated across multiple tenants.


<figure>
  <img
    src="/blog/2024-07-25-navigating-pitfalls-of-multitenancy-01.png" 
    width="100%"
    alt="Underneath the simple login form"
    style={{ margin: '0 auto' }}
  />
  <figcaption>

    Figure 1 - Underneath the simple login form lies a multitude of complexities—it's merely the tip of the iceberg

  </figcaption>
</figure>


When you introduce multi-tenancy, everything becomes more complex. Each customer brings their unique requirements—username and password for one, passwordless or multi-factor authentication for another, or integration with existing identity systems like Azure AD or Google Business. These varying needs mean you must be able to configure and maintain diverse systems for each tenant, requiring significant time, expertise, and resources.

<figure>
  <img
    src="/blog/2024-07-25-navigating-pitfalls-of-multitenancy-02.png" 
    width="100%"
    alt="The layers of complexities"
    style={{ margin: '0 auto' }}
  />
  <figcaption>

    Figure 2 - The layers of complexities behind the the multi-dimensional aspects of multi-tenancy

  </figcaption>
</figure>

Let’s look at a real-world example. Imagine you run an online store serving end consumers, business partners, and your workforce. Each group has different needs: consumers need a user-friendly login and account management system, business partners (such as other sellers) might use their existing enterprise identity systems and may have their own branding requirements, and your workforce needs robust role and permission management to secure administrative tasks.

Yes, it’s possible to manage all these requirements with roles and permissions. However, when you consider the need for different security settings, it often makes more sense to adopt a multi-tenancy approach. As you scale to multiple customers, each one may require unique domains, branding, social logins, and security settings. Managing these variations with a roles and permissions model becomes increasingly complex and unwieldy. Multi-tenancy offers a more streamlined and efficient solution, allowing you to handle these diverse needs effectively and securely.

Questions to ask when dealing with multi-tenancy include: How many levels of tenancy do you need? Are there multiple organizations within a tenant? What scenarios are you dealing with (B2C, B2B, mixed)? Each user group might need different authentication methods, security policies, and compliance requirements (e.g., GDPR, SOC 2, ISO).

Consider the example of a healthcare application where different tenants have varying password hashing requirements (PBKDF2, Argon2, bcrypt) and audit trail needs. Protocol-specific differences also arise; for instance, integrating customers’ existing Azure AD for user federation can lead to numerous configurations and requirements.

So, do you explain outdated or incorrect policies to each customer, or make your software flexible enough to handle these diverse needs while focusing on your business case? Ideally, you want to provide a robust, flexible platform that can accommodate different configurations and compliance requirements.

From an architectural perspective, you have two main options: shared systems or dedicated systems. Shared systems are cost-effective and simpler to manage but come with lower isolation, potential security risks, compliance challenges, and performance issues. Dedicated systems offer enhanced security, compliance, and customization but require more management, infrastructure costs, and personnel.

In summary, identity infrastructure involves much more than just two input fields and a button. It's intricate plumbing work, particularly with multi-tenancy. Always remember that the customer is king: guide them on security best practices, but also ensure your infrastructure can meet their unique needs. A proven track record in security is essential for enterprise deals, so regular penetration tests and certifications are crucial. Make use of established frameworks like OAuth 2.0 and OpenID Connect, and rely on an existing IAM product, such as ZITADEL, for authentication and authorization instead of building your own from scratch.


## How ZITADEL Handles Multi-Tenancy


ZITADEL has a strong focus on supporting SaaS providers with a multi-tenancy use case. This is achieved by allowing multiple organizations within your ZITADEL instance, where all customers can self-manage their own users and roles. ZITADEL operates as a shared system, but it also allows for virtual instances and separate organizations within each instance. This setup is particularly beneficial for B2B app providers where

- you sell your application to other businesses, where each business wants to manage their own users, roles, and access settings
- your customers have different needs for the login flow, such as unique branding, federated logins, password policies, and MFA options
- your customers want to self-manage their users and roles without relying on your administrative team
- users/employees of your customers need to log in or register independently
- not all customers have the same feature set within your application


## How Does Multi-Tenanacy Work in ZITADEL


### Create Organizations

For each customer, create an [organization](https://zitadel.com/docs/concepts/structure/organizations), the equivalent of a tenant, in ZITADEL. Assign an [organization manager](https://zitadel.com/docs/guides/manage/console/managers) to let each customer manage their users independently. Furthermore, users can belong to multiple organizations and switch between them using the same identity, simplifying user management and improving the user experience.

### Custom Configuration

Customers can configure their login look and feel ([branding](https://zitadel.com/docs/guides/manage/customize/branding), [authorization methods](https://zitadel.com/docs/guides/manage/console/roles), [federation](https://zitadel.com/docs/guides/integrate/identity-providers/introduction) or you can do it for them. ZITADEL supports various authentication methods, including [username/password](https://zitadel.com/docs/guides/integrate/login), MFA, and [passwordless options](https://zitadel.com/docs/concepts/features/passkeys). Integrate existing identity providers like Microsoft Azure AD, Google etc., allowing users to log in with their existing corporate credentials.

### Domain Discovery

ZITADEL offers [domain discovery](https://zitadel.com/docs/guides/solution-scenarios/domain-discovery) capabilities, which routes users to the appropriate organization based on their login methods, whether it's a username, email, or phone number. For instance, if a user from "foo.com" logs in, they are routed to the Foo Organization, while a user from "bar.com" is directed to the Bar Organization. This ensures users are authenticated according to their organization’s policies and access settings.


### Project Grants

With [project grants](https://zitadel.com/docs/concepts/structure/granted_projects) (also known as granted projects) your customers can access your project with a subset of roles so they can manage authorizations for their users. Enable granular role management, allowing organizations to assign specific roles and permissions to users based on their needs.



## Standards and Compliance


From a certification and standards compliance perspective, ZITADEL is [GDPR compliant](https://zitadel.com/gdpr) and [ZITADEL’s OIDC library has been certified by the OpenID Foundation](https://zitadel.com/blog/openid-connect-certification). Furthermore, [ZITADEL recently achieved ISO 27001 certification](https://zitadel.com/blog/zitadel-iso-27001-certified) for its information security management system, to maintain the highest standards of information security. ZITADEL assures customers that their data is protected by robust security measures, reflecting global best practices in information security management. 

By providing these capabilities, ZITADEL simplifies the management of multi-tenant IAM systems, ensuring security, flexibility, and ease of use for both administrators and end-users. Moreover, ZITADEL provides support for unlimited users, projects, and applications, making ZITADEL a trusted, secure, and scalable solution for your multi-tenant IAM needs that can grow with your business. 


*This blog post is based on and expands upon the talk "The Perils and Pitfalls of Multi-Tenant Identity Management" from Cloud Native Security Con 2024, North America. For the full discussion, you can watch the video [here](https://www.youtube.com/watch?v=gZHxjnx81WE&list=PLj6h78yzYM2MSAFvjG22ZynvaUs1nnaQJ&index=46).*




This post explores the complexities and solutions of multi-tenant identity management in modern SaaS environments.

Blog.