Delegated access management

Hosted Login

Multifactor Authentication

Passwordless Authentication

Audit Trail

Identity Brokering

Platform

Service Accounts

Features

Easy integration

B2B (Business to Business)

Self Service

Existing identities

Secure authentication

Use Cases

Learn how to install, setup, and use ZITADEL.

Documentation

ZITADEL Cloud

Self-hosting

Trust center

Examples and Guides

Github Repository

Develop

Get Started

Contribute

Roadmap

Changelog

About Us

Jobs

Contact

Company

Read the blog

Sign up

Login

Pricing

Blog

## Introduction
As Zitadel continues to evolve, we are excited to announce several significant changes coming with the release of Zitadel v3.  Our team has been working diligently to enhance Zitadel’s sustainability, performance, and developer experience.  

Today, we are sharing three major updates: 
1. Our transition to AGPL 3.0 license
2. A completely streamlined release process
3. Discontinuation of CockroachDB support

All these changes reflect our ongoing commitment to maintaining a robust, open-source identity and access management (IAM) platform while ensuring its long-term sustainability and focusing our resources where they deliver the most value.
### License Change
With Zitadel v3, we are transitioning from Apache 2.0 to the GNU Affero General Public License v3.0 (AGPL-3.0). This decision was not made lightly, but after careful consideration, we believe AGPL better aligns with our vision for Zitadel's future.
#### Why AGPL 3.0?
The AGPL license ensures that any modifications to Zitadel used to provide a service need to be made available to the community.  This creates a more reciprocal relationship between Zitadel and organizations that leverage and build upon our platform.  It protects the open nature of our project while encouraging contributions back to the community.
#### What This Means for You
For most users and contributors, this change will have minimal impact:
* **For end-users:** If you are only using Zitadel as an identity platform, the license change doesn't affect you.
* **For contributors:** Your future  contributions will be licensed under AGPL-3.0 and we will introduce a contributor license agreement (CLA).
* **For service providers:** If you modify Zitadel and provide it as a service to others, you'll need to make your modifications available under the AGPL-3.0 license.
* **For developers:** If you are using our Examples, Libraries, SDKs, APIs, do not worry we will keep those under their existing license.

Our commercial licensing options remain available for organizations that require different terms. Please reach out to us if you have any questions about licensing.

If you have more questions we compiled a detailed [blog post](https://zitadel.com/blog/apache-to-agpl) and an [FAQ](https://zitadel.com/license-faq) for you.

I will also be hosting a Community Office Hours session on [Discord](https://discord.com/events/927474939156643850/1344022255759528027) on **March 25 at 15:00 UTC |  08:00 US Pacific** to help answer questions from the community.

### Release Streamlining
We are excited to announce a completely revamped “fast release” process that will bring new Zitadel features to you more quickly and make updates more manageable for our users.
#### What’s Changing
We are introducing a process that's more agile and responsive to user needs.  Instead of our current approach that can result in larger releases with many changes at once, we are moving to:
* Major releases (v3, v4, etc.) every 3 months
* New minor releases (v3.1.0, v3.2.0, etc.) every 2 weeks
* Patch releases  (v3.0.1, v3.1.1, etc.) whenever needed, particularly for bug fixes
* Release candidates (RC) before each major release that you can test before production
* Creation of a new release branch after each release while approved PRs are merged into the main branch for the next release
* Backward compatibility between minor releases
#### Benefits
These improvements translate to tangible benefits:
* Features are available fast for testing while the release schedule clearly indicates when a version is ready for production deployments
* Opportunity to test release candidates in your environment before production releases
* More predictable planning for your upgrade cycles
* Faster security patches and bug fixes when needed

For organizations using Zitadel in production, this means less operational overhead and more reliable planning for upgrades.

_This process is also detailed in [this GitHub announcement](https://github.com/zitadel/zitadel/discussions/9417) in our repo._
### Discontinuing CockroachDB Support
After careful consideration, we have made the decision to discontinue support for CockroachDB in Zitadel v3 and beyond.

While CockroachDB is an excellent distributed SQL database, supporting multiple database backends has increased our maintenance burden and complicated our testing matrix. By focusing on a single primary database technology, we can:
* Deliver well optimized performance
* Provide more database-specific features
* Simplify our codebase and reduce potential bugs
* Concentrate our resources on core feature development

_This has been detailed in [this GitHub issue](https://github.com/zitadel/zitadel/issues/9414)._
#### Alternatives and Migration Path
Moving forward, Zitadel will standardize on PostgreSQL as our recommended database backend. For existing CockroachDB users, we have prepared a [migration guide](https://zitadel.com/docs/self-hosting/manage/cli/mirror) to help you transition smoothly.  We will provide more detailed instructions specific to the CockroachDB to PostgreSQL migration in our documentation following the release of Zitadel Version 3.
#### Support During Transition
We understand this change may impact your operations. To ease the transition, CockroachDB support will continue in maintenance mode for Zitadel v2.x until September 30, 2025.  Our team is ready to assist with migration questions; please feel free to respond to [this GitHub issue](https://github.com/zitadel/zitadel/issues/9414) or post a question on [Discord](https://zitadel.com/chat).
### What Do These Changes Mean?
#### Immediate Actions
If you're currently using Zitadel, here's what you should do:
1. Review our licensing [FAQ](https://zitadel.com/license-faq) to learn if and how the license change to AGPL 3.0  affects your use case
2. If you are using CockroachDB, start [planning your migration](https://zitadel.com/docs/self-hosting/manage/cli/mirror) to PostgreSQL
3. Test the v3 release candidates in your non-production environments when available
#### Long-term Benefits
These changes, while significant, set the foundation for Zitadel's continued growth and improvement with a more sustainable open-source model, fast and plannable development cycles, improved performance and reliability, and simplified maintenance and upgrades.
#### Looking Forward
Zitadel v3 represents more than just these changes—it is a significant step forward for our platform.  With these foundational improvements in place, we are excited to focus on new capabilities:
* Enhanced developer experience with improved APIs and SDKs
* More advanced authentication options
* Deeper integration capabilities
* Expanded compliance certifications
* Improved performance and scalability

We are also expanding opportunities for community involvement. If you are interested in contributing to Zitadel, now is an [excellent time to get involved](https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md)!
### Conclusion
The changes announced today—our move to AGPL-3.0, streamlined release process, and focused database support—represent our commitment to building a sustainable, high-quality identity platform that meets the needs of modern organizations.

We deeply appreciate your support as we continue to evolve Zitadel. Your feedback and contributions have been invaluable in shaping our direction.
For more information about these changes, please visit our documentation, join our community Discord, or reach out to our team directly. We're here to answer your questions and help ensure a smooth transition to Zitadel v3.
Thank you for being part of the Zitadel community!

Have questions or concerns? Join the discussion on [Discord](https://discord.com/channels/927474939156643850/1349516328867729498) or [contact us](mailto:product@zitadel.com) directly.

As Zitadel continues to evolve, the team announced several significant changes coming with the release of Zitadel v3, including a licensing update, streamlined releases, and standardization on PostgreSQL

Zitadel v3: AGPL License, Streamlined Releases, and Platform Updates

When choosing the right authentication provider for your application it can be hard to narrow down one that works not just for your organization internally but also for your customer and partners. Recognizing the diverse needs of a modern identity management system that is both flexible and secure can become an overwhelming task, especially in a market that offers a plethora of alternatives. That’s why it is important to understand the value proposition of the vendor offerings and evaluate how they fit your organizational requirements.

In this article, we will do a quick comparison of the two alternatives - Auth0 by Okta and Zitadel.

# Introduction: Auth0 (by Okta) and Zitadel
## Auth0 by Okta
Auth0 by Okta (referred to as Auth0 in the rest of the article), is a well-reputed Identity and Access Management solution. It historically has had a strong developer focus and supports a variety of use-cases and integrations. Auth0 is a pure SaaS-oriented, closed-source platform. You have the option to get dedicated setups referred to as "private cloud" that reside on popular hyperscalers. The pricing is oriented around tiers and monthly active users with a free tier for small scale developer projects. Auth0 supports the standard integration protocols like OpenID Connect, SAML 2.0 and WS-Fed.
## Zitadel
Zitadel is an API-first identity platform that is built for developers. It offers easier integration into your tech stack to support the authentication, authorization, and self-service needs.  Offered as an open source and a commercial solution, it also provides a long-term audit trail out-of-the-box to ensure the security and compliance posture for your organization. Zitadel is offered in free and cloud subscription tiers, along with a self-hosted version for organizations that require complete data ownership. Zitadel’s comprehensive identity platform supports business-to-business (B2B) use cases including multi-tenancy, identity brokering, multi-factor or passwordless authentication, delegated access management, and in-context audit trail. Zitadel supports the standard integration protocols such as OpenID Connect, SAML 2.0, and OAuth 2.0.
## Core Differences
### Source Code
Auth0 and Zitadel have quite a big difference in regard to their position of publicizing their source code. Auth0 is closed source project and Zitadel is an open source project. Up to version 2, Zitadel leveraged the Apache 2.0 license but will  transition to the GNU Affero General Public License v3.0 (AGPL-3.0) with the upcoming version 3. The AGPL license ensures that any modifications to Zitadel need to be made available to the community. This creates a more reciprocal relationship between Zitadel and organizations that leverage and build upon our platform. It protects the open nature of our project while encouraging contributions back to the community.

For most of Zitadel’s community, this change will have minimal impact:

**For end-users**: If you are only using Zitadel as an identity platform, the license change doesn't affect you.
**For contributors**: Your future contributions will be licensed under AGPL-3.0 and we will introduce a contributor license agreement (CLA).
**For service providers**: If you modify Zitadel and provide it as a service to others, you'll need to make your modifications available under the AGPL-3.0 license.
**For developers**: If you are using our Examples, Libraries, SDKs, APIs, do not worry we will keep those under their existing license.

Our commercial licensing options remain available for organizations that require different terms. Please reach out to us if you have any questions about licensing, we have compiled a detailed [blog post](https://zitadel.com/blog/apache-to-agpl) and an [FAQ](https://zitadel.com/license-faq) for you.
### Operating Model
While Auth0 operates in a SaaS model with the option to get a private cloud system on one of the well-known hyperscalers, Zitadel operates under an [Open SaaS ideology](https://digitalassetmanagementnews.org/features/the-rise-of-open-saas-and-its-implications-for-digital-asset-management/) (SaaS built with OSS). As an open-source solution, Zitadel can be self-hosted, giving organizations complete control over their data and infrastructure. Zitadel also offers the ability to run a dedicated instance or support to our customers who are in need to self host. If you are trying to decide between cloud or self-hosting, we recently wrote a blog post laying out the pros and cons of [self-hosting and a cloud approach](https://zitadel.com/blog/cloud-or-selfhosted). 
### Pricing
Auth0 offers by default a “Monthly Active User” pricing strategy. A common frustration for customers is that Auth0 bases its billing on peak usage rather than actual real-time consumption, which usually results in unanticipated costs. This, in combination with the need to pay extra for security features like multi-factor authentication makes it a costlier option. The user-based pricing offers an easier starting point but the fact that critical security features are only available in higher tiers hides the true cost for production-ready scenarios.

Zitadel’s pricing model is tailored to your organization’s needs, focusing on three core elements: Support Level Agreements (SLA), Daily Active Users (DAUs), and Technical Account Management (TAM). We include essential features such as multifactor authentication and passkeys at no additional cost, and we don’t charge based on the total number of users stored in your system. 
### Project Structure
Zitadel has a unique way to group clients that belong to the same security context into what we call “Project”. Projects help users bundle together clients, for example a web-application and a mobile-application, that share the same authorization mechanics. This ensures developers see consistent results across all clients without needing to manually configure audience scopes. The project allows you to delegate the access control and permission management to a third party. More details on how our “project grants” work [are here](https://zitadel.com/docs/apis/resources/mgmt/project-grants). 

Auth0 currently lacks functionality to manage applications as a cohesive group.
### Self Service
While Auth0 provides authentication interfaces for sign-up, login and password reset, it lacks broader self-service capabilities such as user profile page or ability to manage users as business partners. In contrast, Zitadel offers comprehensive  self-service capabilities including user profile management, access control delegation, and the ability for business customers to configure their own identity providers.
### Data Residency
When creating an Auth0 tenant, you must select one of four geographic regions for data storage:  US, Europe, Japan, or Australia. Auth0’s region selection is not easily modifiable after initial setup, and this single-region architecture may increase latency for customers accessing services from other geographic regions.

Zitadel offers flexible data residency options with hosting regions the United States, Europe, Switzerland, or Australia. Organizations can deploy multiple instances across different regions to optimize global coverage. For strict data residency requirements, Zitadel supports regional cloud hosting and self-hosted deployments, giving organizations complete control over their data location and security protocols. Many of our enterprise customers choose self-hosted deployments to maintain maximum control over their infrastructure and data governance. 
### Location of Incorporation
Auth0, incorporated in the United States, was acquired in 2021 by Okta which is also incorporated in the United States. With headquarters in the United States and a principal office in Switzerland, Zitadel provides flexible contracting options through its dual-entity structure. Organizations serving European Union customers can contract through Zitadel's Swiss entity, leveraging Switzerland's data protection adequacy status granted by the European Commission. This simplifies EU data transfer compliance compared to the more complex requirements for US-based providers.
### Extensibility
Zitadel and Auth0 both have Actions to support extensibility through debugging and logging capabilities. Zitadel’s event-driven architecture enables organizations to customize workflows by responding to any authentication or audit event. The Zitadel platform’s Session API and Login Experience features offer extensive customization options for both functionality and branding to align with your organization’s requirements. As a fast-growing open-source company, Zitadel rapidly incorporates customer feedback through strategic partnerships and contributions on GitHub.
![](https://cdn.sanity.io/images/y3uu7rkl/production/e912fbcd18d080b3749cc3646171bdb1e8714f55-1024x768.png)

## What’s Next for Zitadel: Development Priorities for 2025
Zitadel maintains a [public product roadmap](https://zitadel.com/roadmap) and operates with full transparency as an open-source platform. It includes significant feature releases planned for platform development and performance optimization in 2025.  
### Performance Optimization:
Comprehensive platform-wide performance enhancements that focus on core authentication service response times, API endpoint optimization across new and existing services, enhanced resource management efficiency, and improved system scalability. 
### TypeScript Login with OIDC: 
A new, highly customizable login interface for our customers, built in with [TypeScript and OpenID Connect](https://zitadel.com/blog/typescript-login) support. Self-hosting customers will soon be able to use the hosted login option with OIDC.
### User Schema Management: 
This feature offers [advanced user profile customization](https://zitadel.com/blog/end-of-year-product-wrap-up#:~:text=informed%20through%20our-,GitHub%20Product%20Roadmap%20Epic,-.) enabling granular control over field management permissions between users and administrators. 
### Configurable Caching System: 
Beta release of [flexible caching infrastructure](https://zitadel.com/docs/self-hosting/manage/cache) supporting Redis integration for improved object lookup performance.  
### SCIM Integration: 
This is the [implementation](https://github.com/zitadel/zitadel/issues/8140) of System for Cross-domain Identity Management (SCIM) protocol for automated user provisioning, synchronization, and lifecycle management across external systems. 
### Actions Framework v2: 
This [feature](https://github.com/orgs/zitadel/projects/6/views/1?pane=issue&itemId=50259306&issue=zitadel%7Czitadel%7C7235) offers enhanced extensibility framework supporting custom triggers and executions through API endpoints for advanced workflow customization. 
### User Group Authorization: 
The implementation of [user group management](https://github.com/orgs/zitadel/projects/6/views/1?pane=issue&itemId=48898543&issue=zitadel%7Czitadel%7C5822) capabilities enable efficient authorization management at scale, expanding beyond individual user permissions. 
## Decision Framework: 
Zitadel is particularly suitable for organizations that prioritize these capabilities:
### Security and Control:
Your organization requires complete control over infrastructure through self-hosting options, and you need robust data protection measures. Zitadel’s comprehensive audit trails provide detailed long-term tracking of all authentication and authorization activities.

### Business Architecture:
Zitadel excels in multi-tenant environments, making it ideal for organizations managing multiple client organizations or separate business units. Zitadel’s B2B-focused approach is designed to handle complex organizational relationships and hierarchies.

### Technology Philosophy:
If your organization values open-source solutions, Zitadel offers full transparency and the ability to customize the platform to your needs. It is built on cloud-native and serverless principles, making it a natural fit for modern, scalable architectures.

### Community Engagement:
As an open-source platform, Zitadel welcomes direct contributions from its user community. This means you can actively participate in improving the platform and adapting it to meet emerging needs in identity management.
## Take Control of your Identity Infrastructure
Transform your organization’s identity, authentication, and access control with Zitadel.  Connect with our team to:
* Assess your current identity infrastructure needs
* Design a tailored implementation strategy
* Learn how to scale seamlessly as your organization grows

Book a consultation today to start your journey towards simplified, secure identity management.
<CTA
	label={'Book a Consultation'}
	href={'https://meetings-eu1.hubspot.com/jason-burkhead/zitadel-discovery-call'}
	external={false}
	layout={'primary'}
	noreferrer={false}
	align={'center'}
/>

Please [share your feedback](mailto:hi@zitadel.com) to ensure this guide remains accurate and valuable for the community. Your insights help us maintain the quality and relevance of our documentation.



Understanding why Zitadel is the best Auth0 (by Okta) alternative and how it best fits your organization in comparison to Auth0 will ensure a streamlined deployment and authentication experience for your organization and customers.

Zitadel vs Auth0: The Definitive Comparison for Enterprise Identity Infrastructure


At Zitadel every customer is granted their own virtual instance with unlimited identities that allows them to fully configure their instance to their needs. This includes choosing a deployment option which is most suitable for the unique needs, security requirements, budget, and resources of each individual organization.

Unlike most Identity and Access Management (IAM) offerings available today (such as Auth0 by Okta, Keycloak, etc.) Zitadel officially offers flexible deployment options – to deploy in Zitadel Cloud or to self-host in your preferred location. In this article, we will discuss our Cloud and self-hosted options to help you find the right solution for your project or business.

## Convenience and Speed-to-Market: Zitadel Cloud

### Pros:

Our public cloud option is ideal for any user who is intrigued by the idea of a hosted deployment model that is ready-to-use the moment you obtain it. Unlike the self-hosted alternative, Zitadel Cloud is pre-configured and automated, saving you the time and money spent on implementing, managing, and maintaining your platform. A virtual instance will automatically upgrade with new product improvements and security fixes without your intervention.

You also do not have to worry about expanding your infrastructure when your service gains new customers or sees usage spikes. Zitadel Cloud can help scale and handle resource allocation for you. A notable benefit also lies in the possibility of choosing a region that works best for your project to stay close to your users. The Zitadel platform is built to manage traffic from a global audience or constrain data to only a certain location, depending on your organization's needs. Both scenarios are possible through Zitadel Cloud, while we optimize and guarantee low latencies and high availability.

With the Zitadel Cloud, you also benefit from the operational security aspects, such as Distributed Denial of Service (DDoS) attack protection and automated certificate management. Zitadel is an open source platform and has the same open source releases available to both our cloud and self hosted environments. We take security seriously and go above-and-beyond so we take pride in publishing the results of our [penetration tests](https://zitadel.com/blog/pentest-results-h1-2021) done by external auditors, as soon as we mitigate issues.

As a “cherry on top”, we offer a true pay-as-you-go subscription method to keep the total cost of ownership (TCO) affordable to even strict budgets.

### Cons:

There are certain weaknesses relying on a Cloud deployment, which are easily outweighed by the convenience of a pay-as-you-go subscription for most customers. While most customers are satisfied with our infrastructure in terms of cloud provider and data location options, some want to choose their own infrastructure providers or data location. In this case self-hosting is the best option (we also partner with managed service providers in some areas if a dedicated instance of Zitadel is the preferred option). Both options are also viable in case a customer requires more flexibility of upgrade cycles or backup frequencies.

A common weakness in today's software is supply chain risk, where our open source model provides extraordinary transparency of code, dependencies, and processes, yet a customer relies on the quality of our technical and organizational measures to manage information security. We are continuously improving our information security and are ISO27001 certified. If your organization requires complete control over the technical and organizational measures, you should choose to self-host Zitadel.

Another challenge in a Cloud deployment lies in its less flexible options out of the box. While companies mostly offer a wide variety of templates to choose from, their number can't compete with the infinite customization possibilities that come with building your own platform. We do not recommend building your own identity management system, rather we promote our platform approach where customers can easily extend functionality of the platform by loosely coupling new components. This is supported by [Zitadel’s API-first approach](https://zitadel.com/docs/apis/introduction), SDK's in [various languages](https://zitadel.com/docs/sdk-examples/introduction), and programmatic extensibility through [Zitadel Actions](https://zitadel.com/docs/guides/manage/console/actions).

The summed-up benefits of Zitadel Cloud include:

- Receive a pre-configured and implemented platform – no need to bother with updates, backups, maintenance, and troubleshooting
- Operational security provided
- Automated backups and updates
- Availability guarantees and automatic scaling
- “Pay as you go” model with low total cost of ownership
- Choose the region that works best for you
- Technical support from the creators - we are here to help

## Complete Control: Self-hosted

### Pros:

Unlike Zitadel Cloud, the self-hosted version is hosted by you on your infrastructure. In the case of Zitadel, companies or individuals can deploy Zitadel on their preferred cloud provider or install it as an on-premise solution; Both of these options allow our customers to take full control over all aspects, instead of having to rely on our infrastructure and our technical and organizational processes. Zitadel is based on cloud-native principles and is designed to be deployed as containers, which makes it straightforward to run and operate on almost any platform.

Self-hosting is a great choice if you have the resources to set up and host your own Zitadel instances on custom infrastructure with your company's needs in mind. If implemented correctly, the features of a self-hosted platform even have the potential to surpass the security possibilities of Zitadel Cloud, making it an ideal alternative for firms working with sensitive data.

The key benefits of self-hosting include:

- Manage your platform with full control in your own cloud or hardware
- Be in control of your technical and organizational measures
- Fully customizable platform
- Self-hosting organizations can get commercial technical support with an SLA
- Highest possible security, if implemented accordingly

### Cons:

The setup cost and maintenance are often downsides of self-hosting, we recommend choosing this solution if your company already possesses internal resources to handle the hosting and is ready to pay the investment and upkeep. While we at Zitadel are happy to help with any issues, “support” still needs to be considered especially around the technical aspects of self-hosting. The responsibility of adequately hosting the platform lies solely in the hands of the company.

We also tend to discourage self-hosting your identity platform without an in-depth IT-knowledge. As the security measures must be manually installed and maintained, mistakes in the implementation can potentially lead to inadequate protection from intruders.

<figure>
  <img
    src="/blog/2025-02-04-zitadelcloudvsselfhosting.png"
    width="100%"
    alt="Figure 1: Benefits of Zitadel Cloud vs. Zitadel Self-Hosted"
  />
</figure>

## Which option to choose?

While both deployment options have their respective advantages, the self-hosted alternative will most likely benefit companies that aim to fulfill some very specific requirements or compliance goals. If your organization lacks internal staff with in-depth IT knowledge, the serious dangers of faulty implementation are not worth risking. The advantages of Zitadel Cloud outweigh those of self-hosted options for most organizations and are therefore generally the recommended path to take. For easier decision-making, we created this simplistic chart as a guide:

<figure>
  <img
    src="/blog/2025-02-04-cloudselfhostdecisionchart.png"
    width="100%"
    alt="Figure 2:  Handy Reference Chart to Decide if Zitadel Cloud or Zitadel Self-Hosted is the Right Choice"
  />
</figure>

Whether you choose to use Zitadel Cloud or host Zitadel yourself, Zitadel ensures the best possible deployment experience with its flexible pricing options, comprehensive set of features, guaranteed high security, and unlimited identities for all options. In the future, you can also decide to migrate from Zitadel Cloud to hosting it yourself.

Should you have questions regarding Zitadel Cloud, self-hosting, or any other related (or unrelated) topics, feel free to contact us anytime on our Zitadel [Discord Server](https://zitadel.com/chat), our [Bluesky](https://bsky.app/profile/zitadel.bsky.social), [Twitter](https://twitter.com/zitadel), [Linkedin](https://www.linkedin.com/company/zitadel/) or [GitHub](https://github.com/zitadel/zitadel) pages, or on our [Website](https://zitadel.com/contact).

As you find the project helpful, please be sure to [give us a star over on GitHub](https://github.com/zitadel/zitadel/stargazers).


A blog post detailing the use cases that best suit a self-hosted vs. cloud model for an IAM Platform while demonstrating the flexibility offered by Zitadel

Zitadel Self-Hosted vs. Cloud: Making the Right Choice


We've developed a new TypeScript-based login system to streamline the authentication process for our customers. This solution offers a **flexible**, **customizable**, and **self-hostable** login experience.

By providing a ready-to-use login solution, we aim to reduce development time and effort for our customers. The open-source nature of the project allows for easy customization and adaptation to specific business needs.

Our immediate goal is to enable customers to self-host the login system. In the future, we plan to fully integrate this new login system into our cloud offering, providing a more robust and secure authentication experience. We plan to initiate the first cloud integration by the end of February. New customers will be automatically provisioned with the new cloud-based login. Existing customers will have the flexibility to migrate their entire instance or individual applications at their preferred time.

The new TypeScript login system offers several key improvements:

- **Leverages Modern Technology**: By utilizing our newly developed [session APIs](https://zitadel.com/docs/apis/resources/session_service_v2), we've significantly enhanced the security and performance of the authentication process.
- **Enhanced Features**: The system introduces new features such as user invitation flows and passkey-only authentication, providing greater flexibility and convenience for our users.
- **Improved Developer Experience**: The use of TypeScript, a widely adopted language in frontend development, makes the codebase more accessible and easier to contribute to. This encourages community involvement and fosters rapid development.

## Current State

Our primary goal for the TypeScript login system is to fully replace the existing login functionality within the current Zitadel version, which is shipped with Zitadel default. This will allow us to leverage the benefits of the new system, including its modular architecture and enhanced security features.

To achieve this, we are actively working on implementing the core features currently available in Zitadel, such as:

- **Authentication Methods**:
  - Username and Password
  - Passkeys
  - Multi-Factor Authentication (MFA)
  - External Identity Providers (OIDC, SAML, etc.)
- **OpenID Connect (OIDC) Compliance**: Adherence to the OIDC standard for seamless integration with various identity providers.
- **Customization**:
  - Branding options to match your organization's identity.
  - Flexible configuration settings to tailor the login experience.

The full feature list can be found [here](https://github.com/zitadel/typescript?tab=readme-ov-file#features-list).

As we continue to develop the TypeScript login system, we will provide regular updates on its progress and new capabilities.

<figure>
  <img
    src="/blog/2025-01-21-typescript-login-01.png"
    width="100%"
    alt="Login UI with authentication method loginname, Apple, Google OIDC, Google and GitLab"
  />
</figure>

## Limitations

For the first release we have excluded the following features:

- SAML 2.0 ([IdP](https://zitadel.com/docs/apis/saml/endpoints) & [SP](https://zitadel.com/docs/guides/integrate/identity-providers/mocksaml))
- [Generic JWT IDP](https://zitadel.com/docs/guides/integrate/identity-providers/jwt_idp)
- [LDAP IDP](https://zitadel.com/docs/guides/integrate/identity-providers/ldap)
- [Device Authorization Grants](https://zitadel.com/docs/guides/integrate/login/oidc/device-authorization)
- Timebased features
  - [Lockout Settings](https://zitadel.com/docs/guides/manage/console/default-settings#lockout)
  - [Password Expiry Settings](https://zitadel.com/docs/guides/manage/console/default-settings#password-expiry)
  - [Login Settings - Multifactor init prompt](https://zitadel.com/docs/guides/manage/console/default-settings#login-behavior-and-access)
  - [Force MFA on external authenticated users](https://zitadel.com/docs/guides/manage/console/default-settings#login-behavior-and-access)
- [Passkey](https://zitadel.com/docs/guides/manage/console/default-settings#passwordless)/[U2F Setup](https://zitadel.com/docs/guides/manage/console/default-settings#multifactor-mfa)
  As passkey and u2f is bound to a domain, it is important to notice, that setting up the authentication possibility in the ZITADEL management console (Self-service), will not work if the login runs on a different domain
- [Custom Login Texts](https://zitadel.com/docs/guides/manage/console/default-settings#login-interface-texts) configurations are not used in the typescript login, if you want to customize them, fork the repository and change the texts to you liking

## Beta Testing

The TypeScript login system is currently in the beta testing phase. Your feedback is highly valuable in helping us refine and improve this new solution.

At your convenience please open any issues faced on our [Typescript Login GitHub repository](https://github.com/zitadel/typescript) to report bugs or suggest enhancements while more general feedback can be shared directly to the [corresponding discord thread](https://discord.com/channels/927474939156643850/1329100936127320175/threads/1329827099606782093).
Your contributions will play a crucial role in shaping the future of our login system.
Thank you for your support!

### Steps to start testing

The simplest way to deploy the new login for yourself is by using the [“Deploy” button in our repository](https://github.com/zitadel/typescript?tab=readme-ov-file#deploy-to-vercel) to deploy the login directly to your Vercel.

1. [Create a service user (ZITADEL_SERVICE_USER_ID) with a PAT](https://zitadel.com/docs/guides/integrate/service-users/personal-access-token#create-a-service-user-with-a-pat) in your instance
2. Give the user IAM_LOGIN_CLIENT Permissions in the default settings (YOUR_DOMAIN/ui/console/instance?id=organizations)
   [https://zitadel.com/docs/guides/manage/console/managers](https://zitadel.com/docs/guides/manage/console/managers)
3. Deploy login to Vercel: You can do so, be directly clicking the “Deploy” button at the bottom of the readme in our [repository](https://github.com/zitadel/typescript)
   <figure>
     <img src="/blog/2025-01-21-typescript-login-02.png" width="100%" alt="Deploy to vercel button" />
   </figure>
4. If you have used the deploy button in the steps before, you will automatically be asked for this step. Enter the environment variables in Vercel
   - ZITADEL_SERVICE_USER_ID
   - PAT
   - ZITADEL_API_URL (Example: https://my-domain.zitadel.cloud, no trailing slash)
5. Add the domain where your login UI is hosted to the [trusted domains](https://zitadel.com/docs/apis/resources/admin/admin-service-add-instance-trusted-domain) in ZITADEL (Example: my-new-zitadel-login.vercel.app)
6. Use the new login in your application. To implement the new login, choose one of the following options:
   1. Enable the new login in your application configuration: Add the URL of your new login UI to your application’s settings. Zitadel will automatically redirect users to the new login if they attempt to use the old one.
   2. Enable the loginV2 feature on the instance:Activate the LoginV2 feature in your Zitadel instance and specify the URL of your new login. This will apply the new login for all applications configured under your Zitadel instance. Example: https://my-new-zitadel-login.vercel.app. More details: [Zitadel Documentation](https://zitadel.com/docs/apis/resources/feature_service_v2/feature-service-set-instance-features)
   3. Update the issuer URL in your application configuration: Change the issuer domain in your application configuration to match the new login domain.

For more information read our [Login V2 documentation](https://zitadel.com/docs/guides/integrate/login/hosted-login#hosted-login-version-2-beta)

## Important Notes

- **User Creation**: The new TypeScript login utilizes the Session and User V2 APIs. Note that the User V2 API introduces some changes compared to the V1 API. Ensure you create users using the new V2 API to maintain compatibility.
- **External Identity Providers (IDPs)**: To enable login with external identity providers, such as Google or Apple, follow our existing setup guides. Ensure that you use the following redirect URL: $YOUR-DOMAIN/idps/callback.
- **Passkey/U2F Authentication**: These authentication methods are domain-bound. Since your new login operates on a different domain than the previous one, existing passwordless authentication (e.g., fingerprint, Face ID) and U2F methods cannot be reused. Additionally, when managed through the Zitadel console, they will be tied to the old domain. Note: To avoid this issue, consider running the new login on a subdomain of your current instance (e.g., myinstance.zitadel.cloud and login.myinstance.zitadel.cloud).

## Customization / Feature requests

If you have specific customization needs beyond the current capabilities of the Typescript login offering, please follow one of these two options:

1. **Fork the Repository**: By forking the [Typescript Login](https://github.com/zitadel/typescript) repository on GitHub, you can directly modify the source code to implement your desired features. This offers maximum flexibility and control over the login system.
2. **Build Your Own Login UI**: For full customization control, you can leverage our Session API to build your own login interface. This allows you to create a fully tailored experience that aligns perfectly with your application's design and functionality. A detailed guide on how to use the Session API is available [here](https://zitadel.com/docs/guides/integrate/login-ui).

## Future plans

Our roadmap for the TypeScript login includes several exciting developments:

### Short-term Goals

- **Feature Parity**: We will continue to implement the missing features listed above to ensure seamless migration.
- **Multi-tenancy**: We will enable multi-tenancy to support our cloud offering, allowing new users to directly access the new login experience while existing customers can migrate at their own pace.

### Long-term Vision

- **Self-Service Components**: We plan to introduce self-service components for the users like profile management, making it easier for you to integrate these functionalities into your applications without relying on our full-fledged management console.
- **Enhanced Customization**: We will explore options to further customize the appearance of the login page, allowing you to tailor it to your specific branding and design preferences.

By focusing on these areas, we aim to provide a powerful, flexible, and customizable login solution that empowers your applications.

Now it’s your turn. Do you have any suggestions for [improvement](https://github.com/zitadel/typescript/issues/new?template=improvement.yaml) or [bug reports](https://github.com/zitadel/typescript/issues/new?template=bug.yaml)? Explore the [repository](https://github.com/zitadel/typescript) and share your feedback in our [discord thread](https://discord.com/channels/927474939156643850/1329100936127320175/threads/1329827099606782093).


We've developed a new TypeScript-based login system to streamline the authentication process for our customers.

Introducing our New TypeScript Login


As the snow falls outside here in Switzerland creating a winter wonderland, I am filled with pride looking at the past year’s milestones.  Zitadel has grown in such exciting ways — the features that have been deployed, the product roadmap, the collaboration with our vibrant developer community, partnering with customers from every walk of life, and last but not the least, getting incredible support from our investors.  Each person, team, GitHub comment to the pull requests, Discord discussion have shaped the path to where we stand today!  A heartfelt thank-you to everyone involved.   To say I am thrilled about our next growth phase in 2025 is an understatement! 
 
As we near the last few weeks of 2024, I want to take a minute to reflect and review some of the milestones that made this year one of our best yet!

Before I get to it, I wanted to share our upcoming Discord event on the Back-Channel Logout feature.  If you want to see how it can help you manage your user sessions throughout your identity infrastructure, [register and join us in Discord on December 11th](https://discord.gg/bnuAe2RX?event=1308899625041924127) where [Livio Spring](https://www.linkedin.com/in/liviospring/), Engineer and Co-founder, Zitadel, will give a live demo.

## Zitadel in 2024: Highlights 

- We are [proud to announce](/blog/zitadel-the-future-of-identity-infrastructure) our $9 Million Series A  round of funding in collaboration with Nexus Ventures and Floodgate to advance Cloud-Native Identity Infrastructure.

- We achieved our [ISO 27001 certification](/blog/zitadel-iso-27001-certified) further reinforcing our commitment to security through this internationally recognized standard that confirms our dedication to maintaining the highest levels of security for our customers' data. 

- Zitadel has grown to serve over 150 customers this year such as Klaviyo, Open Systems, Vector Solutions,  and Kaspar&!

- [Zitadel’s Discord Community](https://discord.gg/szfmzC2M) has grown by 93% in 2024 from 1,527 to 2,953 members

- [Zitadel’s Github Repository](https://github.com/zitadel/zitadel) continues to make traction with a 57% increase to 9,100+ Github Stars and another 57% increase of individual contributors to 220+ collaborators across all the Zitadel repositories. 

- Continuing to be a remote-first team, we came together twice this year — in [Italy](/blog/team-retreat-bologna) and [Switzerland](/blog/team-retreat-zurich) — for team get-togethers and planning forward as we level up Zitadel’s future!

## Zitadel in 2024: Product

Looking over the past year we released key features that helped customers across the board in the way they manage their identity infrastructure. 

- **Performance Improvements:** We prioritized stability and scalability enhancements in 2024 to set a solid foundation for our Self-Hosted and Cloud customers.  With some of our customers deploying as many as 2.3 million tenants to manage their identity infrastructure, performance is key.  These enhancements include latency, [benchmark testing](/docs/apis/benchmarks), and reliability on services such as token endpoint and new generation APIs like the [improvedPerformance](/docs/apis/resources/feature_service_v2/feature-service-set-instance-features) field.

- **Easier Integrations:** This allows admins to set up an application in their [framework and programming language of choice](/docs/sdk-examples/introduction) quickly.  Zitadel simplifies the process for the admin’s deployment process of client applications by enabling the use of default settings!

- **Using external SAML IdPs:** This enables admins to level up using external identity providers by defining the preferred nameID format and configuring user mapping in Zitadel based on attributes received from the external IdP.  [Learn more](/docs/guides/integrate/identity-providers/mocksaml) about building using external SAML IdPs.

- **Setting up Email Providers:** This was accelerated greatly thanks to our open source community.  This feature makes it easier to configure email delivery even faster within Zitadel through SMTP provider templates.  [These templates](/docs/guides/manage/console/default-settings#smtp) offer pre-defined settings for popular email service providers (ESPs) like Amazon SES, Mailgun, Mailjet, Postmark, Sendgrid, and a Generic SMTP option.

- **Managing OpenID Connect Signing Web Keys:** This became much easier with Zitadel taking the lead to create keys without expiry for each instance.  Now users can create, rotate, and disable signing Keys via API at your discretion as [documented here](/docs/guides/integrate/login/oidc/webkeys).

- **Organizational Metadata:** This allows developers to use the org’s metadata in the [complement token flow](/docs/apis/actions/complement-token) in Actions as well as include a user’s organization metadata into tokens that can be read by receiving applications. 

- **New Password Expiry:** Policies came out in mid-2024 to aid organizations to require users to change their passwords on a routine basis. [This feature](/docs/guides/manage/console/default-settings#password-expiry) can be used quickly through the Console UI at both instance and organization levels. 

- **New Sample Apps:** We prioritized building out sample apps in [VueJS](https://github.com/zitadel/zitadel-vue), [PHP](https://github.com/zitadel/example-symfony-oidc), and [Java](https://github.com/zitadel/zitadel-java) in the beginning of 2024 to make getting started with authentication and authorization easier with these specific examples and guides.

- **Back-Channel Logout:** This is a feature that resides on the server-side and does not require the user agent to be involved. Through [back-channel logout’s](/docs/guides/integrate/login/oidc/logout#back-channel-logout) ability it has the user logged out from all clients in the event that the authenticated session gets terminated. 

- **Four New Translations added to the Zitadel platform** with **Hungarian**, **Indonesian**, **Swedish**, and the latest being **Korean** thanks to the recent addition from our community contributor [Kim JeongHyeon](https://github.com/KimTibber)!

- **New Translations added to Upcoming Typescript Login** to include **German**, **Spanish**, **Italian**, and **English**.  If you’re not seeing the language of your choice, please request or collaborate with us directly on our [GitHub](https://github.com/zitadel/typescript/tree/main/apps/login/locales).

## Zitadel in 2025: Vision

For 2025, we are focusing on three key areas to enhance the Dev and SecOps experience:

- **A Seamless Onboarding Journey:**  Our goal is to make your first integration with Zitadel as smooth as possible.  We are working on intuitive APIs, comprehensive examples and SDKs, flexible user management tailored to your use case, and streamlined deployment and maintenance processes.

- **Enterprise-Grade Performance and Scalability:** We are committed to making Zitadel a highly scalable and performant identity infrastructure.  This includes linear scalability to meet your growing needs, easy upgrades for business continuity, and efficient user management with group administration and standardized provisioning/deprovisioning capabilities.

- **Proactive System Insights:** We empower you with the tools to proactively monitor and manage your Zitadel environment.  This includes seamless integration with your SOC/SIEM systems, real time system health insights, and user analytics to identify potential issues before they impact your customers.

## Zitadel in 2025: Product 

As we look to the future, we’ve got a wide range of exciting new features on the horizon! 

- **Performance Improvements:** This remains a top priority for the team as we continue to strengthen Zitadel’s core authentication capabilities, the platform’s existing & new API endpoints, and resource management across the board. 

- **New Typescript Login including OIDC:** This allows admins to enhance their Zitadel instance with a ready-to-deploy login that is highly customizable.  [Read the GitHub Product Roadmap Epic here](https://github.com/orgs/zitadel/projects/6/views/1?pane=issue&itemId=50833557&issue=zitadel%7Ctypescript%7C46).

- **User Schemas:** This feature offers flexibility when managing user details from user- and admin- perspective by allowing to define the fields that are allowed to be managed by a user and the ones that are to be managed by admin.  Stay informed through our [GitHub Product Roadmap Epic](https://github.com/zitadel/zitadel/issues/6433).

- **Configurable Cache Options:** This was the last beta feature of 2024 that enables speedy lookup of objects that are often needed by storing them in cache, like Redis.  [Take it for a spin](/docs/self-hosting/manage/cache) before it becomes generally available in 2025 and [share your feedback](https://discord.com/channels/927474939156643850/1309157792292012063/1309158011469692958).

- **SCIM (System for Cross-domain Identity Management):** This is the standard for inbound user-provisioning so other systems can automatically provision and manage users within Zitadel.  This allows creation, update, and deletion of users based on user data changes in the external system and streamlines user management across systems ensuring consistent user states. To dig deeper into this feature, read the [GitHub Product Roadmap Epic here](https://github.com/zitadel/zitadel/issues/8140).

- **Actions v2:**   This feature will allow you to extend Zitadel with custom executions and triggers through API endpoints as you look to make the most out of your Zitadel instance.  Check out the [GitHub Product Roadmap Epic](https://github.com/orgs/zitadel/projects/6/views/1?pane=issue&itemId=50259306&issue=zitadel%7Czitadel%7C7235) to find out more.

- **User Group Authorizations:** Through this feature Zitadel expands past the managing users individually and now offers groups to enable authorizations as a wider scale for user management. To follow along on this feature delivery in 2025, review the [GitHub Product Roadmap Epic](https://github.com/orgs/zitadel/projects/6/views/1?pane=issue&itemId=48898543&issue=zitadel%7Czitadel%7C5822).

## Community & Feedback Opportunities

As always, we appreciate and welcome your feedback.  It helps us shape our product roadmap and build a robust platform that caters to your needs: 

- If you are interested in a sneak peek at our User Schemas update, and would like to share your feedback, please email [Jim@Zitadel.com](mailto:Jim@Zitadel.com)

- Please share your feedback and experiences with our Community team by [scheduling some time here](https://calendar.app.google/UgTzLndLKKMk7BYp8)

- If you are using Zitadel today, please add yourself to the [Adopters](https://github.com/zitadel/zitadel/blob/main/ADOPTERS.md) list with a short description of your use case by opening a pull request and adding a section describing your usage of Zitadel.

- If you are interested in contributing to Zitadel, please review our [Contributing Guide](https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md) to collaborate with us.

Have a look at our great product enhancements of 2024 and what is ahead for 2025.

End Of Year Product Wrap Up 2024


As an open source organization with strong community roots, we want to ensure that the care, intention, and nurturing that we pour into our product is also reflected within our team. Back in May of 2023, we held our first retreat, taking initial steps towards becoming a fully remote, global company. Fast forward to November 2024, we’ve grown from a small unit to a team of almost 20 fully distributed professionals across the globe. Along the way, we’ve made meaningful strides towards curating a strong sense of belonging while cultivating our remote work culture. Our efforts really come to life at our biannual off-sites where we’re all able to reconnect in person. Off-sites are one of many ongoing cultural rituals that allow us to work on the four Cs:  Collaboration, communication, connection, and . . . carbs **(yes, seriously —  stay with me, more on this in a second)**. 
 
## Pre-Arrival

Three days before everyone was set to fly out, we found ourselves needing to make a 1000+ kilometer change to our plans (we originally planned to go to Valencia, Spain). With time against us, we had to quickly rebook flights, shift the location of our activities and accommodations — all of this in less than 1 week. With some team members up to 8000 km away, this last-minute change really tested our ability to be communicative and adaptable. (In hindsight, this felt like an almost impossible task but we did it!)

Despite this being a logistical nightmare & having tight timelines, we were really able to come together as a team and push this through to success on such short notice. Adding on to a whirlwind of a week, illnesses, personal emergencies, and hurdles popped up that threatened to fully derail our upcoming trip. What could have been the end of our plans gave us an opportunity to show how far we’ve come as a remote-first team. We were operating like a well-oiled machine—leadership quickly went to work preparing a compact action plan, while team members supported each other with rebooking flights and figuring out how to navigate locally. From the warm, sunny coastlines we planned to visit to the cool, cozy vibes of Zurich -  the chaos gave us the opportunity to not only show resilience through challenging circumstances but also our ability to adapt and thrive together. 
 
## Arrivals

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-01.jpg" width="100%" alt="Nine Zitadel staff members smiling and posing at a bar near the Zurich opera house, with drinks on the table." />
</figure>

With our travel toils behind us, we began our journey to Zurich. For those already stationed in Switzerland, getting to Zurich wasn’t too much of a hassle. For others, it meant 20+ hours of travel - an experience best summarized as "amazing, spectacular, 10/10, would do again". Can you hear the sarcasm? The excitement to meet our co-workers in person surpassed the jet lag & weariness with all of us finally uniting in the evening. With early arrivals already at the hotel and others still on the way, a smaller group of us met near the opera house, where the view of the water at sunset provided a stunning backdrop for some great photos. We all quickly caught up (and met some new teammates!) before continuing on a short walk to the jazzy, goat-themed Widder Bar where the rest of team Zitadel joined us.  

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-02.jpg" width="100%" alt="Table at Raclette Stube with wine glasses, a fondue pot, and plates of vegetables, meat, raclette, and potatoes." />
</figure>

Light banter, warm introductions, and plenty of jokes set the tone for our evening as we made our way to Raclette Stube. We all ate to our heart's content - with some of us experiencing raclette for the first time and others opting for the very classic fondue. After the night's festivities, most of us felt like we turned into a ball of cheese.

That first evening together melted away the strain of those last minute changes, leaving us recharged & ready to dive head first into the rest of a very promising retreat.
 
## Activities & Exploration

After we settled in, our retreat really started on day 2 with a series of workshops led by some of our incredible internal subject matter experts.
Our new product marketing manager, Jim, opened up our sessions with an engaging discussion around our documentation and how it is crucial to your (yes, you, dear reader) Zitadel experience. Following Jim, our head of sales, Jason, broke down the sales process for our engineering team - delving into our processes, how we map customer needs while giving us a quick overview of negotiation tactics, and relationship building.

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-03.jpg" width="100%" alt="Zitadel staff in a meeting room, attentively watching Jason, the head of sales, present his workshop." />
</figure>

Next, Silvan and Max came in with well crafted & informative workshops focused on engineering. Silvan, through a hilarious presentation, provided much needed insights into Zitadel’s performance and detailed next steps on how we plan to improve it. Max gave a detailed overview of the new Typescript login, its implementation, and how it fits into creating an exceptional user experience. Our workshop series ended with our CEO, Florian, breaking down venture capital and offering a clear picture of where we currently are as a company [(check out our latest funding announcement!)](https://zitadel.com/blog/zitadel-the-future-of-identity-infrastructure)

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-04.jpg" width="100%" alt="Group hiking with those at the front smiling at the camera, while others straggle behind, surrounded by lush greenery." />
</figure>

With our workshops wrapped up, we took a casual stroll through Zurich that included us raiding Migros and Coop (a Swiss rite of passage). We tested our limits with an “intense” hike (spoiler: some of us fumbled on the beginner trail and felt winded at the end of it). The stunning views, adorable cows, and fresh air made every step of that hike worth it.

In the days that followed, we explored Lucerne where some of us shopped for souvenirs, crossed Kapellbrücke (with Florian providing important historical context), and wrapped up that day with a breathtaking ride up Pilatus. Of course, more souvenirs were added to our suitcases by the end of that Lucerne day trip.

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-05.jpg" width="100%" alt="Group exiting the Lindt chocolate factory with the factory sign partially visible in the background." />
</figure>

We can't forget to mention one of the most delicious parts of our trip: our visit to the Lindt chocolate factory. We experienced (and ate) a key piece of Swiss history, with some of it ending up in our jackets & bags at the end of the day. 
 
## Wrapping Up

This was a trip filled with fresh energy, joy, collaboration, and a reinforced sense of belonging. We all had the chance to strengthen our existing relationships (and build new ones!) - From celebrating promotions, to learning through in-depth internal workshops, and getting a thorough workout in Zurich - This trip was a memorable experience that left us all inspired and more than excited to continue growing. 

💜 **Here are some staff quotes from the trip:**  

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-06.jpg" width="100%" alt="Jim and Stefan sitting in the hotel lobby playing Magic: The Gathering, with cards spread across the table and drinks nearby." />
</figure>

"Our team retreat in Zurich was fantastic! It was refreshing to connect with everyone on a personal level. My highlight was those late-night Magic the Gathering sessions with Jim and Stefan – it had been 10 years since I'd played, and the competitive spirit with plenty of laughs was the perfect way to unwind and bond! Beyond the fun, it was inspiring to see how strong our company culture has become. As a remote company, these connections are crucial, and it's clear that even with the team nearly doubling in size, newcomers feel welcomed and supported. That creates such a positive and productive environment, no matter where we're working from. I can't wait for our next retreat!"
-**Florian Forster, CEO**

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-07.jpg" width="100%" alt="Lindt chocolate factory sign prominently displayed on the factory's exterior." />
</figure>

“It was great to show everyone our beautiful country and where the whole story of Zitadel started. I always love to explore something unique for the place we visit, and the Home of Chocolate was just amazing. Even if it was waaaay too much chocolate. :) Getting to know everyone in person is always my favorite part of the team retreat, and I am sure this makes a big difference for our daily remote work.”
-**Fabienne Bühler, CPO**

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-08.jpg" width="100%" alt="Zitadel staff in a meeting room, attentively watching Jim, the product marketing manager, present his workshop." />
</figure>

“It was a lovely offsite that hit all the points you hope for out of a team coming together, from long term strategy discussions to rapport building amongst the crew. It’s exciting to have a strong alignment closing out 2024 and going into 2025!”
-**Jim Morrison, Product Marketing Manager**

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-09.jpg" width="100%" alt="Team walking through Lucerne, passing buildings with signs for 'Pilatus', 'Victorinox', and 'La Fenice Steakhouse'." />
</figure>

“The Zurich retreat was an extraordinary experience, one that will forever be etched in my memory. To gather with colleagues from across the globe, to see familiar faces, and meet new ones, was truly inspiring. The days were filled with insightful discussions, thought-provoking presentations, and collaborative problem-solving. Yet, the moments outside of the formal agenda also truly resonated with me. The casual conversations, the shared laughter, the late-night card games with Magic the Gathering– these were the moments that forged deeper bonds and strengthened our team. The opportunity to explore the beauty of Switzerland was an added bonus. Whether it was a leisurely stroll through the city or a breathtaking hike in the mountains, each excursion offered a chance to unwind, recharge, and appreciate the simple joys of life. I’m incredibly grateful for the experience and can’t wait to reconnect with my colleagues at the next retreat.”
-**Stefan Benz, Software Engineer**

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-10.jpg" width="100%" alt="Small group of Zitadel engineers casually chatting near picnic-style seats at an outdoor restaurant." />
</figure>

"I cherished the in-person conversations and unforgettable moments with these amazing people. The presentations, even though they were in the morning, were a valuable source of knowledge about others' work, making this retreat a truly unique experience."
-**Silvan Reusser, Software Engineer**


Discover how our fourth team retreat in Zurich turned last-minute challenges into opportunities for collaboration, connection, and cultural exploration.

Hopp Schwiiz - Company retreat V4


### Advancing the future of identity infrastructure to a cloud-native, multi-tenant, and developer-friendly platform.

Modern organizations have a complex landscape of interconnected systems, spanning hybrid and multi-cloud environments and serverless architectures. To succeed, businesses must constantly adapt their security and identity management strategies to improve developer productivity and user experience across multiple systems. This, however, presents significant challenges. Data ownership and security, the complexities of SSO and MFA, developer-friendly APIs and SDKs, and customization to specific use cases are major concerns that can hinder innovation, slow down time-to-market, and impact customer satisfaction."

### Announcing our Series A Funding Update

Through our collective experiences, we learned that the current solutions for Identity and Access Management and Identity Infrastructure fall short in many different areas. Driven by a shared vision to build a modern identity infrastructure platform, Fabienne, Max, and I, along with a talented group of engineers, founded Zitadel four years ago.

![zitadel raises 9 million series a](/blog/2024-11-20-zitadel-the-future-of-identity-infrastructure.png)

We're thrilled to announce today that [we've raised $9 million in Series A funding](https://www.prnewswire.com/news-releases/zitadel-raises-9-million-series-a-to-advance-cloud-native-identity-infrastructure-302311461.html) to further our mission of building a modern identity infrastructure platform. This investment, led by Nexus Ventures with continued participation from Floodgate, will enable us to accelerate development and bring Zitadel to even more organizations. We're incredibly grateful for the ongoing support of our investors and partners, who share our passion for creating a secure and developer-friendly identity solution.

### What makes Zitadel a great Identity Platform

#### Architectural Innovation

Zitadel is built as a cloud-native infrastructure project that leverages modern technologies to ensure a platform that scales with customers' needs. What sets Zitadel apart is its **unique event-sourced architecture**, where every change in the system is captured as an immutable event. This not only provides a **complete audit log** but also allows customers to **subscribe to real-time changes** within their Zitadel. Built with the help of Go, NextJs, Angular, Postgres and Redis, Zitadel is designed to be highly scalable, resilient, and secure. Our multi-tenant architecture allows us to support customers of all sizes, from small businesses to large enterprises. And our API-first approach makes it easy to integrate Zitadel with your existing applications and workflows.

![Architectural Innovation](/blog/2024-11-20-zitadel-the-future-of-identity-infrastructure-overview.png)

#### Flexible Authentication and Login options

Passwordless authentication along with enterprise or social logins are quickly becoming the de facto standards in identity security. Zitadel supports these and provides a customizable log-in experience for businesses that would like to either embed their login workflow, passkeys, or build a completely custom login experience for their project.

#### Built for Multi-tenancy

Multi-tenancy is a fundamental capability of the Zitadel platform, engineered to effortlessly support millions of tenants. This allows customers to manage a vast number of organizations and policies simultaneously, with the flexibility to handle diverse scenarios – from B2B and B2C to complex mixed setups with both. Customers can seamlessly extend the scope of their applications by adding new organizations and granting projects to them, all within a single, unified Zitadel instance. This scalability ensures that Zitadel can grow with your business, no matter how large or complex your needs become.

![Built for Multi-tenancy](/blog/2024-11-20-zitadel-the-future-of-identity-infrastructure-multitenancy.png)

#### Engineered for Developers

Zitadel is built with developers in mind, adopting an API-first approach. This means that every feature and function is accessible through well-defined and documented APIs. We offer both gRPC and REST APIs, giving you the flexibility to choose the best fit for your needs. This allows for seamless integration with your existing tech stack, regardless of your preferred programming languages or frameworks. Our comprehensive SDKs further simplify development, reducing the learning curve and accelerating your time to market.

With Zitadel's API-first approach, you can:

- **Automate user management:** Programmatically create, update, and delete users.
- **Customize authentication flows:** Integrate with your own login UIs or implement passwordless authentication.
- **Manage roles and permissions:** Fine-tune access control for your applications.
- **Extend Zitadel's functionality:** Build custom integrations with other services.

#### Enabling frictionless Security Operations

The Zitadel Identity Platform aims to empower security operators with critical capabilities such as secure login policies, audit and access events, etc. We are excited to grow our platform to extend this so the SecOps teams will be able to derive actionable insights through data aggregation, enabling them to monitor compliance and security across user behaviors and application usage patterns. By streamlining complex processes, security operators can leverage advanced usage analytics and threat intelligence capabilities, allowing them to focus on strategic security initiatives.

#### Continued Commitment to Open Source

Open source is at the heart of Zitadel and we firmly believe in the benefits that open source has. Our commitment to open source fosters innovation, encourages collaboration, and ensures that our platform remains adaptable and extensible. We invite everybody to join our thriving community, contribute to the project, and help shape the future of identity infrastructure.

<img src="/blog/2024-11-20-zitadel-the-future-of-identity-infrastructure-numbers.png" alt="Zitadel By The Numbers" />

### What’s Next

We are eager to set forth on the next part of our journey at Zitadel with our community. Check out our [documentation](https://zitadel.com/docs) or join us on [Discord](https://zitadel.com/chat). You can also stay informed of our updates by following us on your preferred social channel \- [LinkedIn](https://www.linkedin.com/company/zitadel/), [Twitter](https://x.com/zitadel), or [Bluesky](http://@zitadel.bsky.social).

Check out our [documentation](https://zitadel.com/docs)

Join us on [Discord](https://zitadel.com/chat), Follow us on [LinkedIn](https://www.linkedin.com/company/zitadel/), [Twitter](https://x.com/zitadel), or [Bluesky](http://@zitadel.bsky.social)


Zitadel raises $9 million in Series A to advance the future of identity infrastructure to a cloud-native, multi-tenant, and developer-friendly platform.

Zitadel: The Future of Identity Infrastructure


Imagine this: Dave, an IT manager, is responsible for overseeing access for multiple tenants within his company’s cloud service. He has User A from RetailCo and User B from FinanceCorp, both needing access to the same service but with completely different security requirements. User A prefers logging in with their Google account and demands strict password policies. User B uses their company’s Azure AD and requires multi-factor authentication. Dave thought managing a single organization was tough, but this? This is a whole new level of complexity.

As if that wasn't enough, Dave’s company is rapidly growing, introducing more customers from various industries, each with unique compliance and security requirements. Now he has User C from TechInnovators who needs passkeys for enhanced security, and User D from EduWorld demanding seamless SAML integration with their existing single sign-on system. The more tenants Dave’s company takes on, the more convoluted and headache-inducing his job becomes.


## Understanding Multi-Tenant IAM

Implementing multi-tenant Identity and Access management (IAM) systems can be complex, daunting, and filled with hidden challenges. Whether you're addressing the needs of B2B, B2C, or M2M (Machine-to-Machine) environments, multi-tenancy involves a single service instance serving multiple tenants, such as organizations or customers. This requires meticulous data and component segmentation based on service needs and data types. The chaos gets further compounded with individual compliance requirements. 

Consider a simple login screen—two input fields and a button. It looks straightforward, right? But this seemingly simple UI is just the tip of the iceberg. Behind the scenes, there's a multitude of complexities: username and password management, multi-factor authentication options (SMS codes, email codes, authenticator apps), passwordless authentication (face recognition, fingerprint scans), and identity brokering (social logins like Google, Apple, or Facebook).

On top of that, managing security settings, performing regular penetration testing, adhering to standards (such as SCIM, OAuth 2.0, and OpenID Connect), and obtaining certifications (like ISO and SOC 2) add layers of complexity. This is especially true when these features must be replicated across multiple tenants.


<figure>
  <img
    src="/blog/2024-07-25-navigating-pitfalls-of-multitenancy-01.png" 
    width="100%"
    alt="Underneath the simple login form"
    style={{ margin: '0 auto' }}
  />
  <figcaption>

    Figure 1 - Underneath the simple login form lies a multitude of complexities—it's merely the tip of the iceberg

  </figcaption>
</figure>


When you introduce multi-tenancy, everything becomes more complex. Each customer brings their unique requirements—username and password for one, passwordless or multi-factor authentication for another, or integration with existing identity systems like Azure AD or Google Business. These varying needs mean you must be able to configure and maintain diverse systems for each tenant, requiring significant time, expertise, and resources.

<figure>
  <img
    src="/blog/2024-07-25-navigating-pitfalls-of-multitenancy-02.png" 
    width="100%"
    alt="The layers of complexities"
    style={{ margin: '0 auto' }}
  />
  <figcaption>

    Figure 2 - The layers of complexities behind the the multi-dimensional aspects of multi-tenancy

  </figcaption>
</figure>

Let’s look at a real-world example. Imagine you run an online store serving end consumers, business partners, and your workforce. Each group has different needs: consumers need a user-friendly login and account management system, business partners (such as other sellers) might use their existing enterprise identity systems and may have their own branding requirements, and your workforce needs robust role and permission management to secure administrative tasks.

Yes, it’s possible to manage all these requirements with roles and permissions. However, when you consider the need for different security settings, it often makes more sense to adopt a multi-tenancy approach. As you scale to multiple customers, each one may require unique domains, branding, social logins, and security settings. Managing these variations with a roles and permissions model becomes increasingly complex and unwieldy. Multi-tenancy offers a more streamlined and efficient solution, allowing you to handle these diverse needs effectively and securely.

Questions to ask when dealing with multi-tenancy include: How many levels of tenancy do you need? Are there multiple organizations within a tenant? What scenarios are you dealing with (B2C, B2B, mixed)? Each user group might need different authentication methods, security policies, and compliance requirements (e.g., GDPR, SOC 2, ISO).

Consider the example of a healthcare application where different tenants have varying password hashing requirements (PBKDF2, Argon2, bcrypt) and audit trail needs. Protocol-specific differences also arise; for instance, integrating customers’ existing Azure AD for user federation can lead to numerous configurations and requirements.

So, do you explain outdated or incorrect policies to each customer, or make your software flexible enough to handle these diverse needs while focusing on your business case? Ideally, you want to provide a robust, flexible platform that can accommodate different configurations and compliance requirements.

From an architectural perspective, you have two main options: shared systems or dedicated systems. Shared systems are cost-effective and simpler to manage but come with lower isolation, potential security risks, compliance challenges, and performance issues. Dedicated systems offer enhanced security, compliance, and customization but require more management, infrastructure costs, and personnel.

In summary, identity infrastructure involves much more than just two input fields and a button. It's intricate plumbing work, particularly with multi-tenancy. Always remember that the customer is king: guide them on security best practices, but also ensure your infrastructure can meet their unique needs. A proven track record in security is essential for enterprise deals, so regular penetration tests and certifications are crucial. Make use of established frameworks like OAuth 2.0 and OpenID Connect, and rely on an existing IAM product, such as ZITADEL, for authentication and authorization instead of building your own from scratch.


## How ZITADEL Handles Multi-Tenancy


ZITADEL has a strong focus on supporting SaaS providers with a multi-tenancy use case. This is achieved by allowing multiple organizations within your ZITADEL instance, where all customers can self-manage their own users and roles. ZITADEL operates as a shared system, but it also allows for virtual instances and separate organizations within each instance. This setup is particularly beneficial for B2B app providers where

- you sell your application to other businesses, where each business wants to manage their own users, roles, and access settings
- your customers have different needs for the login flow, such as unique branding, federated logins, password policies, and MFA options
- your customers want to self-manage their users and roles without relying on your administrative team
- users/employees of your customers need to log in or register independently
- not all customers have the same feature set within your application


## How Does Multi-Tenanacy Work in ZITADEL


### Create Organizations

For each customer, create an [organization](https://zitadel.com/docs/concepts/structure/organizations), the equivalent of a tenant, in ZITADEL. Assign an [organization manager](https://zitadel.com/docs/guides/manage/console/managers) to let each customer manage their users independently. Furthermore, users can belong to multiple organizations and switch between them using the same identity, simplifying user management and improving the user experience.

### Custom Configuration

Customers can configure their login look and feel ([branding](https://zitadel.com/docs/guides/manage/customize/branding), [authorization methods](https://zitadel.com/docs/guides/manage/console/roles), [federation](https://zitadel.com/docs/guides/integrate/identity-providers/introduction) or you can do it for them. ZITADEL supports various authentication methods, including [username/password](https://zitadel.com/docs/guides/integrate/login), MFA, and [passwordless options](https://zitadel.com/docs/concepts/features/passkeys). Integrate existing identity providers like Microsoft Azure AD, Google etc., allowing users to log in with their existing corporate credentials.

### Domain Discovery

ZITADEL offers [domain discovery](https://zitadel.com/docs/guides/solution-scenarios/domain-discovery) capabilities, which routes users to the appropriate organization based on their login methods, whether it's a username, email, or phone number. For instance, if a user from "foo.com" logs in, they are routed to the Foo Organization, while a user from "bar.com" is directed to the Bar Organization. This ensures users are authenticated according to their organization’s policies and access settings.


### Project Grants

With [project grants](https://zitadel.com/docs/concepts/structure/granted_projects) (also known as granted projects) your customers can access your project with a subset of roles so they can manage authorizations for their users. Enable granular role management, allowing organizations to assign specific roles and permissions to users based on their needs.



## Standards and Compliance


From a certification and standards compliance perspective, ZITADEL is [GDPR compliant](https://zitadel.com/gdpr) and [ZITADEL’s OIDC library has been certified by the OpenID Foundation](https://zitadel.com/blog/openid-connect-certification). Furthermore, [ZITADEL recently achieved ISO 27001 certification](https://zitadel.com/blog/zitadel-iso-27001-certified) for its information security management system, to maintain the highest standards of information security. ZITADEL assures customers that their data is protected by robust security measures, reflecting global best practices in information security management. 

By providing these capabilities, ZITADEL simplifies the management of multi-tenant IAM systems, ensuring security, flexibility, and ease of use for both administrators and end-users. Moreover, ZITADEL provides support for unlimited users, projects, and applications, making ZITADEL a trusted, secure, and scalable solution for your multi-tenant IAM needs that can grow with your business. 


*This blog post is based on and expands upon the talk "The Perils and Pitfalls of Multi-Tenant Identity Management" from Cloud Native Security Con 2024, North America. For the full discussion, you can watch the video [here](https://www.youtube.com/watch?v=gZHxjnx81WE&list=PLj6h78yzYM2MSAFvjG22ZynvaUs1nnaQJ&index=46).*




This post explores the complexities and solutions of multi-tenant identity management in modern SaaS environments.

The Complexities and Pitfalls of Multi-Tenant Identity and Access Management


In this newsletter, I want to share updates about our platform, and provide some tips on how you can simplify your identity infrastructure.

## Feature highlights

In June,  we shipped over 60 bug fixes, improvements, and new features. Most of those changes were released with ZITADEL [v2.55.0](https://github.com/zitadel/zitadel/releases/tag/v2.55.0), so make sure you are running the latest version.

### New password expiry feature

ZITADEL has introduced a new password age policy feature, enabling organizations to require users to change their passwords regularly. This feature can be easily managed through the Console UI at both instance and organization levels. Users will be prompted to change their password in the Login UI if their current password exceeds the defined age limit. This enhancement strengthens ZITADEL's password management capabilities and provides organizations with greater control over their password lifecycle.

![ZITADEL Console UI password expiry settings](2024-07-04-zitadel-product-newsletter-june-2024-01.png)

### Limit requested roles with new scope

A new scope was introduced to address the issue of excessive roles being returned in tokens (and as such increasing their size) for users belonging to multiple organizations. This new scope allows administrators and applications to specify which organizations' roles should be included in the token, thus streamlining access control for specific use cases. By using the new scope, either once or multiple times, only the roles of the specified organizations will be included in the token.  It's important to note that this feature is not compatible with legacy mode for Introspection or Userinfo endpoints.

[Reserved Scopes](https://zitadel.com/docs/apis/openidoauth/scopes#reserved-scopes)

### More performance improvements

ZITADEL's performance continues to improve as the team works to identify and eliminate bottlenecks. Notably, import operations for large quantities of project grants will witness a substantial enhancement. Furthermore, a significant improvement has been made to OpenID Connect / OAuth 2.0 session checks, effectively addressing recent observations identified during load testing.

### Sending test emails

The newly introduced feature has enhanced ZITADEL’s SMTP functionality by introducing a new testing step within the SMTP provider wizard. This allows administrators to verify their SMTP configuration before saving or updating it, preventing potential issues with email delivery. Additionally, the existing table of SMTP providers now includes a test option for existing configurations. This streamlined testing process ensures that email settings are correct from the outset, saving time and effort. This feature was contributed by the community - thank you for your efforts!

![ZITADEL Console UI sending test email during configuration of SMTP](2024-07-04-zitadel-product-newsletter-june-2024-02.png)

[Changelog](https://zitadel.com/changelog)

## ZITADEL achieves ISO 27001 certification, reinforcing commitment to security

<img src="/blog/2024-07-04-zitadel-product-newsletter-june-2024-03.png" width="25%" align="left" alt="" class="wrap"/>

In a significant milestone for ZITADEL's commitment to security and data protection, we have achieved ISO 27001 certification for our information security management system (ISMS). This internationally recognized standard validates our dedication to maintaining the highest levels of security for our customers' data.

To provide further transparency and information about our security practices, we have also updated our [Trust Center](https://trust.zitadel.com). This resource offers comprehensive details on our security posture, policies, and certifications.

[ZITADEL Achieves ISO 27001 Certification](https://zitadel.com/blog/zitadel-iso-27001-certified)

## 21 more reasons to celebrate: Community contributions in June

* Many Console UI improvements were contributed by [doncicuto](https://github.com/doncicuto) improving the user experience for administrators and users. Moreover [doncicuto](https://github.com/doncicuto) made it possible to send test mails for SMTP configurations and further improvements to mail providers.
* [JesperWe](https://github.com/JesperWe) made it possible for Swedish speakers to use their beautiful native language
* [Schettn](https://github.com/schettn) created a guide to integrate with the [Pylon](https://github.com/getcronit/pylon) framework

Many thanks to the contributors this month for their efforts, helping to improve documentation, tests, and fixing bugs in our code: [dkaminer](https://github.com/dkaminer), [panapol-p](https://github.com/panapol-p), [jvanderneutstulen](https://github.com/jvanderneutstulen), [danielmoisa](https://github.com/danielmoisa), [Loddan](https://github.com/Loddan), [Yxnt](https://github.com/Yxnt), [Cubox](https://github.com/Cubox), [danielloader](https://github.com/danielloader), [jfschubert](https://github.com/jfschubert)

Thinking of contributing? Grab a ‘good first issue’ or start a discussion. 

[Contributing guide](https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md)

## Additional resources

* [ZITADEL Bi-Weekly Office Hours](https://github.com/zitadel/zitadel/blob/main/MEETING_SCHEDULE.md)
* [Forza Italia: Retreat the third edition in Bologna](https://zitadel.com/blog/team-retreat-bologna)
* First time contribution (Japanese only): [OSS コントリビュートの実績を解除した](https://zenn.dev/otakakot/articles/dc58ff849e43e4)
* Integrate .NET (Polish only):  [Integracja Aplikacji .NET z Zitadel | bd90](https://bd90.pl/integracja-aplikacji-net-z-zitadel/)

ZITADEL introduced new features and enhancements, including a password expiry feature, a new scope to limit requested roles in tokens, SMTP configuration testing, and performance improvements. ZITADEL achieved ISO 27001 certification, demonstrating its commitment to security.

Product Newsletter June 2024


ZITADEL, a leading provider of cloud-native identity and access management (IAM) solutions, has achieved ISO 27001 certification for its information security management system (ISMS). This certification demonstrates ZITADEL's deeply rooted commitment to protect the confidentiality, availability, and integrity of customer, company, and employee data.

"Obtaining the ISO 27001 certification is a testament to ZITADEL's commitment to information security," said Florian Forster, CEO of ZITADEL. "This certification demonstrates that we have the systems and processes in place to protect our customers' data."

<img src="/blog/2024-06-20-zitadel-iso-27001-certified-01.png" width="35%" align="left" alt="" class="wrap"/>

The ISO 27001 standard is a globally recognized framework for information security management. It provides a comprehensive set of requirements for establishing, implementing, operating, monitoring, reviewing, maintaining, and continually improving the security of ZITADEL.

We designed our information security management system (ISMS) to protect against a wide range of threats, including unauthorized access, data breaches, and cyberattacks. The ISMS further includes processes for managing and responding to security incidents.

"Secure development and operations practices are essential for protecting our customers' data," said Fabienne Bühler, CPO of ZITADEL. "ISO 27001 certification provides our customers with assurance that their data is safe and secure."

ZITADEL's ISO 27001 certification is a valuable asset for the company's customers. It provides customers with assurance that their data is protected by world-class processes and tools .

"Our commitment to information security and data privacy is steadfast," said Maximilian Panne, COO of ZITADEL. "ISO 27001 certification is a recognition of our efforts to protect our customers' data at ZITADEL."



You can verify the validity of our ISO certificate by visiting the [website of the British Assessment Bureau](https://cvs.babcert.com/babcert.asp?c=258048&v=3fs61l6zn6).

Visit the [Trust Center](https://trust.zitadel.com) to learn more about our commitment to information security and data protection.


ZITADEL achieved ISO 27001 certification, demonstrating its dedication to data protection and cybersecurity. This certification provides a framework for information security management, safeguarding data against unauthorized access and cyber attacks.

ZITADEL Achieves ISO 27001 Certification


As a fully remote company, the time we spend together in person is precious.
This is why twice a year, our team gathers for an in person retreat, an opportunity to connect beyond the virtual world.
Last week, we met outside the beautiful city of Bologna for our first retreat of the year.
Since we really enjoyed it, we wanted to share a glimpse of  our week-long adventure.

## Travel Monday and Arrival in Bologna

After a full day of travel by plane or train excitement filled the air as we arrived in Bologna.
The last steps to our accommodation were harder than expected, the location with its view of its flowing hills and grape wines were worth it.
As everybody arrived later in the afternoon we rounded off the evening with pasta, as one would expect in Italy.
We even committed ourselves to cooking two fresh sauces, ragu and a verdure.  The whole team enjoyed the get-together and chatted until late that night over a drink.

<figure>
    <img src="/blog/2024-06-19-team-retreat-bologna-01.jpg" width="100%" alt="Up the hill." />
</figure>

## Workshop Tuesday (with Pizza)

Tuesday marked the beginning of our planned activities. In the morning, we gathered for a collaborative workshop focused on team dynamics and fostering a productive environment. This session, prepared with the guidance of our coach, Diane, was insightful and set a strong foundation for our company culture.

The afternoon was free for everyone to explore the surroundings or engage in spontaneous discussions. Some team members chose to go for a walk, while others stayed back to exchange ideas and plans that have been in their heads for a long time and some others decided to play a game called Kubb.

The highlight of the day was undoubtedly pizza night. Max brought his portable pizza oven, and Florian had spent the afternoon making pizza dough from scratch. As evening fell, we gathered to create our own pizzas. The making was as enjoyable as the delicious outcome. We laughed, shared stories, and ate homemade pizzas—a perfect blend of teamwork and fun.

<figure>
    <img src="/blog/2024-06-19-team-retreat-bologna-02.jpg" width="100%" alt="Pizza Night" />
</figure>

## Wednesday, Continued Workshops and Exploration

Wednesday morning continued with another productive workshop session. Building on the previous day's discussions and results, we delved deeper into our operating principles, aligning our visions and strengthening our collaborative spirit.

The afternoon was again free for personal activities. These unstructured times were as valuable as the workshops, allowing for organic connections and idea exchanges.

<figure>
    <img src="/blog/2024-06-19-team-retreat-bologna-03.jpg" width="100%" alt="Workshop" />
</figure>

### A Culinary Adventure on Thursday

Thursday was dedicated entirely to food. We went on a walking food tour in Bologna, immersing ourselves in the local culinary delights. From fresh pasta to delicious pastries, we tasted a variety of specialties that the city is renowned for, such as cold-cuts, Tiggele, Tortellini al Brodo, Tagliatelle al Ragù. This gastronomic journey was not just about food but also about experiencing the culture and history of Bologna together.

<figure>
    <img src="/blog/2024-06-19-team-retreat-bologna-04.jpg" width="100%" alt="Pasta" />
</figure>

<figure>
    <img src="/blog/2024-06-19-team-retreat-bologna-05.jpg" width="100%" alt="Church" />
</figure>

### The Importance of In-Person Retreats

We figured that these in-person retreats are crucial for our company culture. They provide us with a unique opportunity to build stronger relationships and learn about each other's interests and expertise. Spending time together allows us to connect on a personal and social level, enhancing our collaboration and understanding of each other, far beyond what is possible through modern communication channels like video and audio.

Our week in Bologna was a resounding success. From the insightful workshops to unforgettable culinary experiences, we cherished every moment. These retreats remind us of the importance of human connection in a digital world. It made us aware that remote work is hard work, and we are already looking forward to seeing each other again in person in the next retreat.

<figure>
    <img src="/blog/2024-06-19-team-retreat-bologna-06.jpg" width="100%" alt="Team" />
</figure>


As a fully remote company, the time we spend together in person is precious. Get some insights about our third team retreat taking place in Bologna.

Forza Italia: Retreat the third edition in Bologna


This is Max from ZITADEL. As in the previous months, in this update I want to highlight our product updates, and tips and tricks in making your identity infrastructure easier.

## Feature highlights

Again in May, we kept the pace high with more than 76 improvements shipped to our self-hosting and cloud users. Let’s go through the key improvements to ZITADEL this month.

[All changes](https://zitadel.com/changelog)

### Improvements using external SAML IdPs

We understand that many organizations, particularly enterprises, leverage SAML for user federation. In response to your needs, we've made significant steps in enhancing ZITADEL's interoperability with various SAML providers this May.

Previously, ZITADEL relied on a persistent nameID format, requiring external identity providers (IdPs) to consistently return this format for linking users. However, some IdPs utilize transient nameIDs, leading to mismatched user identities.

This update allows you to define the preferred nameID format and configure how ZITADEL maps users based on attributes received from the external IdP. For instance, you can leverage email addresses from the IdP to link users with matching emails in ZITADEL.

While ZITADEL offers pre-configured templates for external IdPs that utilize OpenID Connect, we're considering extending this functionality to SAML providers. We value your feedback – let us know your thoughts on this potential addition!

[Should we support SAML provider templates?](https://github.com/zitadel/zitadel/issues/7995)

### Making it easier to manage resources programmatically

While you get all the functionality through a UI, we are api-first and you are able to manage everything through our APIs. Managing ZITADEL resources and configuration programmatically just got simpler with some recent updates.

When you start with a new ZITADEL system, you need a first admin user to login and configure your system. In the past it was only possible to either create a human user or a service user, but not both at the same time. With a recent update creating both a human and service user is now possible, giving you hopefully a much simpler and easier access to configure ZITADEL from the start.

Moreover our [terraform provider](https://zitadel.com/docs/guides/manage/terraform/basics) got significantly updated and improved over the last weeks. Examples are managing organization and user metadata as well as managing SAML and OIDC generic external identity provider templates.

### Scaling to multi-million identities

We're excited to announce performance optimizations in ZITADEL to meet the growing needs of our enterprise customers! This update addresses the demands of multi-million identity deployments and aligns with our ongoing commitment to performance improvement. We've focused on enhancing the token endpoint, specifically for new token creation, alongside optimizations for many frequently used ZITADEL APIs. For detailed upgrade guidance, please refer to the technical advisories.

[Technical Advisories](https://zitadel.com/docs/support/technical_advisory)

## Office hours

Gear up for deeper dives and live engagement! We are excited to announce bi-weekly office hours on our Discord server for our community. These hour-long sessions will offer in-depth explorations of upcoming features, followed by a live Q&A where the ZITADEL team tackles your burning questions.

The first session, held on May 29th, delved into the exciting new version of the Actions feature.

Don't miss out on this chance to connect with the ZITADEL team and stay ahead of the curve! Checkout our [meeting schedule](https://github.com/zitadel/zitadel/blob/main/MEETING_SCHEDULE.md) for upcoming sessions.

[Office hours meeting schedule](https://github.com/zitadel/zitadel/blob/main/MEETING_SCHEDULE.md)

## You will become a Pro

ZITADEL Cloud subscription model is changing to a simpler daily active user (DAU) model on July 1st for easier cost allocation and full feature access across instances. This serves as a friendly reminder that accounts not already on our Pro plan will automatically update.

All new subscription plans will include in the base fee 25’000 Daily Active Users in a month, one custom domain, and 3 external identity providers.

[Pricing Plans](https://zitadel.com/pricing)

## Contributors for the win

19 contributions came from our community in May. 
Thank you for your the continued support and the time you put in to make the project better for everyone.

* [yordis](https://github.com/yordis) helped us bring the typescript repo for our next gen login UI significantly forwards
* Never forget to activate your email service provider with this change from [doncicuto](https://github.com/doncicuto)
* Also by [doncicuto](https://github.com/doncicuto) comes a solution to a  community request, adding customization options to console navigation buttons
* [sujoysb](https://github.com/sujoysb) improved the error messages and user feedback for password complexity validations
* [calRobert](https://github.com/CalRobert), [jayPe69](https://github.com/jayPe69), [aurel004](https://github.com/aurel004), [burahimu](https://github.com/burahimu) all helped with our translations, and typos (is our French that bad? Apologies.)
* [cr1cr1](https://github.com/cr1cr1), [exeteres](https://github.com/exeteres), [kleberbaum](https://github.com/kleberbaum) contributed various improvement to our Charts
* Sign tokens FAPI-compliant with ES256 and PS256 thanks to [nannany](https://github.com/nannany)
* [ymarcus93](https://github.com/ymarcus93) increased compatibility with certain identity providers and fixed some issues around the library

## Additional resources

* [Passkeys: A Shattered Dream](https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shattered-dream/)
* [The SaaS Trends Report | Q1 2024 | Vendr](https://www.vendr.com/insights/saas-trends-report-q1-2024#top-categories-renewed) - Cybersecurity at the top
* [Navigating Session Logouts, Timeouts, and Token Expiry](https://zitadel.com/blog/session-timeouts-logouts)
* [Google Online Security Blog: On Fire Drills and Phishing Tests](https://security.googleblog.com/2024/05/on-fire-drills-and-phishing-tests.html)

New Success Story: [Achieving 70% Faster B2B Integration in Document Automation at BLP Digital](https://zitadel.com/blog/success-story-blp)

Thanks for reading, \
Max


Updates on ZITADEL, and tips and tricks to simplify your identity infrastructure for May 2024. In this episode we highlight improvements to SAML IdPs, managing resources programmatically, and scaling to millions of identities.

Blog.