Delegated access management

Hosted Login

Multifactor Authentication

Passwordless Authentication

Audit Trail

Identity Brokering

Platform

Service Accounts

Features

Easy integration

B2B (Business to Business)

Self Service

Existing identities

Secure authentication

Use Cases

Learn how to install, setup, and use ZITADEL.

Documentation

ZITADEL Cloud

Self-hosting

Trust center

Examples and Guides

Github Repository

Develop

Get Started

Contribute

Roadmap

Changelog

About Us

Jobs

Contact

Company

Read the blog

Sign up

Login

Pricing

Blog

At Zitadel, we take customer feedback and requests from our community members as the driving force for our work. Keeping that in mind today, we are happy to announce the release of Zitadel Version 4 (General Availability) that brings in Service Ping, the new resource-based API, Zitadel's self-hosted Login, and four new SDKs.

## What is Zitadel?

Zitadel is an open-source identity and access management (IAM) platform that simplifies identity infrastructure for cloud-native and modern applications, providing enterprise-grade security and multi-tenancy support with deployment flexibility and developer-first design.

## Why Zitadel?

Some key reasons why Enterprises [choose](https://zitadel.com/blog/5-reasons-to-choose-zitadel-iam) Zitadel as their IAM solution.
* Eliminate expensive infrastructure development and deployment by using the Self-hosted option.
* Built-in enterprise security features.
* Ready-made compliance controls.
* Professional support and maintenance.
* More flexible and a transparent pricing model.
* Open-source transparency.
* Better multi-tenancy support.
* More developer-friendly.
* Modern, API-first architecture.

## How often does Zitadel release software?

We release a new major version of our [software](https://zitadel.com/docs/product/release-cycle) every three months. This predictable schedule allows us to introduce significant features and enhancements in a structured way. What we are releasing today is a Generally Available release for all our customers and users.

Following the month-long Release Candidate and Stabilization phase, today we are happy to announce the official General Availability (GA) / Stable Release. This is the final, production-ready version of our software that has been thoroughly tested by both our internal teams and the community. This release is available to everyone, and we recommend that customers begin reviewing the official upgrade path for their production environments. The deployment of this new major version to our cloud services also happens at this time.

## What features are available with Zitadel V4?

You can find more information about the release in our [release notes](https://github.com/zitadel/zitadel/releases/tag/v4.0.0). 

The following features are now available with Zitadel Version 4 for enabling in your production environments (Zitadel Cloud and Self-Hosted):

### Service Ping
We have added [Service Ping](https://zitadel.com/docs/self-hosting/manage/service_ping) for self-hosted customers, which allows your instance(s) to send us anonymized data about their performance and usage. You can choose what info to share, from basic details like your domain and version to more advanced metrics, or turn it off entirely. This will set a foundation for future improvements like advanced analytics and predictive threat detection.

If the feature is enabled, the base information will always be sent, and it includes the following data that is sent back to us:
* Your system ID
* The currently running version of ZITADEL
* Information on all instances
* Instance Id
* Creation Date
* Domains

### Resource-based APIs
Our new resource-based APIs make it easier to manage tasks like creating users, creating instances, and managing permissions. The new set of APIs is focused on resources like users, sessions, projects, etc. Each resource has a unique ID and a set of attributes. You can manage the complete lifecycle of a resource using V2 APIs.

With the new API design, all resources have their dedicated service. This approach minimizes the impact on other parts of the business by allowing processes to run in parallel, maintaining a clear separation of tasks. Unlike the old API that required complete updates to resources, the new resource-based APIs allow for partial updates as needed.

If you are currently using V1 APIs, you can switch to V2 by following the [provided guide](https://zitadel.com/docs/apis/migration_v1_to_v2). To learn more about how resource-based implementation works, explore our API Design documentation.

We will gradually introduce the V2 APIs to ensure that all new endpoints are thoroughly tested before becoming part of our stable releases. Refer to the release notes for an overview of V2 APIs, categorized by Beta and General Availability (GA), as well as a comprehensive list of deprecated endpoints.

### New SDKs
We are pleased to announce the availability of [new](https://zitadel.com/blog/zitadel-sdks-java-python-php-ruby) SDKs for Java, Python, PHP, and Ruby! These SDKs empower your Zitadel projects by simplifying API interactions and promoting efficient development workflows. Try out our various other SDK [examples](https://zitadel.com/docs/sdk-examples/introduction) that best suit your use case.

### Hosted Login
A few months ago, we announced the [availability](https://zitadel.com/blog/custom-login) of Hosted Login V2, and now [Zitadel's Self-Hosted Login](https://zitadel.com/docs/guides/integrate/login/hosted-login#hosted-login-version-2-beta) is the default login experience for both cloud and self-hosted customers. Get started by adding a [custom login](https://zitadel.com/blog/custom-login) to your Zitadel instance.


## How can I try out and contribute to Zitadel?

Read our [documentation](https://zitadel.com/docs) and learn how you can set up, customise, and integrate authentication and authorisation into your project. If you are interested in having a direct influence on the future [roadmap](https://zitadel.com/docs/product/roadmap) of Zitadel and early access to new features, [please apply today](https://2dljbt.share-eu1.hsforms.com/242YyCzyJRP-5ceTa2h5Uaw) to become a beta tester. 

We would love to see you being a part of the Zitadel community, and you can reach us at:
	* [Discord](https://discord.com/invite/zitadel)
	* [Github](https://github.com/zitadel/zitadel/)
	
## What is Zitadel's support model?

It's important to note that [support](https://zitadel.com/docs/support/software-release-cycles-support) may differ depending on the feature, and not all features may be fully supported. We always strive to provide the best support possible for our customers and community, but we may not be able to provide immediate or comprehensive support for all features. Also, the support may differ depending on your contracts.



We are happy to announce the release of Zitadel Version 4 (General Availability) that brings in Service Ping, the new resource-based API, Zitadel's self-hosted Login, and four new SDKs.

Announcing the General Availability of Zitadel V4

This tutorial will provide you with an overview of how to use Terraform and customize the ZITADEL behavior with different parameters based on your organization's needs. 

Terraform in Identity and Access Management

## Introducing an OIDC Playground by Zitadel: The Fastest Way for Developers to Master Authentication

Let’s face it: authentication is rarely the part of your stack that gets developers excited. OIDC flows can feel like a black box, and when something breaks, you’re left deciphering cryptic errors, scouring docs, or waiting for support. That’s wasted engineering time and momentum.

At Zitadel, we’re obsessed with building for developers and platform engineers. That’s why we created the [OIDC Playground](https://zitadel.com/playgrounds/oidc), a hands-on, interactive tool that lets you experiment with OpenID Connect authentication requests, see how Zitadel responds, and iterate in real time. Whether you’re integrating, debugging, or just curious, this is your fast lane to understanding and control.

## What is Zitadel?

Zitadel is an open-source identity and access management (IAM) platform built for modern, cloud-native applications. We help you ship authentication and authorization quickly, securely, and at scale without having to build or maintain complex identity infrastructure. ZITADEL delivers enterprise-grade security, true multi-tenancy, flexible deployment, and a developer-first experience.

## Why Zitadel?

Enterprises choose Zitadel as their IAM solution for several key reasons:

-   Eliminate expensive infrastructure development:  Go self-hosted or cloud, and skip months of building and maintaining IAM.
-   Built-in enterprise security features: From Passekys, to one-time passwords to Single Sign-on, we've got you covered.
-   Ready-made compliance controls:  Ready-made controls help you meet regulatory requirements.
-   Professional support and maintenance: You get professional help and upkeep.
-   More flexible and a transparent pricing model:  No surprises, no opaque “enterprise” gates.
-   Open-source transparency:  Inspect, contribute, or extend no black boxes.
-   Solid multi-tenancy support: It handles millions of tenants at scale.
-   Developer-friendly:  Integrate in days, not weeks, with modern APIs and docs.
-   Modern, API-first architecture: Provides a modern, API-first approach.
    

## What is OIDC?

[OpenID Connect](https://openid.net/developers/specs/) (OIDC) is the industry standard for authentication, sitting on top of OAuth 2. It lets your apps verify users’ identities and get profile information via secure, standardized tokens (JWTs). OIDC is enabled when a client includes the `openid` scope in an authorization request. The result? Your app receives an ID Token, a JWT containing “claims” about the user (like name, email, or custom attributes).

## What is the OIDC Playground from Zitadel?

An OIDC (OpenID Connect) playground is useful for developers, security engineers, and testers to experiment and debug OIDC flows in a controlled environment. The playground can be helpful in many different ways:

#### Learning and Experimentation

-   Understand how OIDC works by crafting an authentication request.
-   An OIDC authentication request is a standardized way for a relying party (an application or website) to request a user's identity information from an OpenID provider.
    

#### Debugging and Development

-   Easily modify parameters like client_id, scope, redirect_uri, response_type, etc., to observe how different parameters change the behavior
-   Useful for debugging issues like:
	-   Invalid redirect URIs
	-   Token decoding problems    
	-  	Scopes not returned as expected
    
## Pre-Requisites

-   A [self-hosted](https://zitadel.com/docs/self-hosting/deploy/overview) or [cloud](https://zitadel.com/signin) instance of Zitadel.
-   Create a new [Project](https://zitadel.com/docs/guides/manage/console/projects) and create a new [User.](https://zitadel.com/docs/guides/manage/user/reg-create-user)
-   Create a client.
-   Take a note of the issuer URL, which can be obtained by logging into your Zitadel instance.
-   Click Projects > Select the respective project > Select the respective application > Click URLs
    

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXdhV734K4DL9ckcOlx-U25xXpWTrOS7WuT-FnTqI5P9Xj5x36fXF0iPrDd7vybYLHhenwXUzeMrOLQfMh2jieI4w1gFkIwvknsUm_EbyieUujmAr8WM_J1bluWrH6_P3FbUfwxLmg?key=bgcsq8E2ip6wVk3nVSJgBA)

-   Web App (Optional)- We are using the OIDC debugger in this tutorial    
-   To enable users to register with a local account (username/password), you need to enable the "register allowed" setting in the login behavior settings within ZITADEL.
-   When enabled, a registration button will appear on the login page, allowing users to create new accounts. You can specify the organization users are registered to during the registration process by including the organization scope in the authorization request.
    

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXeV3Vr_efJwLQgLk1R1Atp83-AOH7NRtAGdNmvpSCMqmdsgw0R3Qn3ymhEmyl3NOAxEY0dLt90BQERdlcuz-Pj9vkFjc4qE-fYdlINSqBear_lnLiw5KA_gWiRdYYQBL64DVcEkGw?key=bgcsq8E2ip6wVk3nVSJgBA)

## How can you get started with the OIDC playground from Zitadel?

This playground will help you craft an authentication request initially and explore the behavior of Zitadel in more depth.

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXe_qtGjVMPdJGUX0r6U9PfpA-1mYWUcc5nmc70Z16RQMgul5IwvAUc4xmWIm5SsCNSuJBhnOOV14tCVWaX8mLMRiVADUBok81Te3suGh1HEtBf-6Sw0lpMH36-4pu5r9MUSBcmkHg?key=bgcsq8E2ip6wVk3nVSJgBA)

### Required Parameters

-   Your Domain- The Instance Domain for your Zitadel instance.
-   Example: [https://test1-zitadel-tuyhqf.us1.zitadel.cloud](https://test1-zitadel-tuyhqf.us1.zitadel.cloud)
-   Client ID is the unique identifier assigned to a client application of an application. It's the application where you want your users to log in. You can find the client ID in the Console. Click> Project> Choose your respective project where the application has been created> Click on the Application > Click Configuration
    

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXcsEc7lv5ssX6JrOp4t4o8K5PfI7CtNiT51j91LYJoKCWkRjB-0mxSag6xU_Saj3TbzHFck4ZSeb0s9jlUK0Assfa50azZ93uNgYQYg-SRzXkG7NlkLMjwtEDlm-TlmSUQe7k1R?key=bgcsq8E2ip6wVk3nVSJgBA)
-   Redirect URI is one of the pre-configured redirect URIs for your application.    
-   Example- [http://localhost:3000/callback](http://localhost:3000/callback)
-   Response Type defines whether a code, id_token token or just id_token will be returned. Most use cases will need code. This tells the authorization server which grant to execute. When you choose code, you will use the Authorization Code grant (recommended).
    

### Authentication methods

-   Depending on the authentication and authorization flow of your application, you might need to append some information to the authentication request.
-   Authentication method "(none) PKCE" is recommended for most application types. The playground automatically appends a code challenge for PKCE flows.

### Additional Parameters

Prompt defines if and how the user should be prompted on login. For example:

-   login: requires the user to re-authenticate.

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXdCZRyrhfKtDmnPxtbA32k4WdnhqQKFVVMXitM8c0Yi5MobPNQEf1wZ3BfNopM81sm1o2-j0cQLL8_RcG9eK6ZJckuI2M3vTwhAPA3xakzPGKql4l92nAJZuguMyyUhZXcfj60s0w?key=bgcsq8E2ip6wVk3nVSJgBA)

-   none: user must be authenticated without interaction, an error is returned otherwise; use for silent-refresh.

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXfxa95i2sLLSEwG3jo9yZ87kVib2pzjrCUsvDR98JicKTYLs5iT0R1mkKNOmeWXKBglBjApUwjdljnuIAArcY_tIWOM5ViZ_FN_13qPRYb5QyDIOy3kB9gqG5q_kapmiNDsANYj?key=bgcsq8E2ip6wVk3nVSJgBA)

-   create: present the registration form.

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXc45ZwhvspV3RQR6kBw6Xz0t4ZOjWYxxdNx0qNcVK706bTk2652ugrCkD7hbtfFAHp6_ow1bm6lGnfCEOzj0Tvake5oSyJH0jibDbwgDUIpgQlcUHG2J6oYbGQiGU5aR1km12U6?key=bgcsq8E2ip6wVk3nVSJgBA)

-   The user would be prompted to register.

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXeJA9qh-d1lOVVkYXKC0FNnq9IbiudTAJ2hG6iaSMBW-E4yKJ-5OSzYcNh_Ads232F0aT1S1JtMPQ2WVyh60KsIA1BVLS6GNE1oNZyqtBBfdAlHAD7ZuoCrU3XoU-dqt3kBrZM9Xw?key=bgcsq8E2ip6wVk3nVSJgBA)

-   select_account: The user is prompted to select one of the existing sessions or create a new one.
-   Using the login hint- The Login hint must be a valid logon name of a user. You can skip the account picker by providing the Login hint.

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXcQQQnfItiygoETRxHjpSQNnb4sYW8Yy7Xk1YxpS_9Szpwy_D_qAnDgGGF6pdPJXzYR-KXSxwSdnJhmafLd4frF5Pmz_am5Lj_V0Ov5ultILOPt0nzdM57-MAxXebnHv-rOhECe3g?key=bgcsq8E2ip6wVk3nVSJgBA)

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXf1FyQMwAlXAhSoxvLtZcwiep6xXjs3obrJmPJgvjYKeo0o0LYzzjNlcPYH9AnJ7Tyiz2Wv1UM4pBcjzYi8xToknEQ_ujDpEc6HU4r-KMrEswU9KwUTY51RT3mkKW10j48Iqnd5bQ?key=bgcsq8E2ip6wVk3nVSJgBA)

-   Without using the login hint- The user is prompted to select the respective user.
   
![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXct1CUvLP2aLtolMAftm2ExJWRdRTVI7UTFCusnX1PomxgmVXrNfWdbEDdznQWY7MXbDSd_hBBGTIZHk51Db_CYOQEw6Tdw-aDQiWpFPI4Kkn9YlJD-Uk2btsMn36rT1fJDcGp0Ag?key=bgcsq8E2ip6wVk3nVSJgBA)

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXc1C63ZZRAeTYMG78nYvA5ajzgNFPYGX_9o_CNsmqNc9RwlwEs5gBRpGl5-oq6UBy53NYjHTMO9DQ48guZXOpIzzozKPEvNPFNp48Jy4lffaSodsU7hLkeSvng_H2zXaezUikjr?key=bgcsq8E2ip6wVk3nVSJgBA)

## Conclusion

Hopefully, this tutorial gave you a good overview of how you can use the OIDC playground for testing OpenID Authentication Requests and can customize Zitadel behavior with different parameters based on your organization's needs. We encourage you to [explore Zitadel](https://zitadel.com/signin) on the cloud or self-hosted environment(s). If you want to learn more before starting, request a demo today. Click the [button](https://zitadel.com/discoverycall)to get in touch!

If you’re building in the Bay Area, or anywhere developers value speed, clarity, and control, the Zitadel OIDC Playground is your shortcut to robust, modern authentication without the guesswork.

## How can I try out and contribute to Zitadel?

Read our [documentation](https://zitadel.com/docs) and learn how you can set up, customise, and integrate authentication and authorisation into your project. We would love to see you being a part of the Zitadel community, and you can reach us at

-   [Discord](https://discord.com/invite/zitadel)
    
-   [Github](https://github.com/zitadel/zitadel/)
    

## Suggested reading

-   [Zitadel Getting Started](https://zitadel.com/docs/guides/start/quickstart)
    
-   [OIDC and Zitadel](https://zitadel.com/blog/secure-logins-with-zitadel-part-1)
    
-   [Securing Applications with OIDC and Zitadel](https://zitadel.com/blog/secure-logins-with-zitadel-part-2)

At Zitadel, we’re obsessed with building for developers and platform engineers. That’s why we created the OIDC Playground, a hands-on, interactive tool that lets you experiment with OpenID Connect authentication requests, see how Zitadel responds, and iterate in real time. Whether you’re integrating, debugging, or just curious, this is your fast lane to understanding and control.

Introducing an OIDC Playground by Zitadel: The Fastest Way for Developers to Master Authentication

A common task for many developer and security-centric teams is to provide an identity and access management (IAM) service.  Whether that component only consists of a sign-up form and a login page or a more complex infrastructure, the number one priority is always to provide a seamless functionality for your users.  Failure in implementation can have severe consequences. To reduce your risk and feel confident in your IAM platform, partnering seasoned professionals in the space ensures success.

Companies looking for authentication servers have the option to consider the solutions available in the market or build it themselves.  As each option presents its own set of benefits and drawbacks, teams are often overwhelmed to make the right choice.  In this article, we will cover the key pros and cons of each of the two options that help companies make the right decision for both short-term and long-term benefits.

### Benefits of a Custom-built Platform
1.  Built to your needs: Custom-built IAM platforms can be tailored to your organization's specific requirements.  With a custom solution, you have complete control over the user experience and the technology choices. You can design authentication flows that align with your brand and user journey, creating a seamless experience that doesn't feel disconnected from the rest of your application. This customization extends to crucial workflows like user onboarding, password resets, and permission management—all of which can be optimized for your specific use cases rather than following a generic approach.
2. Enterprise Integrations: Enterprise environments often present complex integration challenges that off-the-shelf IAM solutions struggle to address effectively. A custom-built IAM platform can be architected from the ground up to integrate seamlessly with your existing technology ecosystem, regardless of its complexity or uniqueness.
Legacy systems present a particular advantage for custom solutions. While many modern IAM platforms have limited support for older technologies or protocols, a custom solution can be built to bridge these gaps. Whether you're dealing with mainframe applications, custom LDAP schemas, or proprietary single sign-on systems developed in-house decades ago, a custom solution can be tailored to interface with these systems without compromise.
3. Control Over Data and Infrastructure: A custom-built IAM platform puts you in the driver's seat when it comes to data sovereignty and infrastructure decisions. This complete control means your organization retains ownership of user credentials, access patterns, and authentication logs—data that is often among the most sensitive your company manages.
For organizations in regulated industries such as healthcare, finance, or government, this control can become crucial. Custom solutions allow you to construct specific data residency requirements, ensuring user information never leaves particular geographic boundaries or jurisdictions. You can also implement custom encryption schemes that go beyond standard offerings, creating multiple layers of protection for particularly sensitive identity data.
4. No Vendor Lock-in: Building your own IAM platform frees your organization from the constraints of vendor dependencies. This independence means you're not tied to a particular company's business decisions, product roadmap, or pricing strategies. If a vendor decides to sunset a feature your business relies on or dramatically increases licensing costs, organizations using off-the-shelf solutions may find themselves scrambling to adapt.
Custom solutions also shield you from the impacts of acquisitions and mergers in the IAM market, which can often lead to discontinued products or significant changes in service quality and support. With your own platform, you maintain continuity regardless of market fluctuations.
5. Customized Compliance Implementation: Regulatory compliance requirements for identity management vary significantly across industries and regions. A custom IAM platform allows you to design compliance features that precisely address your specific regulatory landscape without unnecessary overhead.
For example, a custom platform can be built with GDPR's right to be forgotten as a core architectural principle rather than an afterthought. Healthcare organizations can design authentication workflows that inherently enforce HIPAA requirements. Financial institutions can implement multi-factor authentication schemas that directly align with specific banking regulations in their operating regions.
### Drawbacks of a Custom-built IAM Platform
While the benefits of custom-built IAM solutions are compelling, they come with significant challenges that organizations must carefully consider. The reality is that identity management is a specialized field requiring deep expertise in security, performance optimization, and regulatory compliance. Building your own platform means taking on the full burden of these complexities—often pulling focus and resources away from your core business objectives. The following drawbacks highlight why many organizations ultimately find that the apparent freedom of a custom solution can become a costly constraint.
1. Security Issues: A significant risk of building your own authentication server lies in its generally higher probability of security issues, which is usually due to a disproportionate time spent on building and not security implementation. Since keeping your users’ data safe is among the greatest responsibilities of the platform and the primary task of an IAM , it is essential to make sure an adequately established security system is given. One of the most obvious advantages specialized vendors have over DIY developers is the possession of a dedicated team with cybersecurity and software engineering expertise. The members of these teams can utilize their knowledge to create the best possible security system based on their diverse experiences.
IAM vendors commonly offer advanced security features, such as support for multi-factor authentication (MFA) and security keys (Yubikey etc.). Another security aspect where third-party IAM solutions prevail is pattern recognition: they can prevent attacks more easily due to their large user base, whereas a custom-made solution does not possess enough data to recognize suspicious patterns.
Keeping up with authentication best practices and standards becomes another insurmountable task for custom-built platforms, whereas IAM vendors can ensure compliance and adherence to standards.
2. Cost of Maintenance: Contrary to popular belief, you will likely find that building your own authentication server is not cheaper in the long run. While you might initially save money, that will quickly be compensated by the cost of development, maintenance, troubleshooting, upgrades, and the resources themselves that are needed for these procedures. Furthermore, you might find that unexpected expenses arise later on in your software’s lifetime: while initially you will likely implement a simple username + password login system, due to the high security requirements of a well-functioning authentication solution, you will most likely need to expand it with more complex features (f.e. Multi-Factor-Authentication, passwordless login options and more social logins).  Also, since your primary business is likely in an unrelated field to the IAM itself, the inevitable shift in your working context would entail additional costs. When considering a custom-built solution, it is therefore beneficial to evaluate if the needed investments over the lifetime of your product are ultimately less than the amount you would have to pay for the one-time fee of the purchasable alternative.  
Add in the scale by a factor of (n) to address a multi-tenancy requirement for each customer with their own settings, and the cost of maintenance grows exponentially.
3. Expensive, in all aspects: When creating anything from scratch, you should probably reckon with a lengthy production process. This not only delays the “time to value” of your business-critical applications as you first need to build the IAM platform before you can make your application available to your users.  This also applies to developing a service; given that authentication solutions require lots of API programming and complicated security features, fully building one might take at least a year as a full-time job. Since this service will handle sensitive data, the development of an adequately functioning security system also involves constant testing and optimizing, which should not be neglected to save time. The need for custom features also extends to the product phases well beyond the initial development: keeping your application functional and up to date requires you to additionally establish a maintenance system that will serve this purpose. Using an already established IAM solution would therefore likely save you several years of time, and money spent on essential resources.

![](https://cdn.sanity.io/images/y3uu7rkl/production/deeec64e2aa7e46f68c8de9addac4090ae2f3c80-2940x1656.png)
*Calculations based on our analysis*
### Benefits of Buying an IAM Platform
While custom-built IAM solutions offer some advantages, after examining the complex challenges of building one, it becomes clear why many organizations ultimately choose to purchase a dedicated IAM platform from specialized vendors. These purpose-built solutions offer numerous advantages that directly address the pain points of custom development.
1. Industry-Leading Security Expertise: Specialized IAM vendors focus exclusively on identity security, employing teams of security experts who dedicate their careers to staying ahead of emerging threats. This concentrated expertise translates into robust security practices that would be difficult for most organizations to replicate internally. Professional IAM solutions typically offer:
Regular security audits and penetration testing with third party partners
Rapid response and mitigation of vulnerabilities
Advanced threat detection and prevention capabilities
Compliance with the latest security standards and best practices and certifications
2. Faster Time to Market: Implementing a pre-built IAM solution dramatically accelerates your deployment timeline. What can typically take months or years to develop in-house can often be set up in weeks or even days with a vendor solution. This quick implementation means:
Your core products and services launch faster
Security enhancements reach your users more quickly
Development resources stay focused on your business differentiators
You realize return on investment sooner
3. Reduced Total Cost of Ownership: While the upfront licensing costs of purchased IAM solutions are visible line items in your budget, they typically represent a fraction of the total cost of building and maintaining a custom platform especially if you factor in the development time. A comprehensive IAM solution hence eliminates:
* Development costs for initial implementation of the security features
* Ongoing expenses for security updates and patching
* Infrastructure and operational overhead, especially for SaaS users
* Costs associated with specialized security talent acquisition and retention
* Expenses related to compliance certification and auditing

![](https://cdn.sanity.io/images/y3uu7rkl/production/6b2ba627a001746cc86e4499c29d15ae5f898fc1-2940x1648.png)

4. Continuous Innovation Without Internal Resources: Professional IAM vendors continuously improve their platforms, incorporating new authentication methods, security enhancements, and usability features as they emerge in the market. This ongoing innovation happens without draining your internal resources, allowing you to:
* Benefit from industry advancements automatically
* Support new standards and protocols without additional development
* Offer cutting-edge security features to your users
* Stay competitive with larger organizations that have more resources
5. Scalability and Reliability: Enterprise-grade IAM platforms are built from the ground up to handle massive scale with exceptional reliability. These solutions typically offer:
* High-availability architectures with redundancy built in
* Elastic scaling to handle usage spikes
* Global distribution for performance optimization
* Proven reliability under extreme load conditions
* Comprehensive monitoring and alerting options
6. Simplified Compliance Management: Managing compliance across multiple regulations (GDPR, HIPAA, SOC2, ISO27001, etc.) requires significant expertise and ongoing attention. Dedicated IAM platforms typically:
* Maintain compliance certifications so you don't have to
* Provide detailed audit logs and reporting
* Offer pre-built compliance frameworks for various industries
* Stay updated with evolving regulatory requirements
* Simplify your compliance audits with ready documentation
7. Professional Support and Expertise On-Demand: When issues arise (as they inevitably do), having access to specialized support can mean the difference between minor inconvenience and major business disruption. Established IAM vendors provide:
* 24/7 technical support from identity specialists
* Comprehensive documentation and implementation guides
* Professional services for complex deployments
* User community and knowledge sharing
* Training and certification programs


![](https://cdn.sanity.io/images/y3uu7rkl/production/18106bcce85f266ce752a3e24d3d7cba3b115fd6-2940x1654.png)

### Bringing the Best of Both Worlds with Zitadel 
Zitadel delivers enterprise-grade identity and access management without the development overhead of building your own solution from scratch. Unlike custom-built IAM systems that require significant engineering resources, ongoing maintenance, and security expertise, Zitadel provides a battle-tested, comprehensive solution out of the box. 
With Zitadel, organizations gain immediate access to modern authentication protocols, multi-tenancy support, robust user management, and authorization controls —all while avoiding the hidden costs, security vulnerabilities, and compliance challenges that often plague homegrown IAM implementations. By choosing Zitadel, your team can focus on core business objectives rather than reinventing complex identity infrastructure.
1. Developer-first, multi-tenant platform: As a developer-first multi-tenant platform, Zitadel gives you custom-level control with turnkey implementation - offering intuitive APIs, comprehensive SDKs, and detailed documentation that drastically reduces development resources while supporting complex multi-organization structures that would typically require months of custom coding. You can even build your own custom login UI using Zitadel's APIs while relying on its battle-tested security and standards implementation behind the scenes.
2. Flexible deployment: Zitadel offers the data sovereignty of custom solutions without the infrastructure burden. You have the ability to choose between the convenience of Zitadel Cloud with its zero-maintenance approach or the control of self-hosting in your own infrastructure - either way, you maintain full ownership of your identity data without the ongoing operational costs of a custom-built IAM platform.
3. Extensibility and Enterprise Integrations: Zitadel delivers adaptability at the level of a custom-built solution without the associated complexity of a custom-built IAM solution. Its extensive extensibility and enterprise integrations ensure seamless connection to your existing ecosystem through webhooks, actions, and pre-built connectors for enterprise systems, allowing for the same customization you get from building in-house without forking code, managing separate codebases, or compromising security.
### Get Started
Get started with  Zitadel, the comprehensive, ready-to-deploy Identity and Access Management platform  rather than building one from scratch. We offer the ideal authentication platform with flexible pricing, a variety of deployment options, extensive features, enterprise-grade security, and unlimited identities across all instances.

Have questions about authentication or anything else? Connect with us on the [Zitadel Discord Server](https://zitadel.com/chat). You can also find us on [LinkedIn](https://www.linkedin.com/company/zitadel/), [GitHub](https://github.com/caos/zitadel), [Bluesky](https://bsky.app/profile/zitadel.com), [Twitter](https://twitter.com/zitadel) or through our [website](https://zitadel.com/).

If you appreciate our work, please consider [giving us a star on GitHub](https://github.com/zitadel/zitadel). We value your support!

The Zitadel Identity and Access Management (IAM) platform offers a turnkey enterprise-grade platform for cloud-native organizations looking to move away from a custom-built IAM platform with modules that are expensive to maintain.

Stop Building and Maintaining Frankenstein IAM Platforms


At Zitadel every customer is granted their own virtual instance with unlimited identities that allows them to fully configure their instance to their needs. This includes choosing a deployment option which is most suitable for the unique needs, security requirements, budget, and resources of each individual organization.

Unlike most Identity and Access Management (IAM) offerings available today (such as Auth0 by Okta, Keycloak, etc.) Zitadel officially offers flexible deployment options – to deploy in Zitadel Cloud or to self-host in your preferred location. In this article, we will discuss our Cloud and self-hosted options to help you find the right solution for your project or business.

## Convenience and Speed-to-Market: Zitadel Cloud

### Pros:

Our public cloud option is ideal for any user who is intrigued by the idea of a hosted deployment model that is ready-to-use the moment you obtain it. Unlike the self-hosted alternative, Zitadel Cloud is pre-configured and automated, saving you the time and money spent on implementing, managing, and maintaining your platform. A virtual instance will automatically upgrade with new product improvements and security fixes without your intervention.

You also do not have to worry about expanding your infrastructure when your service gains new customers or sees usage spikes. Zitadel Cloud can help scale and handle resource allocation for you. A notable benefit also lies in the possibility of choosing a region that works best for your project to stay close to your users. The Zitadel platform is built to manage traffic from a global audience or constrain data to only a certain location, depending on your organization's needs. Both scenarios are possible through Zitadel Cloud, while we optimize and guarantee low latencies and high availability.

With the Zitadel Cloud, you also benefit from the operational security aspects, such as Distributed Denial of Service (DDoS) attack protection and automated certificate management. Zitadel is an open source platform and has the same open source releases available to both our cloud and self hosted environments. We take security seriously and go above-and-beyond so we take pride in publishing the results of our [penetration tests](https://zitadel.com/blog/pentest-results-h1-2021) done by external auditors, as soon as we mitigate issues.

As a “cherry on top”, we offer a true pay-as-you-go subscription method to keep the total cost of ownership (TCO) affordable to even strict budgets.

### Cons:

There are certain weaknesses relying on a Cloud deployment, which are easily outweighed by the convenience of a pay-as-you-go subscription for most customers. While most customers are satisfied with our infrastructure in terms of cloud provider and data location options, some want to choose their own infrastructure providers or data location. In this case self-hosting is the best option (we also partner with managed service providers in some areas if a dedicated instance of Zitadel is the preferred option). Both options are also viable in case a customer requires more flexibility of upgrade cycles or backup frequencies.

A common weakness in today's software is supply chain risk, where our open source model provides extraordinary transparency of code, dependencies, and processes, yet a customer relies on the quality of our technical and organizational measures to manage information security. We are continuously improving our information security and are ISO27001 certified. If your organization requires complete control over the technical and organizational measures, you should choose to self-host Zitadel.

Another challenge in a Cloud deployment lies in its less flexible options out of the box. While companies mostly offer a wide variety of templates to choose from, their number can't compete with the infinite customization possibilities that come with building your own platform. We do not recommend building your own identity management system, rather we promote our platform approach where customers can easily extend functionality of the platform by loosely coupling new components. This is supported by [Zitadel’s API-first approach](https://zitadel.com/docs/apis/introduction), SDK's in [various languages](https://zitadel.com/docs/sdk-examples/introduction), and programmatic extensibility through [Zitadel Actions](https://zitadel.com/docs/guides/manage/console/actions).

The summed-up benefits of Zitadel Cloud include:

- Receive a pre-configured and implemented platform – no need to bother with updates, backups, maintenance, and troubleshooting
- Operational security provided
- Automated backups and updates
- Availability guarantees and automatic scaling
- “Pay as you go” model with low total cost of ownership
- Choose the region that works best for you
- Technical support from the creators - we are here to help

## Complete Control: Self-hosted

### Pros:

Unlike Zitadel Cloud, the self-hosted version is hosted by you on your infrastructure. In the case of Zitadel, companies or individuals can deploy Zitadel on their preferred cloud provider or install it as an on-premise solution; Both of these options allow our customers to take full control over all aspects, instead of having to rely on our infrastructure and our technical and organizational processes. Zitadel is based on cloud-native principles and is designed to be deployed as containers, which makes it straightforward to run and operate on almost any platform.

Self-hosting is a great choice if you have the resources to set up and host your own Zitadel instances on custom infrastructure with your company's needs in mind. If implemented correctly, the features of a self-hosted platform even have the potential to surpass the security possibilities of Zitadel Cloud, making it an ideal alternative for firms working with sensitive data.

The key benefits of self-hosting include:

- Manage your platform with full control in your own cloud or hardware
- Be in control of your technical and organizational measures
- Fully customizable platform
- Self-hosting organizations can get commercial technical support with an SLA
- Highest possible security, if implemented accordingly

### Cons:

The setup cost and maintenance are often downsides of self-hosting, we recommend choosing this solution if your company already possesses internal resources to handle the hosting and is ready to pay the investment and upkeep. While we at Zitadel are happy to help with any issues, “support” still needs to be considered especially around the technical aspects of self-hosting. The responsibility of adequately hosting the platform lies solely in the hands of the company.

We also tend to discourage self-hosting your identity platform without an in-depth IT-knowledge. As the security measures must be manually installed and maintained, mistakes in the implementation can potentially lead to inadequate protection from intruders.

<figure>
  <img
    src="/blog/2025-02-04-zitadelcloudvsselfhosting.png"
    width="100%"
    alt="Figure 1: Benefits of Zitadel Cloud vs. Zitadel Self-Hosted"
  />
</figure>

## Which option to choose?

While both deployment options have their respective advantages, the self-hosted alternative will most likely benefit companies that aim to fulfill some very specific requirements or compliance goals. If your organization lacks internal staff with in-depth IT knowledge, the serious dangers of faulty implementation are not worth risking. The advantages of Zitadel Cloud outweigh those of self-hosted options for most organizations and are therefore generally the recommended path to take. For easier decision-making, we created this simplistic chart as a guide:

<figure>
  <img
    src="/blog/2025-02-04-cloudselfhostdecisionchart.png"
    width="100%"
    alt="Figure 2:  Handy Reference Chart to Decide if Zitadel Cloud or Zitadel Self-Hosted is the Right Choice"
  />
</figure>

Whether you choose to use Zitadel Cloud or host Zitadel yourself, Zitadel ensures the best possible deployment experience with its flexible pricing options, comprehensive set of features, guaranteed high security, and unlimited identities for all options. In the future, you can also decide to migrate from Zitadel Cloud to hosting it yourself.

Should you have questions regarding Zitadel Cloud, self-hosting, or any other related (or unrelated) topics, feel free to contact us anytime on our Zitadel [Discord Server](https://zitadel.com/chat), our [Bluesky](https://bsky.app/profile/zitadel.bsky.social), [Twitter](https://twitter.com/zitadel), [Linkedin](https://www.linkedin.com/company/zitadel/) or [GitHub](https://github.com/zitadel/zitadel) pages, or on our [Website](https://zitadel.com/contact).

As you find the project helpful, please be sure to [give us a star over on GitHub](https://github.com/zitadel/zitadel/stargazers).


A blog post detailing the use cases that best suit a self-hosted vs. cloud model for an IAM Platform while demonstrating the flexibility offered by Zitadel

Zitadel Self-Hosted vs. Cloud: Making the Right Choice


We've developed a new TypeScript-based login system to streamline the authentication process for our customers. This solution offers a **flexible**, **customizable**, and **self-hostable** login experience.

By providing a ready-to-use login solution, we aim to reduce development time and effort for our customers. The open-source nature of the project allows for easy customization and adaptation to specific business needs.

Our immediate goal is to enable customers to self-host the login system. In the future, we plan to fully integrate this new login system into our cloud offering, providing a more robust and secure authentication experience. We plan to initiate the first cloud integration by the end of February. New customers will be automatically provisioned with the new cloud-based login. Existing customers will have the flexibility to migrate their entire instance or individual applications at their preferred time.

The new TypeScript login system offers several key improvements:

- **Leverages Modern Technology**: By utilizing our newly developed [session APIs](https://zitadel.com/docs/apis/resources/session_service_v2), we've significantly enhanced the security and performance of the authentication process.
- **Enhanced Features**: The system introduces new features such as user invitation flows and passkey-only authentication, providing greater flexibility and convenience for our users.
- **Improved Developer Experience**: The use of TypeScript, a widely adopted language in frontend development, makes the codebase more accessible and easier to contribute to. This encourages community involvement and fosters rapid development.

## Current State

Our primary goal for the TypeScript login system is to fully replace the existing login functionality within the current Zitadel version, which is shipped with Zitadel default. This will allow us to leverage the benefits of the new system, including its modular architecture and enhanced security features.

To achieve this, we are actively working on implementing the core features currently available in Zitadel, such as:

- **Authentication Methods**:
  - Username and Password
  - Passkeys
  - Multi-Factor Authentication (MFA)
  - External Identity Providers (OIDC, SAML, etc.)
- **OpenID Connect (OIDC) Compliance**: Adherence to the OIDC standard for seamless integration with various identity providers.
- **Customization**:
  - Branding options to match your organization's identity.
  - Flexible configuration settings to tailor the login experience.

The full feature list can be found [here](https://github.com/zitadel/typescript?tab=readme-ov-file#features-list).

As we continue to develop the TypeScript login system, we will provide regular updates on its progress and new capabilities.

<figure>
  <img
    src="/blog/2025-01-21-typescript-login-01.png"
    width="100%"
    alt="Login UI with authentication method loginname, Apple, Google OIDC, Google and GitLab"
  />
</figure>

## Limitations

For the first release we have excluded the following features:

- SAML 2.0 ([IdP](https://zitadel.com/docs/apis/saml/endpoints) & [SP](https://zitadel.com/docs/guides/integrate/identity-providers/mocksaml))
- [Generic JWT IDP](https://zitadel.com/docs/guides/integrate/identity-providers/jwt_idp)
- [LDAP IDP](https://zitadel.com/docs/guides/integrate/identity-providers/ldap)
- [Device Authorization Grants](https://zitadel.com/docs/guides/integrate/login/oidc/device-authorization)
- Timebased features
  - [Lockout Settings](https://zitadel.com/docs/guides/manage/console/default-settings#lockout)
  - [Password Expiry Settings](https://zitadel.com/docs/guides/manage/console/default-settings#password-expiry)
  - [Login Settings - Multifactor init prompt](https://zitadel.com/docs/guides/manage/console/default-settings#login-behavior-and-access)
  - [Force MFA on external authenticated users](https://zitadel.com/docs/guides/manage/console/default-settings#login-behavior-and-access)
- [Passkey](https://zitadel.com/docs/guides/manage/console/default-settings#passwordless)/[U2F Setup](https://zitadel.com/docs/guides/manage/console/default-settings#multifactor-mfa)
  As passkey and u2f is bound to a domain, it is important to notice, that setting up the authentication possibility in the ZITADEL management console (Self-service), will not work if the login runs on a different domain
- [Custom Login Texts](https://zitadel.com/docs/guides/manage/console/default-settings#login-interface-texts) configurations are not used in the typescript login, if you want to customize them, fork the repository and change the texts to you liking

## Beta Testing

The TypeScript login system is currently in the beta testing phase. Your feedback is highly valuable in helping us refine and improve this new solution.

At your convenience please open any issues faced on our [Typescript Login GitHub repository](https://github.com/zitadel/typescript) to report bugs or suggest enhancements while more general feedback can be shared directly to the [corresponding discord thread](https://discord.com/channels/927474939156643850/1329100936127320175/threads/1329827099606782093).
Your contributions will play a crucial role in shaping the future of our login system.
Thank you for your support!

### Steps to start testing

The simplest way to deploy the new login for yourself is by using the [“Deploy” button in our repository](https://github.com/zitadel/typescript?tab=readme-ov-file#deploy-to-vercel) to deploy the login directly to your Vercel.

1. [Create a service user (ZITADEL_SERVICE_USER_ID) with a PAT](https://zitadel.com/docs/guides/integrate/service-users/personal-access-token#create-a-service-user-with-a-pat) in your instance
2. Give the user IAM_LOGIN_CLIENT Permissions in the default settings (YOUR_DOMAIN/ui/console/instance?id=organizations)
   [https://zitadel.com/docs/guides/manage/console/managers](https://zitadel.com/docs/guides/manage/console/managers)
3. Deploy login to Vercel: You can do so, be directly clicking the “Deploy” button at the bottom of the readme in our [repository](https://github.com/zitadel/typescript)
   <figure>
     <img src="/blog/2025-01-21-typescript-login-02.png" width="100%" alt="Deploy to vercel button" />
   </figure>
4. If you have used the deploy button in the steps before, you will automatically be asked for this step. Enter the environment variables in Vercel
   - ZITADEL_SERVICE_USER_ID
   - PAT
   - ZITADEL_API_URL (Example: https://my-domain.zitadel.cloud, no trailing slash)
5. Add the domain where your login UI is hosted to the [trusted domains](https://zitadel.com/docs/apis/resources/admin/admin-service-add-instance-trusted-domain) in ZITADEL (Example: my-new-zitadel-login.vercel.app)
6. Use the new login in your application. To implement the new login, choose one of the following options:
   1. Enable the new login in your application configuration: Add the URL of your new login UI to your application’s settings. Zitadel will automatically redirect users to the new login if they attempt to use the old one.
   2. Enable the loginV2 feature on the instance:Activate the LoginV2 feature in your Zitadel instance and specify the URL of your new login. This will apply the new login for all applications configured under your Zitadel instance. Example: https://my-new-zitadel-login.vercel.app. More details: [Zitadel Documentation](https://zitadel.com/docs/apis/resources/feature_service_v2/feature-service-set-instance-features)
   3. Update the issuer URL in your application configuration: Change the issuer domain in your application configuration to match the new login domain.

For more information read our [Login V2 documentation](https://zitadel.com/docs/guides/integrate/login/hosted-login#hosted-login-version-2-beta)

## Important Notes

- **User Creation**: The new TypeScript login utilizes the Session and User V2 APIs. Note that the User V2 API introduces some changes compared to the V1 API. Ensure you create users using the new V2 API to maintain compatibility.
- **External Identity Providers (IDPs)**: To enable login with external identity providers, such as Google or Apple, follow our existing setup guides. Ensure that you use the following redirect URL: $YOUR-DOMAIN/idps/callback.
- **Passkey/U2F Authentication**: These authentication methods are domain-bound. Since your new login operates on a different domain than the previous one, existing passwordless authentication (e.g., fingerprint, Face ID) and U2F methods cannot be reused. Additionally, when managed through the Zitadel console, they will be tied to the old domain. Note: To avoid this issue, consider running the new login on a subdomain of your current instance (e.g., myinstance.zitadel.cloud and login.myinstance.zitadel.cloud).

## Customization / Feature requests

If you have specific customization needs beyond the current capabilities of the Typescript login offering, please follow one of these two options:

1. **Fork the Repository**: By forking the [Typescript Login](https://github.com/zitadel/typescript) repository on GitHub, you can directly modify the source code to implement your desired features. This offers maximum flexibility and control over the login system.
2. **Build Your Own Login UI**: For full customization control, you can leverage our Session API to build your own login interface. This allows you to create a fully tailored experience that aligns perfectly with your application's design and functionality. A detailed guide on how to use the Session API is available [here](https://zitadel.com/docs/guides/integrate/login-ui).

## Future plans

Our roadmap for the TypeScript login includes several exciting developments:

### Short-term Goals

- **Feature Parity**: We will continue to implement the missing features listed above to ensure seamless migration.
- **Multi-tenancy**: We will enable multi-tenancy to support our cloud offering, allowing new users to directly access the new login experience while existing customers can migrate at their own pace.

### Long-term Vision

- **Self-Service Components**: We plan to introduce self-service components for the users like profile management, making it easier for you to integrate these functionalities into your applications without relying on our full-fledged management console.
- **Enhanced Customization**: We will explore options to further customize the appearance of the login page, allowing you to tailor it to your specific branding and design preferences.

By focusing on these areas, we aim to provide a powerful, flexible, and customizable login solution that empowers your applications.

Now it’s your turn. Do you have any suggestions for [improvement](https://github.com/zitadel/typescript/issues/new?template=improvement.yaml) or [bug reports](https://github.com/zitadel/typescript/issues/new?template=bug.yaml)? Explore the [repository](https://github.com/zitadel/typescript) and share your feedback in our [discord thread](https://discord.com/channels/927474939156643850/1329100936127320175/threads/1329827099606782093).


We've developed a new TypeScript-based login system to streamline the authentication process for our customers.

Introducing our New TypeScript Login


Imagine this: Dave, an IT manager, is responsible for overseeing access for multiple tenants within his company’s cloud service. He has User A from RetailCo and User B from FinanceCorp, both needing access to the same service but with completely different security requirements. User A prefers logging in with their Google account and demands strict password policies. User B uses their company’s Azure AD and requires multi-factor authentication. Dave thought managing a single organization was tough, but this? This is a whole new level of complexity.

As if that wasn't enough, Dave’s company is rapidly growing, introducing more customers from various industries, each with unique compliance and security requirements. Now he has User C from TechInnovators who needs passkeys for enhanced security, and User D from EduWorld demanding seamless SAML integration with their existing single sign-on system. The more tenants Dave’s company takes on, the more convoluted and headache-inducing his job becomes.


## Understanding Multi-Tenant IAM

Implementing multi-tenant Identity and Access management (IAM) systems can be complex, daunting, and filled with hidden challenges. Whether you're addressing the needs of B2B, B2C, or M2M (Machine-to-Machine) environments, multi-tenancy involves a single service instance serving multiple tenants, such as organizations or customers. This requires meticulous data and component segmentation based on service needs and data types. The chaos gets further compounded with individual compliance requirements. 

Consider a simple login screen—two input fields and a button. It looks straightforward, right? But this seemingly simple UI is just the tip of the iceberg. Behind the scenes, there's a multitude of complexities: username and password management, multi-factor authentication options (SMS codes, email codes, authenticator apps), passwordless authentication (face recognition, fingerprint scans), and identity brokering (social logins like Google, Apple, or Facebook).

On top of that, managing security settings, performing regular penetration testing, adhering to standards (such as SCIM, OAuth 2.0, and OpenID Connect), and obtaining certifications (like ISO and SOC 2) add layers of complexity. This is especially true when these features must be replicated across multiple tenants.


<figure>
  <img
    src="/blog/2024-07-25-navigating-pitfalls-of-multitenancy-01.png" 
    width="100%"
    alt="Underneath the simple login form"
    style={{ margin: '0 auto' }}
  />
  <figcaption>

    Figure 1 - Underneath the simple login form lies a multitude of complexities—it's merely the tip of the iceberg

  </figcaption>
</figure>


When you introduce multi-tenancy, everything becomes more complex. Each customer brings their unique requirements—username and password for one, passwordless or multi-factor authentication for another, or integration with existing identity systems like Azure AD or Google Business. These varying needs mean you must be able to configure and maintain diverse systems for each tenant, requiring significant time, expertise, and resources.

<figure>
  <img
    src="/blog/2024-07-25-navigating-pitfalls-of-multitenancy-02.png" 
    width="100%"
    alt="The layers of complexities"
    style={{ margin: '0 auto' }}
  />
  <figcaption>

    Figure 2 - The layers of complexities behind the the multi-dimensional aspects of multi-tenancy

  </figcaption>
</figure>

Let’s look at a real-world example. Imagine you run an online store serving end consumers, business partners, and your workforce. Each group has different needs: consumers need a user-friendly login and account management system, business partners (such as other sellers) might use their existing enterprise identity systems and may have their own branding requirements, and your workforce needs robust role and permission management to secure administrative tasks.

Yes, it’s possible to manage all these requirements with roles and permissions. However, when you consider the need for different security settings, it often makes more sense to adopt a multi-tenancy approach. As you scale to multiple customers, each one may require unique domains, branding, social logins, and security settings. Managing these variations with a roles and permissions model becomes increasingly complex and unwieldy. Multi-tenancy offers a more streamlined and efficient solution, allowing you to handle these diverse needs effectively and securely.

Questions to ask when dealing with multi-tenancy include: How many levels of tenancy do you need? Are there multiple organizations within a tenant? What scenarios are you dealing with (B2C, B2B, mixed)? Each user group might need different authentication methods, security policies, and compliance requirements (e.g., GDPR, SOC 2, ISO).

Consider the example of a healthcare application where different tenants have varying password hashing requirements (PBKDF2, Argon2, bcrypt) and audit trail needs. Protocol-specific differences also arise; for instance, integrating customers’ existing Azure AD for user federation can lead to numerous configurations and requirements.

So, do you explain outdated or incorrect policies to each customer, or make your software flexible enough to handle these diverse needs while focusing on your business case? Ideally, you want to provide a robust, flexible platform that can accommodate different configurations and compliance requirements.

From an architectural perspective, you have two main options: shared systems or dedicated systems. Shared systems are cost-effective and simpler to manage but come with lower isolation, potential security risks, compliance challenges, and performance issues. Dedicated systems offer enhanced security, compliance, and customization but require more management, infrastructure costs, and personnel.

In summary, identity infrastructure involves much more than just two input fields and a button. It's intricate plumbing work, particularly with multi-tenancy. Always remember that the customer is king: guide them on security best practices, but also ensure your infrastructure can meet their unique needs. A proven track record in security is essential for enterprise deals, so regular penetration tests and certifications are crucial. Make use of established frameworks like OAuth 2.0 and OpenID Connect, and rely on an existing IAM product, such as ZITADEL, for authentication and authorization instead of building your own from scratch.


## How ZITADEL Handles Multi-Tenancy


ZITADEL has a strong focus on supporting SaaS providers with a multi-tenancy use case. This is achieved by allowing multiple organizations within your ZITADEL instance, where all customers can self-manage their own users and roles. ZITADEL operates as a shared system, but it also allows for virtual instances and separate organizations within each instance. This setup is particularly beneficial for B2B app providers where

- you sell your application to other businesses, where each business wants to manage their own users, roles, and access settings
- your customers have different needs for the login flow, such as unique branding, federated logins, password policies, and MFA options
- your customers want to self-manage their users and roles without relying on your administrative team
- users/employees of your customers need to log in or register independently
- not all customers have the same feature set within your application


## How Does Multi-Tenanacy Work in ZITADEL


### Create Organizations

For each customer, create an [organization](https://zitadel.com/docs/concepts/structure/organizations), the equivalent of a tenant, in ZITADEL. Assign an [organization manager](https://zitadel.com/docs/guides/manage/console/managers) to let each customer manage their users independently. Furthermore, users can belong to multiple organizations and switch between them using the same identity, simplifying user management and improving the user experience.

### Custom Configuration

Customers can configure their login look and feel ([branding](https://zitadel.com/docs/guides/manage/customize/branding), [authorization methods](https://zitadel.com/docs/guides/manage/console/roles), [federation](https://zitadel.com/docs/guides/integrate/identity-providers/introduction) or you can do it for them. ZITADEL supports various authentication methods, including [username/password](https://zitadel.com/docs/guides/integrate/login), MFA, and [passwordless options](https://zitadel.com/docs/concepts/features/passkeys). Integrate existing identity providers like Microsoft Azure AD, Google etc., allowing users to log in with their existing corporate credentials.

### Domain Discovery

ZITADEL offers [domain discovery](https://zitadel.com/docs/guides/solution-scenarios/domain-discovery) capabilities, which routes users to the appropriate organization based on their login methods, whether it's a username, email, or phone number. For instance, if a user from "foo.com" logs in, they are routed to the Foo Organization, while a user from "bar.com" is directed to the Bar Organization. This ensures users are authenticated according to their organization’s policies and access settings.


### Project Grants

With [project grants](https://zitadel.com/docs/concepts/structure/granted_projects) (also known as granted projects) your customers can access your project with a subset of roles so they can manage authorizations for their users. Enable granular role management, allowing organizations to assign specific roles and permissions to users based on their needs.



## Standards and Compliance


From a certification and standards compliance perspective, ZITADEL is [GDPR compliant](https://zitadel.com/gdpr) and [ZITADEL’s OIDC library has been certified by the OpenID Foundation](https://zitadel.com/blog/openid-connect-certification). Furthermore, [ZITADEL recently achieved ISO 27001 certification](https://zitadel.com/blog/zitadel-iso-27001-certified) for its information security management system, to maintain the highest standards of information security. ZITADEL assures customers that their data is protected by robust security measures, reflecting global best practices in information security management. 

By providing these capabilities, ZITADEL simplifies the management of multi-tenant IAM systems, ensuring security, flexibility, and ease of use for both administrators and end-users. Moreover, ZITADEL provides support for unlimited users, projects, and applications, making ZITADEL a trusted, secure, and scalable solution for your multi-tenant IAM needs that can grow with your business. 


*This blog post is based on and expands upon the talk "The Perils and Pitfalls of Multi-Tenant Identity Management" from Cloud Native Security Con 2024, North America. For the full discussion, you can watch the video [here](https://www.youtube.com/watch?v=gZHxjnx81WE&list=PLj6h78yzYM2MSAFvjG22ZynvaUs1nnaQJ&index=46).*




This post explores the complexities and solutions of multi-tenant identity management in modern SaaS environments.

The Complexities and Pitfalls of Multi-Tenant Identity and Access Management


In this newsletter, I want to share updates about our platform, and provide some tips on how you can simplify your identity infrastructure.

## Feature highlights

In June,  we shipped over 60 bug fixes, improvements, and new features. Most of those changes were released with ZITADEL [v2.55.0](https://github.com/zitadel/zitadel/releases/tag/v2.55.0), so make sure you are running the latest version.

### New password expiry feature

ZITADEL has introduced a new password age policy feature, enabling organizations to require users to change their passwords regularly. This feature can be easily managed through the Console UI at both instance and organization levels. Users will be prompted to change their password in the Login UI if their current password exceeds the defined age limit. This enhancement strengthens ZITADEL's password management capabilities and provides organizations with greater control over their password lifecycle.

![ZITADEL Console UI password expiry settings](2024-07-04-zitadel-product-newsletter-june-2024-01.png)

### Limit requested roles with new scope

A new scope was introduced to address the issue of excessive roles being returned in tokens (and as such increasing their size) for users belonging to multiple organizations. This new scope allows administrators and applications to specify which organizations' roles should be included in the token, thus streamlining access control for specific use cases. By using the new scope, either once or multiple times, only the roles of the specified organizations will be included in the token.  It's important to note that this feature is not compatible with legacy mode for Introspection or Userinfo endpoints.

[Reserved Scopes](https://zitadel.com/docs/apis/openidoauth/scopes#reserved-scopes)

### More performance improvements

ZITADEL's performance continues to improve as the team works to identify and eliminate bottlenecks. Notably, import operations for large quantities of project grants will witness a substantial enhancement. Furthermore, a significant improvement has been made to OpenID Connect / OAuth 2.0 session checks, effectively addressing recent observations identified during load testing.

### Sending test emails

The newly introduced feature has enhanced ZITADEL’s SMTP functionality by introducing a new testing step within the SMTP provider wizard. This allows administrators to verify their SMTP configuration before saving or updating it, preventing potential issues with email delivery. Additionally, the existing table of SMTP providers now includes a test option for existing configurations. This streamlined testing process ensures that email settings are correct from the outset, saving time and effort. This feature was contributed by the community - thank you for your efforts!

![ZITADEL Console UI sending test email during configuration of SMTP](2024-07-04-zitadel-product-newsletter-june-2024-02.png)

[Changelog](https://zitadel.com/changelog)

## ZITADEL achieves ISO 27001 certification, reinforcing commitment to security

<img src="/blog/2024-07-04-zitadel-product-newsletter-june-2024-03.png" width="25%" align="left" alt="" class="wrap"/>

In a significant milestone for ZITADEL's commitment to security and data protection, we have achieved ISO 27001 certification for our information security management system (ISMS). This internationally recognized standard validates our dedication to maintaining the highest levels of security for our customers' data.

To provide further transparency and information about our security practices, we have also updated our [Trust Center](https://trust.zitadel.com). This resource offers comprehensive details on our security posture, policies, and certifications.

[ZITADEL Achieves ISO 27001 Certification](https://zitadel.com/blog/zitadel-iso-27001-certified)

## 21 more reasons to celebrate: Community contributions in June

* Many Console UI improvements were contributed by [doncicuto](https://github.com/doncicuto) improving the user experience for administrators and users. Moreover [doncicuto](https://github.com/doncicuto) made it possible to send test mails for SMTP configurations and further improvements to mail providers.
* [JesperWe](https://github.com/JesperWe) made it possible for Swedish speakers to use their beautiful native language
* [Schettn](https://github.com/schettn) created a guide to integrate with the [Pylon](https://github.com/getcronit/pylon) framework

Many thanks to the contributors this month for their efforts, helping to improve documentation, tests, and fixing bugs in our code: [dkaminer](https://github.com/dkaminer), [panapol-p](https://github.com/panapol-p), [jvanderneutstulen](https://github.com/jvanderneutstulen), [danielmoisa](https://github.com/danielmoisa), [Loddan](https://github.com/Loddan), [Yxnt](https://github.com/Yxnt), [Cubox](https://github.com/Cubox), [danielloader](https://github.com/danielloader), [jfschubert](https://github.com/jfschubert)

Thinking of contributing? Grab a ‘good first issue’ or start a discussion. 

[Contributing guide](https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md)

## Additional resources

* [ZITADEL Bi-Weekly Office Hours](https://github.com/zitadel/zitadel/blob/main/MEETING_SCHEDULE.md)
* [Forza Italia: Retreat the third edition in Bologna](https://zitadel.com/blog/team-retreat-bologna)
* First time contribution (Japanese only): [OSS コントリビュートの実績を解除した](https://zenn.dev/otakakot/articles/dc58ff849e43e4)
* Integrate .NET (Polish only):  [Integracja Aplikacji .NET z Zitadel | bd90](https://bd90.pl/integracja-aplikacji-net-z-zitadel/)

ZITADEL introduced new features and enhancements, including a password expiry feature, a new scope to limit requested roles in tokens, SMTP configuration testing, and performance improvements. ZITADEL achieved ISO 27001 certification, demonstrating its commitment to security.

Product Newsletter June 2024


ZITADEL, a leading provider of cloud-native identity and access management (IAM) solutions, has achieved ISO 27001 certification for its information security management system (ISMS). This certification demonstrates ZITADEL's deeply rooted commitment to protect the confidentiality, availability, and integrity of customer, company, and employee data.

"Obtaining the ISO 27001 certification is a testament to ZITADEL's commitment to information security," said Florian Forster, CEO of ZITADEL. "This certification demonstrates that we have the systems and processes in place to protect our customers' data."

<img src="/blog/2024-06-20-zitadel-iso-27001-certified-01.png" width="35%" align="left" alt="" class="wrap"/>

The ISO 27001 standard is a globally recognized framework for information security management. It provides a comprehensive set of requirements for establishing, implementing, operating, monitoring, reviewing, maintaining, and continually improving the security of ZITADEL.

We designed our information security management system (ISMS) to protect against a wide range of threats, including unauthorized access, data breaches, and cyberattacks. The ISMS further includes processes for managing and responding to security incidents.

"Secure development and operations practices are essential for protecting our customers' data," said Fabienne Bühler, CPO of ZITADEL. "ISO 27001 certification provides our customers with assurance that their data is safe and secure."

ZITADEL's ISO 27001 certification is a valuable asset for the company's customers. It provides customers with assurance that their data is protected by world-class processes and tools .

"Our commitment to information security and data privacy is steadfast," said Maximilian Panne, COO of ZITADEL. "ISO 27001 certification is a recognition of our efforts to protect our customers' data at ZITADEL."



You can verify the validity of our ISO certificate by visiting the [website of the British Assessment Bureau](https://cvs.babcert.com/babcert.asp?c=258048&v=3fs61l6zn6).

Visit the [Trust Center](https://trust.zitadel.com) to learn more about our commitment to information security and data protection.


ZITADEL achieved ISO 27001 certification, demonstrating its dedication to data protection and cybersecurity. This certification provides a framework for information security management, safeguarding data against unauthorized access and cyber attacks.

ZITADEL Achieves ISO 27001 Certification


This is Max from ZITADEL. As in the previous months, in this update I want to highlight our product updates, and tips and tricks in making your identity infrastructure easier.

## Feature highlights

Again in May, we kept the pace high with more than 76 improvements shipped to our self-hosting and cloud users. Let’s go through the key improvements to ZITADEL this month.

[All changes](https://zitadel.com/changelog)

### Improvements using external SAML IdPs

We understand that many organizations, particularly enterprises, leverage SAML for user federation. In response to your needs, we've made significant steps in enhancing ZITADEL's interoperability with various SAML providers this May.

Previously, ZITADEL relied on a persistent nameID format, requiring external identity providers (IdPs) to consistently return this format for linking users. However, some IdPs utilize transient nameIDs, leading to mismatched user identities.

This update allows you to define the preferred nameID format and configure how ZITADEL maps users based on attributes received from the external IdP. For instance, you can leverage email addresses from the IdP to link users with matching emails in ZITADEL.

While ZITADEL offers pre-configured templates for external IdPs that utilize OpenID Connect, we're considering extending this functionality to SAML providers. We value your feedback – let us know your thoughts on this potential addition!

[Should we support SAML provider templates?](https://github.com/zitadel/zitadel/issues/7995)

### Making it easier to manage resources programmatically

While you get all the functionality through a UI, we are api-first and you are able to manage everything through our APIs. Managing ZITADEL resources and configuration programmatically just got simpler with some recent updates.

When you start with a new ZITADEL system, you need a first admin user to login and configure your system. In the past it was only possible to either create a human user or a service user, but not both at the same time. With a recent update creating both a human and service user is now possible, giving you hopefully a much simpler and easier access to configure ZITADEL from the start.

Moreover our [terraform provider](https://zitadel.com/docs/guides/manage/terraform/basics) got significantly updated and improved over the last weeks. Examples are managing organization and user metadata as well as managing SAML and OIDC generic external identity provider templates.

### Scaling to multi-million identities

We're excited to announce performance optimizations in ZITADEL to meet the growing needs of our enterprise customers! This update addresses the demands of multi-million identity deployments and aligns with our ongoing commitment to performance improvement. We've focused on enhancing the token endpoint, specifically for new token creation, alongside optimizations for many frequently used ZITADEL APIs. For detailed upgrade guidance, please refer to the technical advisories.

[Technical Advisories](https://zitadel.com/docs/support/technical_advisory)

## Office hours

Gear up for deeper dives and live engagement! We are excited to announce bi-weekly office hours on our Discord server for our community. These hour-long sessions will offer in-depth explorations of upcoming features, followed by a live Q&A where the ZITADEL team tackles your burning questions.

The first session, held on May 29th, delved into the exciting new version of the Actions feature.

Don't miss out on this chance to connect with the ZITADEL team and stay ahead of the curve! Checkout our [meeting schedule](https://github.com/zitadel/zitadel/blob/main/MEETING_SCHEDULE.md) for upcoming sessions.

[Office hours meeting schedule](https://github.com/zitadel/zitadel/blob/main/MEETING_SCHEDULE.md)

## You will become a Pro

ZITADEL Cloud subscription model is changing to a simpler daily active user (DAU) model on July 1st for easier cost allocation and full feature access across instances. This serves as a friendly reminder that accounts not already on our Pro plan will automatically update.

All new subscription plans will include in the base fee 25’000 Daily Active Users in a month, one custom domain, and 3 external identity providers.

[Pricing Plans](https://zitadel.com/pricing)

## Contributors for the win

19 contributions came from our community in May. 
Thank you for your the continued support and the time you put in to make the project better for everyone.

* [yordis](https://github.com/yordis) helped us bring the typescript repo for our next gen login UI significantly forwards
* Never forget to activate your email service provider with this change from [doncicuto](https://github.com/doncicuto)
* Also by [doncicuto](https://github.com/doncicuto) comes a solution to a  community request, adding customization options to console navigation buttons
* [sujoysb](https://github.com/sujoysb) improved the error messages and user feedback for password complexity validations
* [calRobert](https://github.com/CalRobert), [jayPe69](https://github.com/jayPe69), [aurel004](https://github.com/aurel004), [burahimu](https://github.com/burahimu) all helped with our translations, and typos (is our French that bad? Apologies.)
* [cr1cr1](https://github.com/cr1cr1), [exeteres](https://github.com/exeteres), [kleberbaum](https://github.com/kleberbaum) contributed various improvement to our Charts
* Sign tokens FAPI-compliant with ES256 and PS256 thanks to [nannany](https://github.com/nannany)
* [ymarcus93](https://github.com/ymarcus93) increased compatibility with certain identity providers and fixed some issues around the library

## Additional resources

* [Passkeys: A Shattered Dream](https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shattered-dream/)
* [The SaaS Trends Report | Q1 2024 | Vendr](https://www.vendr.com/insights/saas-trends-report-q1-2024#top-categories-renewed) - Cybersecurity at the top
* [Navigating Session Logouts, Timeouts, and Token Expiry](https://zitadel.com/blog/session-timeouts-logouts)
* [Google Online Security Blog: On Fire Drills and Phishing Tests](https://security.googleblog.com/2024/05/on-fire-drills-and-phishing-tests.html)

New Success Story: [Achieving 70% Faster B2B Integration in Document Automation at BLP Digital](https://zitadel.com/blog/success-story-blp)

Thanks for reading, \
Max


Updates on ZITADEL, and tips and tricks to simplify your identity infrastructure for May 2024. In this episode we highlight improvements to SAML IdPs, managing resources programmatically, and scaling to millions of identities.

Product Newsletter May 2024


This is Max from ZITADEL. As always, I would like to highlight some of our product updates, and tips and tricks in making your identity infrastructure easier and more effective.

Summarizing the April product updates for ZITADEL is a difficult task. While we continue to work on the big roadmap items, the team worked diligently to address improvements ranging from new security features to performance enhancements to secure millions of identities. We shipped over 76 features, improvements, and bug fixes to our products. For those keeping score, that is nearly 400 year to date.

### Feature highlights

Let me share some of the more noteworthy features that were shipped during the month of April.

#### Setup your email provider - easier than ever

A generous contribution from our open source community, simplifies the configuration of email delivery within ZITADEL by introducing SMTP provider templates. These templates offer pre-defined settings for popular email service providers (ESPs) like Amazon SES, Mailgun, Mailjet, Postmark, Sendgrid, and a Generic SMTP option.

By the way, we strongly recommend replacing the pre-configured SMTP service in ZITADEL Cloud. The default provider is for demonstration purposes only and will not provide a reliable way to send emails to your users.

![SMTP provider settings in ZITADEL Console](/blog/2024-05-07-zitadel-product-newsletter-april-2024-01.png)

#### Link accounts with external identity providers

There are situations where your users might have created an account in your application and only later on want to connect their social login or external identity provider.

As of now an error might have been shown to the user, since the IdP link was not known before, but the automatic federation / creation failed, because the information (e.g. username) already existed in ZITADEL.

With a newly introduced functionality, users can connect their account with an account provided by an external identity provider. Administrators can configure how accounts should be matched against usernames or email addresses. 

#### Experimental features

Over the past weeks we introduced feature flags into the core of ZITADEL. Feature flags allow administrators to opt-in or opt-out of experimental features that are not intended to be generally available. In April we finished the work by shipping the new feature settings into the Console. 

Our intention with feature settings is to provide means to access and test early features for users to test and provide feedback. Among the currently available functionalities are several performance improvements, OpenID Connect Token Exchange, a preview of User Schemas, and a preview of a more powerful Actions feature. Some settings allow you to roll-back some improvements that would result in issues to few users.

![Feature settings in ZITADEL Console](/blog/2024-05-07-zitadel-product-newsletter-april-2024-02.png)

#### Limit one-time password attempts

Similar to the existing lockout functionality for password attempts, Managers are able to configure automatic lockouts after a specified number of consecutive failed Time-based One-Time Password (TOTP) checks. The new feature strengthens security posture by mitigating brute-force attacks targeting (T)OTP verification.

Lockouts are applied independently for each TOTP method. This ensures users retain the ability to attempt alternative verification methods (e.g., email OTP) even after exceeding the threshold for a specific TOTP method (e.g., mobile app).

[View all changes on our new changelog](https://zitadel.com/changelog)

### ZITADEL Cloud for scale and simplicity: focus on what matters most

We have no plans of moving to a cloud only service. Let me state that right at the start. There are many reasons and use cases to go for an enterprise grade identity management solution that runs on your private infrastructure, ranging from compliance requirements and risk reduction to special cases such as embedded systems.

In a self-hosted setup you will not only be responsible for managing the infrastructure layer, but also the operational security aspects of the deployment. When using cloud you don’t have to worry about DDoS attacks, WAF configuration, or bot detection during login and register. These are all covered by our systems, have a look at our shared [responsibility matrix](https://zitadel.com/docs/legal/service-description/cloud-service-description#responsibilities) to learn more.

The Pro plan now includes 25’000 daily active users per month. The cost for additional daily active users was also reduced to offer you better scale. We will streamline our subscriptions and update all existing plans that use authenticated requests to an up-to-date plan. No action is required on your end, the changes will be applied automatically on July 1st.

### What we’re working on

#### Feedback wanted on Token Exchange

We are very happy to announce that OAuth 2.0 Token Exchange according to RFC 8693 landed in ZITADEL. This grant will lay the foundation for more advanced integration scenarios, including impersonation of users, token validation and exchange with third-party identity providers, and exchange of session tokens and OAuth tokens.

To get started, follow our integration guide on [Impersonation and delegation using Token Exchange](https://zitadel.com/docs/guides/integrate/token-exchange) and make sure to [enable the feature](https://zitadel.com/docs/guides/manage/console/default-settings#features) in the newly introduced feature settings.

We would very much like to get your feedback on the implementation and learn more about your use cases. Join the discussion on our Github repository.

[Github Discussions](https://github.com/zitadel/zitadel/discussions)

#### A new login UI in typescript for you to make your own

Already today you can use our [hosted login UI](https://zitadel.com/docs/guides/integrate/login/login-users) for the highest security standards. For a couple of months you are also able to use the Session API to [build your own login interface](https://zitadel.com/docs/guides/integrate/login-ui) and user flows.

We are currently working on a next generation of our login page, written in Typescript, that will replace our existing hosted login UI. The goal is to implement a login UI, using the session API of ZITADEL, which also implements the OIDC Standard and is ready to use for everyone.

In the first phase we want to have a MVP login ready with the OIDC Standard and a basic feature set. In a second step the features will be extended. 

As always, we value your early feedback, ideas, and contributions to the next generation of our - and hopefully your - login experience.

[To the Typescript Repo](https://github.com/zitadel/typescript)

### Better together

Our community members contributed 23 improvements and features to ZITADEL repositories. I want to thank you for your continued support and the time you put in to make the project better for everyone.

* The feature SMTP templates for the most popular email service providers was contributed by [doncicuto](https://github.com/doncicuto). Not only a great feature, but also a lot of testing involved - a special thanks for that contribution
* [aDogCalledSpot](https://github.com/aDogCalledSpot) added the option to use locally generated RSA keys for service users, avoiding keys being sent over the network instead
* [Doncicuto](https://github.com/doncicuto) contributed also to multiple parts of the console to fix reported issues, improving the overall usability of the UI and APIs
* [Compatibility](https://github.com/zitadel/oidc/issues/565) of oidc client device authorization grant with Google by [celian-garcia](https://github.com/celian-garcia)  and ability to verify ID tokens based on available sign algorithms from the discovery endpoint by [otakakot](https://github.com/otakakot)
* [vigneshsankariyer1234567890](https://github.com/vigneshsankariyer1234567890) improved UX where users switching between register and login got lost
* [celian-garcia](https://github.com/celian-garcia) , [jkroepke](https://github.com/jkroepke), and [otakakot](https://github.com/otakakot) improved error handling in our oidc library
* [yordis](https://github.com/yordis), [zoltantemesvari](https://github.com/zoltantemesvari), [ahmednfwela](https://github.com/ahmednfwela), and  [HaimKortovich](https://github.com/HaimKortovich) helped us to improve and keep our SDKs up-to-date
* Charts repository dependencies by [rud](https://github.com/rud) and improved configuration of ports [ameijboom](https://github.com/ameijboom) 
* Typos and corrections to docs [EthanHeilman](https://github.com/EthanHeilman),  [alexrimlin](https://github.com/alexrimlin), and [thamow](https://github.com/thamow)

Thinking of contributing? Grab a ‘good first issue’ or start a discussion and get started with our [contribution guide](https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md).

### Additional resources

* [‘Worth exploring’ - Thoughtworks technology radar](https://www.thoughtworks.com/radar/platforms/zitadel)
* Video: [Complete Guide to Identity Federation and Brokering Using ZITADEL](https://www.youtube.com/watch?v=wg-ee-EnHdE)
* [Built with ZITADEL: 23 Technologies' Kubernetes-as-a-Service](https://zitadel.com/blog/success-story-23-technologies) 
* [Test Token Introspection in ZITADEL with Postman](https://zitadel.com/blog/testing-token-introspection-with-postman)

Thanks for reading,

Max


Updates on ZITADEL, and tips and tricks in making your identity infrastructure easier and more effective for April 2024. In this episode we write about SMTP provider templates, limit attacks on OTP, and account linking. We also share what we are currently working on.

Product Newsletter April 2024


This is Max from ZITADEL. In this newsletter, I would like to highlight some of our product updates, and tips and tricks in making your identity infrastructure easier and more effective.
This is the March 2024 edition of our newsletter.

### Feature highlights

In March, the team shipped over 110 improvements and features to ZITADEL, including many bug fixes and stability improvements. We also delivered critical security patches for issues that were reported by the community and customers. Most of the new feature development in March contributes to our roadmap items and improves the user experience.

#### Easier integration with your frameworks

Simply set up a client application in your framework and programming language. You can choose your framework in the Console, and we take care of the default settings for you so you can get started even faster.

Of course, you can still integrate with any other framework or language.

![ZITADEL Console showing app creation screen with various programming languages and frameworks](/blog/2024-04-05-zitadel-product-newsletter-march-2024-01.png)

#### Better descriptions and tooltips

While you can use the APIs to configure ZITADEL, many users rely on the Console as a user interface to configure their system. Descriptions, tooltips, and labels of both the default settings and the organization settings pages were adapted for clarity and to provide more information to users.

The latest stable version is 2.43.11. You can find the [version of our stable release](https://zitadel.com/docs/support/software-release-cycles-support#stable) information in our documentation. Some features are only available in the latest versions.

### New docs resources

This month, we worked on several documentation resources to help developers use and integrate ZITADEL more effectively. 

* [How to handle session validation when building your own login UI](https://zitadel.com/docs/guides/integrate/login-ui/session-validation)
* [Using OKTA SAML IdP for single-sign-on](https://zitadel.com/docs/guides/integrate/identity-providers/okta-saml)
* [Using Entra ID SAML IdP for single-sign-on](https://zitadel.com/docs/guides/integrate/identity-providers/azure-ad-saml)
* [Code example for ZITADEL actions](https://zitadel.com/docs/apis/actions/code-examples)
* [Guide on how to login users with SSO in ZITADEL](https://zitadel.com/docs/guides/integrate/identity-providers/introduction)
* Reworked [service user authentication](https://zitadel.com/docs/guides/integrate/service-users/authenticate-service-users) and guides on [how to access ZITADEL APIs](https://zitadel.com/docs/guides/integrate/zitadel-apis/access-zitadel-apis)
* [Streaming audit logs to external systems such as SIEM/SOC](https://docs-git-external-idp-intro-zitadel.vercel.app/docs/guides/integrate/external-audit-log)

[Check out all our guides](https://zitadel.com/docs/guides/overview)

### Technical & security advisories

Technical advisories (“TA”) are notices about major issues with ZITADEL Self-Hosted or the ZITADEL Cloud platform that could potentially impact security or stability in production environments.   For example, we issue technical advisories if breaking behavior was introduced in a release or if you must expect downtime during an upgrade.

[Review and subscribe to our technical advisories](https://zitadel.com/docs/support/technical_advisory)

Security advisories are notices about security vulnerabilities that affect ZITADEL. While we patch ZITADEL Cloud automatically, these advisories are critical for self-hosted deployments. Make sure to subscribe to “Security alerts” on our GitHub repository, by clicking on “Unwatch”, then “Custom” and selecting “Security alerts”.

[Review past security advisories](https://github.com/zitadel/zitadel/security)

Both technical and security advisories contain the details about the issue, affected versions, and how to resolve the issue.

### What we’re working on

Behind the scenes, the team is continuously  developing and refining the next major feature and improvement.

We needed to make delivery of alpha (experimental) and beta features safer and easier for users. With the recent releases in March, we introduced feature flags via a [feature API](https://zitadel.com/docs/apis/resources/feature_service), allowing users to enable features that are not yet intended for general availability for testing purposes.

In March, we made significant progress on these features. Make sure to subscribe to the underlying GitHub issue to receive regular updates.

* [Impersonation](https://github.com/zitadel/zitadel/issues/7208) enables a functionality to impersonate users to act on behalf of other users. Our efforts in March focused on security settings, Manager roles, and token exchange. We expect to release a preview of the feature in the coming weeks.
* [User Schema](https://github.com/zitadel/zitadel/issues/6433): Implementation for user schemas has started with the first APIs becoming available. This feature is still experimental and behind a feature flag.

[Roadmap](https://zitadel.com/roadmap)

### Community building: Contributions and feedback

Token exchange (RFC8693) is a permissive standard that we will implement to facilitate use cases, such as the impersonation of users. We hope to gather some feedback on our implementation from our community.

Give your [feedback on Token Exchange and impersonation](https://github.com/zitadel/zitadel/discussions/7624).

In March, our community contributed to ZITADEL and our libraries again. Thank you for your continuous support!

* [ay4toh5](https://github.com/ay4toh5i) implemented the OpenID Connect  form_post response mode, increasing interoperability with client applications of our zitadel/oidc library and in the further development of ZITADEL itself.
* [doncicuto](https://github.com/doncicuto) added expiration date information for service users’ keys. Keys expire at midnight (UTC), and that information was previously not displayed to users.
* [vigneshsankariyer1234567890](https://github.com/vigneshsankariyer1234567890) realized we were misaligned with our login button in the email verification and fixed it, while [github-tijlxyz](https://github.com/github-tijlxyz) corrected a mistake in our keycloak migration guide
* [bjw-s](https://github.com/bjw-s) and [pisarz](https://github.com/pisarz) improved our charts allowing additional pod labels and introducing parametrization to probe schemes
* [PaulHiryliuk](https://github.com/PaulHiryliuk) and [petrmifek](https://github.com/petrmifek) helped by reviewing and improving  Czech and Russian translations

We are really grateful to receive all the big and small contributions and the countless feedback and improvement ideas. In case you want to contribute, start with our [contribution guide](https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md).

### Additional resources

* [On our blog: Test your web app login flow with Postman](https://zitadel.com/blog/testing-login-with-postman)
* [ROSS Index: ZITADEL as one of the top trending open-source startups in 2023](https://runacap.com/ross-index/annual-2023/)
* [Transforming Identity and Access Management with Event Sourcing](https://thenewstack.io/transforming-identity-and-access-management-with-event-sourcing/)
* [ZITADEL as Identity Provider for NetBird](https://docs.netbird.io/selfhosted/identity-providers)
* [Load testing ZITADEL using K6](https://medium.com/@harsha_reddy/load-testing-zitadel-using-k6-a68328c89b33)


Updates on ZITADEL, and tips and tricks in making your identity infrastructure easier and more effective for March 2024. This edition includes improvements to the console, new docs resources, and things we are working on right now.

All posts/ #zitadel_cloud