Delegated access management

Hosted Login

Multifactor Authentication

Passwordless Authentication

Audit Trail

Identity Brokering

Platform

Service Accounts

Features

Easy integration

B2B (Business to Business)

Self Service

Existing identities

Secure authentication

Use Cases

Learn how to install, setup, and use ZITADEL.

Documentation

ZITADEL Cloud

Self-hosting

Trust center

Examples and Guides

Github Repository

Develop

Get Started

Contribute

Roadmap

Changelog

About Us

Jobs

Contact

Company

Read the blog

Sign up

Login

Pricing

Blog

## Introducing an OIDC Playground by Zitadel: The Fastest Way for Developers to Master Authentication

Let’s face it: authentication is rarely the part of your stack that gets developers excited. OIDC flows can feel like a black box, and when something breaks, you’re left deciphering cryptic errors, scouring docs, or waiting for support. That’s wasted engineering time and momentum.

At Zitadel, we’re obsessed with building for developers and platform engineers. That’s why we created the [OIDC Playground](https://zitadel.com/playgrounds/oidc), a hands-on, interactive tool that lets you experiment with OpenID Connect authentication requests, see how Zitadel responds, and iterate in real time. Whether you’re integrating, debugging, or just curious, this is your fast lane to understanding and control.

## What is Zitadel?

Zitadel is an open-source identity and access management (IAM) platform built for modern, cloud-native applications. We help you ship authentication and authorization quickly, securely, and at scale without having to build or maintain complex identity infrastructure. ZITADEL delivers enterprise-grade security, true multi-tenancy, flexible deployment, and a developer-first experience.

## Why Zitadel?

Enterprises choose Zitadel as their IAM solution for several key reasons:

-   Eliminate expensive infrastructure development:  Go self-hosted or cloud, and skip months of building and maintaining IAM.
-   Built-in enterprise security features: From Passekys, to one-time passwords to Single Sign-on, we've got you covered.
-   Ready-made compliance controls:  Ready-made controls help you meet regulatory requirements.
-   Professional support and maintenance: You get professional help and upkeep.
-   More flexible and a transparent pricing model:  No surprises, no opaque “enterprise” gates.
-   Open-source transparency:  Inspect, contribute, or extend no black boxes.
-   Solid multi-tenancy support: It handles millions of tenants at scale.
-   Developer-friendly:  Integrate in days, not weeks, with modern APIs and docs.
-   Modern, API-first architecture: Provides a modern, API-first approach.
    

## What is OIDC?

[OpenID Connect](https://openid.net/developers/specs/) (OIDC) is the industry standard for authentication, sitting on top of OAuth 2. It lets your apps verify users’ identities and get profile information via secure, standardized tokens (JWTs). OIDC is enabled when a client includes the `openid` scope in an authorization request. The result? Your app receives an ID Token, a JWT containing “claims” about the user (like name, email, or custom attributes).

## What is the OIDC Playground from Zitadel?

An OIDC (OpenID Connect) playground is useful for developers, security engineers, and testers to experiment and debug OIDC flows in a controlled environment. The playground can be helpful in many different ways:

#### Learning and Experimentation

-   Understand how OIDC works by crafting an authentication request.
-   An OIDC authentication request is a standardized way for a relying party (an application or website) to request a user's identity information from an OpenID provider.
    

#### Debugging and Development

-   Easily modify parameters like client_id, scope, redirect_uri, response_type, etc., to observe how different parameters change the behavior
-   Useful for debugging issues like:
	-   Invalid redirect URIs
	-   Token decoding problems    
	-  	Scopes not returned as expected
    
## Pre-Requisites

-   A [self-hosted](https://zitadel.com/docs/self-hosting/deploy/overview) or [cloud](https://zitadel.com/signin) instance of Zitadel.
-   Create a new [Project](https://zitadel.com/docs/guides/manage/console/projects) and create a new [User.](https://zitadel.com/docs/guides/manage/user/reg-create-user)
-   Create a client.
-   Take a note of the issuer URL, which can be obtained by logging into your Zitadel instance.
-   Click Projects > Select the respective project > Select the respective application > Click URLs
    

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXdhV734K4DL9ckcOlx-U25xXpWTrOS7WuT-FnTqI5P9Xj5x36fXF0iPrDd7vybYLHhenwXUzeMrOLQfMh2jieI4w1gFkIwvknsUm_EbyieUujmAr8WM_J1bluWrH6_P3FbUfwxLmg?key=bgcsq8E2ip6wVk3nVSJgBA)

-   Web App (Optional)- We are using the OIDC debugger in this tutorial    
-   To enable users to register with a local account (username/password), you need to enable the "register allowed" setting in the login behavior settings within ZITADEL.
-   When enabled, a registration button will appear on the login page, allowing users to create new accounts. You can specify the organization users are registered to during the registration process by including the organization scope in the authorization request.
    

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXeV3Vr_efJwLQgLk1R1Atp83-AOH7NRtAGdNmvpSCMqmdsgw0R3Qn3ymhEmyl3NOAxEY0dLt90BQERdlcuz-Pj9vkFjc4qE-fYdlINSqBear_lnLiw5KA_gWiRdYYQBL64DVcEkGw?key=bgcsq8E2ip6wVk3nVSJgBA)

## How can you get started with the OIDC playground from Zitadel?

This playground will help you craft an authentication request initially and explore the behavior of Zitadel in more depth.

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXe_qtGjVMPdJGUX0r6U9PfpA-1mYWUcc5nmc70Z16RQMgul5IwvAUc4xmWIm5SsCNSuJBhnOOV14tCVWaX8mLMRiVADUBok81Te3suGh1HEtBf-6Sw0lpMH36-4pu5r9MUSBcmkHg?key=bgcsq8E2ip6wVk3nVSJgBA)

### Required Parameters

-   Your Domain- The Instance Domain for your Zitadel instance.
-   Example: [https://test1-zitadel-tuyhqf.us1.zitadel.cloud](https://test1-zitadel-tuyhqf.us1.zitadel.cloud)
-   Client ID is the unique identifier assigned to a client application of an application. It's the application where you want your users to log in. You can find the client ID in the Console. Click> Project> Choose your respective project where the application has been created> Click on the Application > Click Configuration
    

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXcsEc7lv5ssX6JrOp4t4o8K5PfI7CtNiT51j91LYJoKCWkRjB-0mxSag6xU_Saj3TbzHFck4ZSeb0s9jlUK0Assfa50azZ93uNgYQYg-SRzXkG7NlkLMjwtEDlm-TlmSUQe7k1R?key=bgcsq8E2ip6wVk3nVSJgBA)
-   Redirect URI is one of the pre-configured redirect URIs for your application.    
-   Example- [http://localhost:3000/callback](http://localhost:3000/callback)
-   Response Type defines whether a code, id_token token or just id_token will be returned. Most use cases will need code. This tells the authorization server which grant to execute. When you choose code, you will use the Authorization Code grant (recommended).
    

### Authentication methods

-   Depending on the authentication and authorization flow of your application, you might need to append some information to the authentication request.
-   Authentication method "(none) PKCE" is recommended for most application types. The playground automatically appends a code challenge for PKCE flows.

### Additional Parameters

Prompt defines if and how the user should be prompted on login. For example:

-   login: requires the user to re-authenticate.

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXdCZRyrhfKtDmnPxtbA32k4WdnhqQKFVVMXitM8c0Yi5MobPNQEf1wZ3BfNopM81sm1o2-j0cQLL8_RcG9eK6ZJckuI2M3vTwhAPA3xakzPGKql4l92nAJZuguMyyUhZXcfj60s0w?key=bgcsq8E2ip6wVk3nVSJgBA)

-   none: user must be authenticated without interaction, an error is returned otherwise; use for silent-refresh.

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXfxa95i2sLLSEwG3jo9yZ87kVib2pzjrCUsvDR98JicKTYLs5iT0R1mkKNOmeWXKBglBjApUwjdljnuIAArcY_tIWOM5ViZ_FN_13qPRYb5QyDIOy3kB9gqG5q_kapmiNDsANYj?key=bgcsq8E2ip6wVk3nVSJgBA)

-   create: present the registration form.

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXc45ZwhvspV3RQR6kBw6Xz0t4ZOjWYxxdNx0qNcVK706bTk2652ugrCkD7hbtfFAHp6_ow1bm6lGnfCEOzj0Tvake5oSyJH0jibDbwgDUIpgQlcUHG2J6oYbGQiGU5aR1km12U6?key=bgcsq8E2ip6wVk3nVSJgBA)

-   The user would be prompted to register.

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXeJA9qh-d1lOVVkYXKC0FNnq9IbiudTAJ2hG6iaSMBW-E4yKJ-5OSzYcNh_Ads232F0aT1S1JtMPQ2WVyh60KsIA1BVLS6GNE1oNZyqtBBfdAlHAD7ZuoCrU3XoU-dqt3kBrZM9Xw?key=bgcsq8E2ip6wVk3nVSJgBA)

-   select_account: The user is prompted to select one of the existing sessions or create a new one.
-   Using the login hint- The Login hint must be a valid logon name of a user. You can skip the account picker by providing the Login hint.

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXcQQQnfItiygoETRxHjpSQNnb4sYW8Yy7Xk1YxpS_9Szpwy_D_qAnDgGGF6pdPJXzYR-KXSxwSdnJhmafLd4frF5Pmz_am5Lj_V0Ov5ultILOPt0nzdM57-MAxXebnHv-rOhECe3g?key=bgcsq8E2ip6wVk3nVSJgBA)

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXf1FyQMwAlXAhSoxvLtZcwiep6xXjs3obrJmPJgvjYKeo0o0LYzzjNlcPYH9AnJ7Tyiz2Wv1UM4pBcjzYi8xToknEQ_ujDpEc6HU4r-KMrEswU9KwUTY51RT3mkKW10j48Iqnd5bQ?key=bgcsq8E2ip6wVk3nVSJgBA)

-   Without using the login hint- The user is prompted to select the respective user.
   
![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXct1CUvLP2aLtolMAftm2ExJWRdRTVI7UTFCusnX1PomxgmVXrNfWdbEDdznQWY7MXbDSd_hBBGTIZHk51Db_CYOQEw6Tdw-aDQiWpFPI4Kkn9YlJD-Uk2btsMn36rT1fJDcGp0Ag?key=bgcsq8E2ip6wVk3nVSJgBA)

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXc1C63ZZRAeTYMG78nYvA5ajzgNFPYGX_9o_CNsmqNc9RwlwEs5gBRpGl5-oq6UBy53NYjHTMO9DQ48guZXOpIzzozKPEvNPFNp48Jy4lffaSodsU7hLkeSvng_H2zXaezUikjr?key=bgcsq8E2ip6wVk3nVSJgBA)

## Conclusion

Hopefully, this tutorial gave you a good overview of how you can use the OIDC playground for testing OpenID Authentication Requests and can customize Zitadel behavior with different parameters based on your organization's needs. We encourage you to [explore Zitadel](https://zitadel.com/signin) on the cloud or self-hosted environment(s). If you want to learn more before starting, request a demo today. Click the [button](https://zitadel.com/discoverycall)to get in touch!

If you’re building in the Bay Area, or anywhere developers value speed, clarity, and control, the Zitadel OIDC Playground is your shortcut to robust, modern authentication without the guesswork.

## How can I try out and contribute to Zitadel?

Read our [documentation](https://zitadel.com/docs) and learn how you can set up, customise, and integrate authentication and authorisation into your project. We would love to see you being a part of the Zitadel community, and you can reach us at

-   [Discord](https://discord.com/invite/zitadel)
    
-   [Github](https://github.com/zitadel/zitadel/)
    

## Suggested reading

-   [Zitadel Getting Started](https://zitadel.com/docs/guides/start/quickstart)
    
-   [OIDC and Zitadel](https://zitadel.com/blog/secure-logins-with-zitadel-part-1)
    
-   [Securing Applications with OIDC and Zitadel](https://zitadel.com/blog/secure-logins-with-zitadel-part-2)

At Zitadel, we’re obsessed with building for developers and platform engineers. That’s why we created the OIDC Playground, a hands-on, interactive tool that lets you experiment with OpenID Connect authentication requests, see how Zitadel responds, and iterate in real time. Whether you’re integrating, debugging, or just curious, this is your fast lane to understanding and control.

Introducing an OIDC Playground by Zitadel: The Fastest Way for Developers to Master Authentication

Twice a year, we block our calendars, say goodbye to the familiar lag of Google Meet, and trade our home offices for the buzz of in-person conversations, shared meals, and the kind of spontaneous laughter you just can't schedule. These retreats are more than just a change of scenery and pace - they are how we stay connected. Through moments that spark important conversations, ideation over gentle rain and warm kebabs, or much needed pauses during late-night board games, we reconnect not just as coworkers, but collaborators united by a shared vision. 

In alignment with the fresh energy that spring brings, we experienced our own season (buh-dum-tss) of growth. Since our last retreat in Zurich, Switzerland, the Zitadel team  has nearly doubled , welcoming a vibrant mix of fresh faces across Sales, Support, Data Engineering, Marketing, and other functions  - expanding the talented team that drives us forward. 

Nestled between a lake and mountains in Switzerland, Thun gave us the perfect backdrop for this retreat: misty weather, glistening water, and just the perfect amount of old-town charm to settle in, slow down, and welcome our newest members. 
## Arrivals
![image title](https://cdn.sanity.io/images/y3uu7rkl/production/e55f3b611eb4a375f96472f9cd5ff5066fe13a74-4032x3024.jpg)

As the team found their way to the beautiful city of Thun through the surrounding snow capped mountain range, much of the crew settled in from 20+ hours of travel adventure having traversed a wide variety of trains and airports. The laughter and camaraderie filled the air of the hotel lobby as the “long timers” welcomed “newbies” to the Zitadel crew. 

White table cloths and delicious local cuisine lined the restaurant tables as discussions unfolded from the team around what they hoped to get out of the offsite and excitement on topic discussions ahead that were sure to make a positive impact ahead. Smiles filled the room as the vision alignment connected effortlessly across the room and secured the fact that this was going to be a productive trip!
## Activities and Exploration 
![image title](https://cdn.sanity.io/images/y3uu7rkl/production/504b9a1fa31d273a2c00aad55c7e19fbbd287bc2-4032x2268.jpg)

Over the next several days, the team participated in planned and ad hoc discussions on topics including how to deliver value through our content strategy, tooling deep dives, empowering our developer community, and elevating our user onboarding experience.

Key takeaways are:
* **Enhancing Onboarding experience**: With the recent additions of the initial account setup checklist for new account creations, it is important to continue improving onboarding with Zitadel!
* **Elevating Zitadel’s Content**: Our community's feedback on which content delivers the most practical value drives our commitment to creating content that matters. We are strengthening our blog articles and documentation by prioritizing high-impact topics such initial setup, feature use cases, and competitor platform migrations to address the real-world challenges technical teams face in their IAM implementations.
* **Internal Tools and Team Efficiency**: With team expansion in mind, discussions centered on how strategic use of tools like GitHub and Asana can proactively address communication challenges that emerge at scale. The focus was on implementing robust processes and workflows now that will reduce communication friction and maintain team efficiency as headcount increases.   
![image title](https://cdn.sanity.io/images/y3uu7rkl/production/8cd38eb26f4fcfd27ac0719fa327b03027bc5e67-3024x4032.jpg)
When we stepped away from the meeting room we had a chance to bond as a team at a few different special locations. The St. Beatus Höhlen  cave tour showcased a stunning cave’s inner workings that is millions of years old. The Rubigencenter offered fun and games for some team competitions. Finally the walk through the Aare Gorge (Aareschlucht) set the stage for the perfect backdrop for an updated team photo as Zitadel nears 25 employees from access the globe. 
![image title](https://cdn.sanity.io/images/y3uu7rkl/production/137220f4f5f4201ef363ac15afc982dc7529f6b2-2048x1365.jpg)
## Wrapping Up 
Every retreat leaves us more connected, aligned, and certainly more inspired! We returned home energized (after recovering from the jet-lag, of course!), full of fresh ideas, shared memories, and the kind of momentum that only comes from in-person connection. We are not only committed to building a great product, but a company we are proud to be part of - and this retreat reinforced just how far we've come, and how much possibility lies ahead as we keep growing together.

💜 **Here are quotes from some of our newest team members about their retreat experience:** 

![image_title](https://cdn.sanity.io/images/y3uu7rkl/production/aff121838a620b1d4bbab21dcf79a4876d1cd831-4032x3024.jpg)
“What an amazing week! I feel truly privileged to have finally met my teammates in person and to experience the beauty of Switzerland together—it was one of the best bonding experiences I’ve had. I had meaningful conversations, lots of fun, and walked away feeling truly part of something great.” 
- **Matías Racedo, Sales Engineer** 

![image title](https://cdn.sanity.io/images/y3uu7rkl/production/505bdcbc55ccf35b76577b6ccad59080c1fbbcb3-3072x4080.jpg)

“The Zitadel team retreat in Thun was an amazing experience, both professionally and personally. I really enjoyed getting to know the team — all the insightful and fun conversations had a very positive impact on me. Having joined the company less than two months ago, it felt great to meet everyone and see firsthand the culture that drives the team. It's inspiring to be surrounded by so many smart people. I’m genuinely excited to start contributing and help take Zitadel to new heights!”
- **Federico Coppede, Sales Engineer**

![image title](https://cdn.sanity.io/images/y3uu7rkl/production/49df071b34177410f79c4cc2f66466bc1bdffa47-4032x2268.jpg)
"The retreat in Thun is something that I'll remember for the rest of my life. As a new joiner, being with a new team in a foreign place, I'll admit I may have been a tad nervous. But I quickly realized that this was all for not. Though I met many people for the first time, it felt like I was talking to old friends that I've known for years and every day I got to experience different personalities and different conversations. I feel very fortunate to be working with such an intelligent, talented group of genuinely good people. I learned a lot from the workshops and it didn't hurt that we were surrounded by crystal clear waters and beautiful mountains. I got back feeling recharged and I'm chomping at the bit to work with this team to take Zitadel to new heights! 5 stars-would highly recommend :)"
- **Joshua Chae,  Account Executive**

![image title](https://cdn.sanity.io/images/y3uu7rkl/production/ac77971915306fbc54296f2fe68001da9f655e42-4032x2268.jpg)
“The team retreat in Thun has been a fantastic event on so many levels. I had the chance to meet the team for the first time and connect with everyone. It was my first time seriously visiting Switzerland, despite not living that far from it. It was such a great discovery, such a beautiful place with its mountains and lakes. The scheduled workshops we had were also very insightful and they helped me to know the company better, how it operates in the OSS world and its objectives for the future. It has also been a moment for rediscovering Magic The Gathering, one of my hobbies, with my coworkers: the draft game we had was amazing and it was so exciting to teach others how to play!”
- **Marco Ardizzone, Backend Engineer**

![image title](https://cdn.sanity.io/images/y3uu7rkl/production/14c82bc8eb8ef2bbade1157aaf99fc12d3484bc3-3072x4080.jpg)
“Joining a remote team can be a puzzle, but this retreat instantly clicked everything into place. It was wonderful to finally put faces to names and feel like I'm part of a genuinely fun and supportive family right from the start.”
- **Mridang Agarwalla, Product Engineer (SDKs)**

Discover how the recent annual company retreat in Thun, Switzerland set the backdrop for Zitadel’s 2025 second half priorities and strategies.

Mountains, Milestones, and Magic - Company Retreat V5


As an open source organization with strong community roots, we want to ensure that the care, intention, and nurturing that we pour into our product is also reflected within our team. Back in May of 2023, we held our first retreat, taking initial steps towards becoming a fully remote, global company. Fast forward to November 2024, we’ve grown from a small unit to a team of almost 20 fully distributed professionals across the globe. Along the way, we’ve made meaningful strides towards curating a strong sense of belonging while cultivating our remote work culture. Our efforts really come to life at our biannual off-sites where we’re all able to reconnect in person. Off-sites are one of many ongoing cultural rituals that allow us to work on the four Cs:  Collaboration, communication, connection, and . . . carbs **(yes, seriously —  stay with me, more on this in a second)**. 
 
## Pre-Arrival

Three days before everyone was set to fly out, we found ourselves needing to make a 1000+ kilometer change to our plans (we originally planned to go to Valencia, Spain). With time against us, we had to quickly rebook flights, shift the location of our activities and accommodations — all of this in less than 1 week. With some team members up to 8000 km away, this last-minute change really tested our ability to be communicative and adaptable. (In hindsight, this felt like an almost impossible task but we did it!)

Despite this being a logistical nightmare & having tight timelines, we were really able to come together as a team and push this through to success on such short notice. Adding on to a whirlwind of a week, illnesses, personal emergencies, and hurdles popped up that threatened to fully derail our upcoming trip. What could have been the end of our plans gave us an opportunity to show how far we’ve come as a remote-first team. We were operating like a well-oiled machine—leadership quickly went to work preparing a compact action plan, while team members supported each other with rebooking flights and figuring out how to navigate locally. From the warm, sunny coastlines we planned to visit to the cool, cozy vibes of Zurich -  the chaos gave us the opportunity to not only show resilience through challenging circumstances but also our ability to adapt and thrive together. 
 
## Arrivals

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-01.jpg" width="100%" alt="Nine Zitadel staff members smiling and posing at a bar near the Zurich opera house, with drinks on the table." />
</figure>

With our travel toils behind us, we began our journey to Zurich. For those already stationed in Switzerland, getting to Zurich wasn’t too much of a hassle. For others, it meant 20+ hours of travel - an experience best summarized as "amazing, spectacular, 10/10, would do again". Can you hear the sarcasm? The excitement to meet our co-workers in person surpassed the jet lag & weariness with all of us finally uniting in the evening. With early arrivals already at the hotel and others still on the way, a smaller group of us met near the opera house, where the view of the water at sunset provided a stunning backdrop for some great photos. We all quickly caught up (and met some new teammates!) before continuing on a short walk to the jazzy, goat-themed Widder Bar where the rest of team Zitadel joined us.  

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-02.jpg" width="100%" alt="Table at Raclette Stube with wine glasses, a fondue pot, and plates of vegetables, meat, raclette, and potatoes." />
</figure>

Light banter, warm introductions, and plenty of jokes set the tone for our evening as we made our way to Raclette Stube. We all ate to our heart's content - with some of us experiencing raclette for the first time and others opting for the very classic fondue. After the night's festivities, most of us felt like we turned into a ball of cheese.

That first evening together melted away the strain of those last minute changes, leaving us recharged & ready to dive head first into the rest of a very promising retreat.
 
## Activities & Exploration

After we settled in, our retreat really started on day 2 with a series of workshops led by some of our incredible internal subject matter experts.
Our new product marketing manager, Jim, opened up our sessions with an engaging discussion around our documentation and how it is crucial to your (yes, you, dear reader) Zitadel experience. Following Jim, our head of sales, Jason, broke down the sales process for our engineering team - delving into our processes, how we map customer needs while giving us a quick overview of negotiation tactics, and relationship building.

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-03.jpg" width="100%" alt="Zitadel staff in a meeting room, attentively watching Jason, the head of sales, present his workshop." />
</figure>

Next, Silvan and Max came in with well crafted & informative workshops focused on engineering. Silvan, through a hilarious presentation, provided much needed insights into Zitadel’s performance and detailed next steps on how we plan to improve it. Max gave a detailed overview of the new Typescript login, its implementation, and how it fits into creating an exceptional user experience. Our workshop series ended with our CEO, Florian, breaking down venture capital and offering a clear picture of where we currently are as a company [(check out our latest funding announcement!)](https://zitadel.com/blog/zitadel-the-future-of-identity-infrastructure)

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-04.jpg" width="100%" alt="Group hiking with those at the front smiling at the camera, while others straggle behind, surrounded by lush greenery." />
</figure>

With our workshops wrapped up, we took a casual stroll through Zurich that included us raiding Migros and Coop (a Swiss rite of passage). We tested our limits with an “intense” hike (spoiler: some of us fumbled on the beginner trail and felt winded at the end of it). The stunning views, adorable cows, and fresh air made every step of that hike worth it.

In the days that followed, we explored Lucerne where some of us shopped for souvenirs, crossed Kapellbrücke (with Florian providing important historical context), and wrapped up that day with a breathtaking ride up Pilatus. Of course, more souvenirs were added to our suitcases by the end of that Lucerne day trip.

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-05.jpg" width="100%" alt="Group exiting the Lindt chocolate factory with the factory sign partially visible in the background." />
</figure>

We can't forget to mention one of the most delicious parts of our trip: our visit to the Lindt chocolate factory. We experienced (and ate) a key piece of Swiss history, with some of it ending up in our jackets & bags at the end of the day. 
 
## Wrapping Up

This was a trip filled with fresh energy, joy, collaboration, and a reinforced sense of belonging. We all had the chance to strengthen our existing relationships (and build new ones!) - From celebrating promotions, to learning through in-depth internal workshops, and getting a thorough workout in Zurich - This trip was a memorable experience that left us all inspired and more than excited to continue growing. 

💜 **Here are some staff quotes from the trip:**  

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-06.jpg" width="100%" alt="Jim and Stefan sitting in the hotel lobby playing Magic: The Gathering, with cards spread across the table and drinks nearby." />
</figure>

"Our team retreat in Zurich was fantastic! It was refreshing to connect with everyone on a personal level. My highlight was those late-night Magic the Gathering sessions with Jim and Stefan – it had been 10 years since I'd played, and the competitive spirit with plenty of laughs was the perfect way to unwind and bond! Beyond the fun, it was inspiring to see how strong our company culture has become. As a remote company, these connections are crucial, and it's clear that even with the team nearly doubling in size, newcomers feel welcomed and supported. That creates such a positive and productive environment, no matter where we're working from. I can't wait for our next retreat!"
-**Florian Forster, CEO**

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-07.jpg" width="100%" alt="Lindt chocolate factory sign prominently displayed on the factory's exterior." />
</figure>

“It was great to show everyone our beautiful country and where the whole story of Zitadel started. I always love to explore something unique for the place we visit, and the Home of Chocolate was just amazing. Even if it was waaaay too much chocolate. :) Getting to know everyone in person is always my favorite part of the team retreat, and I am sure this makes a big difference for our daily remote work.”
-**Fabienne Bühler, CPO**

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-08.jpg" width="100%" alt="Zitadel staff in a meeting room, attentively watching Jim, the product marketing manager, present his workshop." />
</figure>

“It was a lovely offsite that hit all the points you hope for out of a team coming together, from long term strategy discussions to rapport building amongst the crew. It’s exciting to have a strong alignment closing out 2024 and going into 2025!”
-**Jim Morrison, Product Marketing Manager**

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-09.jpg" width="100%" alt="Team walking through Lucerne, passing buildings with signs for 'Pilatus', 'Victorinox', and 'La Fenice Steakhouse'." />
</figure>

“The Zurich retreat was an extraordinary experience, one that will forever be etched in my memory. To gather with colleagues from across the globe, to see familiar faces, and meet new ones, was truly inspiring. The days were filled with insightful discussions, thought-provoking presentations, and collaborative problem-solving. Yet, the moments outside of the formal agenda also truly resonated with me. The casual conversations, the shared laughter, the late-night card games with Magic the Gathering– these were the moments that forged deeper bonds and strengthened our team. The opportunity to explore the beauty of Switzerland was an added bonus. Whether it was a leisurely stroll through the city or a breathtaking hike in the mountains, each excursion offered a chance to unwind, recharge, and appreciate the simple joys of life. I’m incredibly grateful for the experience and can’t wait to reconnect with my colleagues at the next retreat.”
-**Stefan Benz, Software Engineer**

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-10.jpg" width="100%" alt="Small group of Zitadel engineers casually chatting near picnic-style seats at an outdoor restaurant." />
</figure>

"I cherished the in-person conversations and unforgettable moments with these amazing people. The presentations, even though they were in the morning, were a valuable source of knowledge about others' work, making this retreat a truly unique experience."
-**Silvan Reusser, Software Engineer**


Discover how our fourth team retreat in Zurich turned last-minute challenges into opportunities for collaboration, connection, and cultural exploration.

Hopp Schwiiz - Company retreat V4


In this newsletter, I want to share updates about our platform, and provide some tips on how you can simplify your identity infrastructure.

## Feature highlights

In June,  we shipped over 60 bug fixes, improvements, and new features. Most of those changes were released with ZITADEL [v2.55.0](https://github.com/zitadel/zitadel/releases/tag/v2.55.0), so make sure you are running the latest version.

### New password expiry feature

ZITADEL has introduced a new password age policy feature, enabling organizations to require users to change their passwords regularly. This feature can be easily managed through the Console UI at both instance and organization levels. Users will be prompted to change their password in the Login UI if their current password exceeds the defined age limit. This enhancement strengthens ZITADEL's password management capabilities and provides organizations with greater control over their password lifecycle.

![ZITADEL Console UI password expiry settings](2024-07-04-zitadel-product-newsletter-june-2024-01.png)

### Limit requested roles with new scope

A new scope was introduced to address the issue of excessive roles being returned in tokens (and as such increasing their size) for users belonging to multiple organizations. This new scope allows administrators and applications to specify which organizations' roles should be included in the token, thus streamlining access control for specific use cases. By using the new scope, either once or multiple times, only the roles of the specified organizations will be included in the token.  It's important to note that this feature is not compatible with legacy mode for Introspection or Userinfo endpoints.

[Reserved Scopes](https://zitadel.com/docs/apis/openidoauth/scopes#reserved-scopes)

### More performance improvements

ZITADEL's performance continues to improve as the team works to identify and eliminate bottlenecks. Notably, import operations for large quantities of project grants will witness a substantial enhancement. Furthermore, a significant improvement has been made to OpenID Connect / OAuth 2.0 session checks, effectively addressing recent observations identified during load testing.

### Sending test emails

The newly introduced feature has enhanced ZITADEL’s SMTP functionality by introducing a new testing step within the SMTP provider wizard. This allows administrators to verify their SMTP configuration before saving or updating it, preventing potential issues with email delivery. Additionally, the existing table of SMTP providers now includes a test option for existing configurations. This streamlined testing process ensures that email settings are correct from the outset, saving time and effort. This feature was contributed by the community - thank you for your efforts!

![ZITADEL Console UI sending test email during configuration of SMTP](2024-07-04-zitadel-product-newsletter-june-2024-02.png)

[Changelog](https://zitadel.com/changelog)

## ZITADEL achieves ISO 27001 certification, reinforcing commitment to security

<img src="/blog/2024-07-04-zitadel-product-newsletter-june-2024-03.png" width="25%" align="left" alt="" class="wrap"/>

In a significant milestone for ZITADEL's commitment to security and data protection, we have achieved ISO 27001 certification for our information security management system (ISMS). This internationally recognized standard validates our dedication to maintaining the highest levels of security for our customers' data.

To provide further transparency and information about our security practices, we have also updated our [Trust Center](https://trust.zitadel.com). This resource offers comprehensive details on our security posture, policies, and certifications.

[ZITADEL Achieves ISO 27001 Certification](https://zitadel.com/blog/zitadel-iso-27001-certified)

## 21 more reasons to celebrate: Community contributions in June

* Many Console UI improvements were contributed by [doncicuto](https://github.com/doncicuto) improving the user experience for administrators and users. Moreover [doncicuto](https://github.com/doncicuto) made it possible to send test mails for SMTP configurations and further improvements to mail providers.
* [JesperWe](https://github.com/JesperWe) made it possible for Swedish speakers to use their beautiful native language
* [Schettn](https://github.com/schettn) created a guide to integrate with the [Pylon](https://github.com/getcronit/pylon) framework

Many thanks to the contributors this month for their efforts, helping to improve documentation, tests, and fixing bugs in our code: [dkaminer](https://github.com/dkaminer), [panapol-p](https://github.com/panapol-p), [jvanderneutstulen](https://github.com/jvanderneutstulen), [danielmoisa](https://github.com/danielmoisa), [Loddan](https://github.com/Loddan), [Yxnt](https://github.com/Yxnt), [Cubox](https://github.com/Cubox), [danielloader](https://github.com/danielloader), [jfschubert](https://github.com/jfschubert)

Thinking of contributing? Grab a ‘good first issue’ or start a discussion. 

[Contributing guide](https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md)

## Additional resources

* [ZITADEL Bi-Weekly Office Hours](https://github.com/zitadel/zitadel/blob/main/MEETING_SCHEDULE.md)
* [Forza Italia: Retreat the third edition in Bologna](https://zitadel.com/blog/team-retreat-bologna)
* First time contribution (Japanese only): [OSS コントリビュートの実績を解除した](https://zenn.dev/otakakot/articles/dc58ff849e43e4)
* Integrate .NET (Polish only):  [Integracja Aplikacji .NET z Zitadel | bd90](https://bd90.pl/integracja-aplikacji-net-z-zitadel/)

ZITADEL introduced new features and enhancements, including a password expiry feature, a new scope to limit requested roles in tokens, SMTP configuration testing, and performance improvements. ZITADEL achieved ISO 27001 certification, demonstrating its commitment to security.

Product Newsletter June 2024


As a fully remote company, the time we spend together in person is precious.
This is why twice a year, our team gathers for an in person retreat, an opportunity to connect beyond the virtual world.
Last week, we met outside the beautiful city of Bologna for our first retreat of the year.
Since we really enjoyed it, we wanted to share a glimpse of  our week-long adventure.

## Travel Monday and Arrival in Bologna

After a full day of travel by plane or train excitement filled the air as we arrived in Bologna.
The last steps to our accommodation were harder than expected, the location with its view of its flowing hills and grape wines were worth it.
As everybody arrived later in the afternoon we rounded off the evening with pasta, as one would expect in Italy.
We even committed ourselves to cooking two fresh sauces, ragu and a verdure.  The whole team enjoyed the get-together and chatted until late that night over a drink.

<figure>
    <img src="/blog/2024-06-19-team-retreat-bologna-01.jpg" width="100%" alt="Up the hill." />
</figure>

## Workshop Tuesday (with Pizza)

Tuesday marked the beginning of our planned activities. In the morning, we gathered for a collaborative workshop focused on team dynamics and fostering a productive environment. This session, prepared with the guidance of our coach, Diane, was insightful and set a strong foundation for our company culture.

The afternoon was free for everyone to explore the surroundings or engage in spontaneous discussions. Some team members chose to go for a walk, while others stayed back to exchange ideas and plans that have been in their heads for a long time and some others decided to play a game called Kubb.

The highlight of the day was undoubtedly pizza night. Max brought his portable pizza oven, and Florian had spent the afternoon making pizza dough from scratch. As evening fell, we gathered to create our own pizzas. The making was as enjoyable as the delicious outcome. We laughed, shared stories, and ate homemade pizzas—a perfect blend of teamwork and fun.

<figure>
    <img src="/blog/2024-06-19-team-retreat-bologna-02.jpg" width="100%" alt="Pizza Night" />
</figure>

## Wednesday, Continued Workshops and Exploration

Wednesday morning continued with another productive workshop session. Building on the previous day's discussions and results, we delved deeper into our operating principles, aligning our visions and strengthening our collaborative spirit.

The afternoon was again free for personal activities. These unstructured times were as valuable as the workshops, allowing for organic connections and idea exchanges.

<figure>
    <img src="/blog/2024-06-19-team-retreat-bologna-03.jpg" width="100%" alt="Workshop" />
</figure>

### A Culinary Adventure on Thursday

Thursday was dedicated entirely to food. We went on a walking food tour in Bologna, immersing ourselves in the local culinary delights. From fresh pasta to delicious pastries, we tasted a variety of specialties that the city is renowned for, such as cold-cuts, Tiggele, Tortellini al Brodo, Tagliatelle al Ragù. This gastronomic journey was not just about food but also about experiencing the culture and history of Bologna together.

<figure>
    <img src="/blog/2024-06-19-team-retreat-bologna-04.jpg" width="100%" alt="Pasta" />
</figure>

<figure>
    <img src="/blog/2024-06-19-team-retreat-bologna-05.jpg" width="100%" alt="Church" />
</figure>

### The Importance of In-Person Retreats

We figured that these in-person retreats are crucial for our company culture. They provide us with a unique opportunity to build stronger relationships and learn about each other's interests and expertise. Spending time together allows us to connect on a personal and social level, enhancing our collaboration and understanding of each other, far beyond what is possible through modern communication channels like video and audio.

Our week in Bologna was a resounding success. From the insightful workshops to unforgettable culinary experiences, we cherished every moment. These retreats remind us of the importance of human connection in a digital world. It made us aware that remote work is hard work, and we are already looking forward to seeing each other again in person in the next retreat.

<figure>
    <img src="/blog/2024-06-19-team-retreat-bologna-06.jpg" width="100%" alt="Team" />
</figure>


As a fully remote company, the time we spend together in person is precious. Get some insights about our third team retreat taking place in Bologna.

Forza Italia: Retreat the third edition in Bologna


This is Max from ZITADEL. As in the previous months, in this update I want to highlight our product updates, and tips and tricks in making your identity infrastructure easier.

## Feature highlights

Again in May, we kept the pace high with more than 76 improvements shipped to our self-hosting and cloud users. Let’s go through the key improvements to ZITADEL this month.

[All changes](https://zitadel.com/changelog)

### Improvements using external SAML IdPs

We understand that many organizations, particularly enterprises, leverage SAML for user federation. In response to your needs, we've made significant steps in enhancing ZITADEL's interoperability with various SAML providers this May.

Previously, ZITADEL relied on a persistent nameID format, requiring external identity providers (IdPs) to consistently return this format for linking users. However, some IdPs utilize transient nameIDs, leading to mismatched user identities.

This update allows you to define the preferred nameID format and configure how ZITADEL maps users based on attributes received from the external IdP. For instance, you can leverage email addresses from the IdP to link users with matching emails in ZITADEL.

While ZITADEL offers pre-configured templates for external IdPs that utilize OpenID Connect, we're considering extending this functionality to SAML providers. We value your feedback – let us know your thoughts on this potential addition!

[Should we support SAML provider templates?](https://github.com/zitadel/zitadel/issues/7995)

### Making it easier to manage resources programmatically

While you get all the functionality through a UI, we are api-first and you are able to manage everything through our APIs. Managing ZITADEL resources and configuration programmatically just got simpler with some recent updates.

When you start with a new ZITADEL system, you need a first admin user to login and configure your system. In the past it was only possible to either create a human user or a service user, but not both at the same time. With a recent update creating both a human and service user is now possible, giving you hopefully a much simpler and easier access to configure ZITADEL from the start.

Moreover our [terraform provider](https://zitadel.com/docs/guides/manage/terraform/basics) got significantly updated and improved over the last weeks. Examples are managing organization and user metadata as well as managing SAML and OIDC generic external identity provider templates.

### Scaling to multi-million identities

We're excited to announce performance optimizations in ZITADEL to meet the growing needs of our enterprise customers! This update addresses the demands of multi-million identity deployments and aligns with our ongoing commitment to performance improvement. We've focused on enhancing the token endpoint, specifically for new token creation, alongside optimizations for many frequently used ZITADEL APIs. For detailed upgrade guidance, please refer to the technical advisories.

[Technical Advisories](https://zitadel.com/docs/support/technical_advisory)

## Office hours

Gear up for deeper dives and live engagement! We are excited to announce bi-weekly office hours on our Discord server for our community. These hour-long sessions will offer in-depth explorations of upcoming features, followed by a live Q&A where the ZITADEL team tackles your burning questions.

The first session, held on May 29th, delved into the exciting new version of the Actions feature.

Don't miss out on this chance to connect with the ZITADEL team and stay ahead of the curve! Checkout our [meeting schedule](https://github.com/zitadel/zitadel/blob/main/MEETING_SCHEDULE.md) for upcoming sessions.

[Office hours meeting schedule](https://github.com/zitadel/zitadel/blob/main/MEETING_SCHEDULE.md)

## You will become a Pro

ZITADEL Cloud subscription model is changing to a simpler daily active user (DAU) model on July 1st for easier cost allocation and full feature access across instances. This serves as a friendly reminder that accounts not already on our Pro plan will automatically update.

All new subscription plans will include in the base fee 25’000 Daily Active Users in a month, one custom domain, and 3 external identity providers.

[Pricing Plans](https://zitadel.com/pricing)

## Contributors for the win

19 contributions came from our community in May. 
Thank you for your the continued support and the time you put in to make the project better for everyone.

* [yordis](https://github.com/yordis) helped us bring the typescript repo for our next gen login UI significantly forwards
* Never forget to activate your email service provider with this change from [doncicuto](https://github.com/doncicuto)
* Also by [doncicuto](https://github.com/doncicuto) comes a solution to a  community request, adding customization options to console navigation buttons
* [sujoysb](https://github.com/sujoysb) improved the error messages and user feedback for password complexity validations
* [calRobert](https://github.com/CalRobert), [jayPe69](https://github.com/jayPe69), [aurel004](https://github.com/aurel004), [burahimu](https://github.com/burahimu) all helped with our translations, and typos (is our French that bad? Apologies.)
* [cr1cr1](https://github.com/cr1cr1), [exeteres](https://github.com/exeteres), [kleberbaum](https://github.com/kleberbaum) contributed various improvement to our Charts
* Sign tokens FAPI-compliant with ES256 and PS256 thanks to [nannany](https://github.com/nannany)
* [ymarcus93](https://github.com/ymarcus93) increased compatibility with certain identity providers and fixed some issues around the library

## Additional resources

* [Passkeys: A Shattered Dream](https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shattered-dream/)
* [The SaaS Trends Report | Q1 2024 | Vendr](https://www.vendr.com/insights/saas-trends-report-q1-2024#top-categories-renewed) - Cybersecurity at the top
* [Navigating Session Logouts, Timeouts, and Token Expiry](https://zitadel.com/blog/session-timeouts-logouts)
* [Google Online Security Blog: On Fire Drills and Phishing Tests](https://security.googleblog.com/2024/05/on-fire-drills-and-phishing-tests.html)

New Success Story: [Achieving 70% Faster B2B Integration in Document Automation at BLP Digital](https://zitadel.com/blog/success-story-blp)

Thanks for reading, \
Max


Updates on ZITADEL, and tips and tricks to simplify your identity infrastructure for May 2024. In this episode we highlight improvements to SAML IdPs, managing resources programmatically, and scaling to millions of identities.

Product Newsletter May 2024


This is Max from ZITADEL. As always, I would like to highlight some of our product updates, and tips and tricks in making your identity infrastructure easier and more effective.

Summarizing the April product updates for ZITADEL is a difficult task. While we continue to work on the big roadmap items, the team worked diligently to address improvements ranging from new security features to performance enhancements to secure millions of identities. We shipped over 76 features, improvements, and bug fixes to our products. For those keeping score, that is nearly 400 year to date.

### Feature highlights

Let me share some of the more noteworthy features that were shipped during the month of April.

#### Setup your email provider - easier than ever

A generous contribution from our open source community, simplifies the configuration of email delivery within ZITADEL by introducing SMTP provider templates. These templates offer pre-defined settings for popular email service providers (ESPs) like Amazon SES, Mailgun, Mailjet, Postmark, Sendgrid, and a Generic SMTP option.

By the way, we strongly recommend replacing the pre-configured SMTP service in ZITADEL Cloud. The default provider is for demonstration purposes only and will not provide a reliable way to send emails to your users.

![SMTP provider settings in ZITADEL Console](/blog/2024-05-07-zitadel-product-newsletter-april-2024-01.png)

#### Link accounts with external identity providers

There are situations where your users might have created an account in your application and only later on want to connect their social login or external identity provider.

As of now an error might have been shown to the user, since the IdP link was not known before, but the automatic federation / creation failed, because the information (e.g. username) already existed in ZITADEL.

With a newly introduced functionality, users can connect their account with an account provided by an external identity provider. Administrators can configure how accounts should be matched against usernames or email addresses. 

#### Experimental features

Over the past weeks we introduced feature flags into the core of ZITADEL. Feature flags allow administrators to opt-in or opt-out of experimental features that are not intended to be generally available. In April we finished the work by shipping the new feature settings into the Console. 

Our intention with feature settings is to provide means to access and test early features for users to test and provide feedback. Among the currently available functionalities are several performance improvements, OpenID Connect Token Exchange, a preview of User Schemas, and a preview of a more powerful Actions feature. Some settings allow you to roll-back some improvements that would result in issues to few users.

![Feature settings in ZITADEL Console](/blog/2024-05-07-zitadel-product-newsletter-april-2024-02.png)

#### Limit one-time password attempts

Similar to the existing lockout functionality for password attempts, Managers are able to configure automatic lockouts after a specified number of consecutive failed Time-based One-Time Password (TOTP) checks. The new feature strengthens security posture by mitigating brute-force attacks targeting (T)OTP verification.

Lockouts are applied independently for each TOTP method. This ensures users retain the ability to attempt alternative verification methods (e.g., email OTP) even after exceeding the threshold for a specific TOTP method (e.g., mobile app).

[View all changes on our new changelog](https://zitadel.com/changelog)

### ZITADEL Cloud for scale and simplicity: focus on what matters most

We have no plans of moving to a cloud only service. Let me state that right at the start. There are many reasons and use cases to go for an enterprise grade identity management solution that runs on your private infrastructure, ranging from compliance requirements and risk reduction to special cases such as embedded systems.

In a self-hosted setup you will not only be responsible for managing the infrastructure layer, but also the operational security aspects of the deployment. When using cloud you don’t have to worry about DDoS attacks, WAF configuration, or bot detection during login and register. These are all covered by our systems, have a look at our shared [responsibility matrix](https://zitadel.com/docs/legal/service-description/cloud-service-description#responsibilities) to learn more.

The Pro plan now includes 25’000 daily active users per month. The cost for additional daily active users was also reduced to offer you better scale. We will streamline our subscriptions and update all existing plans that use authenticated requests to an up-to-date plan. No action is required on your end, the changes will be applied automatically on July 1st.

### What we’re working on

#### Feedback wanted on Token Exchange

We are very happy to announce that OAuth 2.0 Token Exchange according to RFC 8693 landed in ZITADEL. This grant will lay the foundation for more advanced integration scenarios, including impersonation of users, token validation and exchange with third-party identity providers, and exchange of session tokens and OAuth tokens.

To get started, follow our integration guide on [Impersonation and delegation using Token Exchange](https://zitadel.com/docs/guides/integrate/token-exchange) and make sure to [enable the feature](https://zitadel.com/docs/guides/manage/console/default-settings#features) in the newly introduced feature settings.

We would very much like to get your feedback on the implementation and learn more about your use cases. Join the discussion on our Github repository.

[Github Discussions](https://github.com/zitadel/zitadel/discussions)

#### A new login UI in typescript for you to make your own

Already today you can use our [hosted login UI](https://zitadel.com/docs/guides/integrate/login/login-users) for the highest security standards. For a couple of months you are also able to use the Session API to [build your own login interface](https://zitadel.com/docs/guides/integrate/login-ui) and user flows.

We are currently working on a next generation of our login page, written in Typescript, that will replace our existing hosted login UI. The goal is to implement a login UI, using the session API of ZITADEL, which also implements the OIDC Standard and is ready to use for everyone.

In the first phase we want to have a MVP login ready with the OIDC Standard and a basic feature set. In a second step the features will be extended. 

As always, we value your early feedback, ideas, and contributions to the next generation of our - and hopefully your - login experience.

[To the Typescript Repo](https://github.com/zitadel/typescript)

### Better together

Our community members contributed 23 improvements and features to ZITADEL repositories. I want to thank you for your continued support and the time you put in to make the project better for everyone.

* The feature SMTP templates for the most popular email service providers was contributed by [doncicuto](https://github.com/doncicuto). Not only a great feature, but also a lot of testing involved - a special thanks for that contribution
* [aDogCalledSpot](https://github.com/aDogCalledSpot) added the option to use locally generated RSA keys for service users, avoiding keys being sent over the network instead
* [Doncicuto](https://github.com/doncicuto) contributed also to multiple parts of the console to fix reported issues, improving the overall usability of the UI and APIs
* [Compatibility](https://github.com/zitadel/oidc/issues/565) of oidc client device authorization grant with Google by [celian-garcia](https://github.com/celian-garcia)  and ability to verify ID tokens based on available sign algorithms from the discovery endpoint by [otakakot](https://github.com/otakakot)
* [vigneshsankariyer1234567890](https://github.com/vigneshsankariyer1234567890) improved UX where users switching between register and login got lost
* [celian-garcia](https://github.com/celian-garcia) , [jkroepke](https://github.com/jkroepke), and [otakakot](https://github.com/otakakot) improved error handling in our oidc library
* [yordis](https://github.com/yordis), [zoltantemesvari](https://github.com/zoltantemesvari), [ahmednfwela](https://github.com/ahmednfwela), and  [HaimKortovich](https://github.com/HaimKortovich) helped us to improve and keep our SDKs up-to-date
* Charts repository dependencies by [rud](https://github.com/rud) and improved configuration of ports [ameijboom](https://github.com/ameijboom) 
* Typos and corrections to docs [EthanHeilman](https://github.com/EthanHeilman),  [alexrimlin](https://github.com/alexrimlin), and [thamow](https://github.com/thamow)

Thinking of contributing? Grab a ‘good first issue’ or start a discussion and get started with our [contribution guide](https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md).

### Additional resources

* [‘Worth exploring’ - Thoughtworks technology radar](https://www.thoughtworks.com/radar/platforms/zitadel)
* Video: [Complete Guide to Identity Federation and Brokering Using ZITADEL](https://www.youtube.com/watch?v=wg-ee-EnHdE)
* [Built with ZITADEL: 23 Technologies' Kubernetes-as-a-Service](https://zitadel.com/blog/success-story-23-technologies) 
* [Test Token Introspection in ZITADEL with Postman](https://zitadel.com/blog/testing-token-introspection-with-postman)

Thanks for reading,

Max


Updates on ZITADEL, and tips and tricks in making your identity infrastructure easier and more effective for April 2024. In this episode we write about SMTP provider templates, limit attacks on OTP, and account linking. We also share what we are currently working on.

Product Newsletter April 2024


This is Max from ZITADEL. In this newsletter, I would like to highlight some of our product updates, and tips and tricks in making your identity infrastructure easier and more effective.
This is the March 2024 edition of our newsletter.

### Feature highlights

In March, the team shipped over 110 improvements and features to ZITADEL, including many bug fixes and stability improvements. We also delivered critical security patches for issues that were reported by the community and customers. Most of the new feature development in March contributes to our roadmap items and improves the user experience.

#### Easier integration with your frameworks

Simply set up a client application in your framework and programming language. You can choose your framework in the Console, and we take care of the default settings for you so you can get started even faster.

Of course, you can still integrate with any other framework or language.

![ZITADEL Console showing app creation screen with various programming languages and frameworks](/blog/2024-04-05-zitadel-product-newsletter-march-2024-01.png)

#### Better descriptions and tooltips

While you can use the APIs to configure ZITADEL, many users rely on the Console as a user interface to configure their system. Descriptions, tooltips, and labels of both the default settings and the organization settings pages were adapted for clarity and to provide more information to users.

The latest stable version is 2.43.11. You can find the [version of our stable release](https://zitadel.com/docs/support/software-release-cycles-support#stable) information in our documentation. Some features are only available in the latest versions.

### New docs resources

This month, we worked on several documentation resources to help developers use and integrate ZITADEL more effectively. 

* [How to handle session validation when building your own login UI](https://zitadel.com/docs/guides/integrate/login-ui/session-validation)
* [Using OKTA SAML IdP for single-sign-on](https://zitadel.com/docs/guides/integrate/identity-providers/okta-saml)
* [Using Entra ID SAML IdP for single-sign-on](https://zitadel.com/docs/guides/integrate/identity-providers/azure-ad-saml)
* [Code example for ZITADEL actions](https://zitadel.com/docs/apis/actions/code-examples)
* [Guide on how to login users with SSO in ZITADEL](https://zitadel.com/docs/guides/integrate/identity-providers/introduction)
* Reworked [service user authentication](https://zitadel.com/docs/guides/integrate/service-users/authenticate-service-users) and guides on [how to access ZITADEL APIs](https://zitadel.com/docs/guides/integrate/zitadel-apis/access-zitadel-apis)
* [Streaming audit logs to external systems such as SIEM/SOC](https://docs-git-external-idp-intro-zitadel.vercel.app/docs/guides/integrate/external-audit-log)

[Check out all our guides](https://zitadel.com/docs/guides/overview)

### Technical & security advisories

Technical advisories (“TA”) are notices about major issues with ZITADEL Self-Hosted or the ZITADEL Cloud platform that could potentially impact security or stability in production environments.   For example, we issue technical advisories if breaking behavior was introduced in a release or if you must expect downtime during an upgrade.

[Review and subscribe to our technical advisories](https://zitadel.com/docs/support/technical_advisory)

Security advisories are notices about security vulnerabilities that affect ZITADEL. While we patch ZITADEL Cloud automatically, these advisories are critical for self-hosted deployments. Make sure to subscribe to “Security alerts” on our GitHub repository, by clicking on “Unwatch”, then “Custom” and selecting “Security alerts”.

[Review past security advisories](https://github.com/zitadel/zitadel/security)

Both technical and security advisories contain the details about the issue, affected versions, and how to resolve the issue.

### What we’re working on

Behind the scenes, the team is continuously  developing and refining the next major feature and improvement.

We needed to make delivery of alpha (experimental) and beta features safer and easier for users. With the recent releases in March, we introduced feature flags via a [feature API](https://zitadel.com/docs/apis/resources/feature_service), allowing users to enable features that are not yet intended for general availability for testing purposes.

In March, we made significant progress on these features. Make sure to subscribe to the underlying GitHub issue to receive regular updates.

* [Impersonation](https://github.com/zitadel/zitadel/issues/7208) enables a functionality to impersonate users to act on behalf of other users. Our efforts in March focused on security settings, Manager roles, and token exchange. We expect to release a preview of the feature in the coming weeks.
* [User Schema](https://github.com/zitadel/zitadel/issues/6433): Implementation for user schemas has started with the first APIs becoming available. This feature is still experimental and behind a feature flag.

[Roadmap](https://zitadel.com/roadmap)

### Community building: Contributions and feedback

Token exchange (RFC8693) is a permissive standard that we will implement to facilitate use cases, such as the impersonation of users. We hope to gather some feedback on our implementation from our community.

Give your [feedback on Token Exchange and impersonation](https://github.com/zitadel/zitadel/discussions/7624).

In March, our community contributed to ZITADEL and our libraries again. Thank you for your continuous support!

* [ay4toh5](https://github.com/ay4toh5i) implemented the OpenID Connect  form_post response mode, increasing interoperability with client applications of our zitadel/oidc library and in the further development of ZITADEL itself.
* [doncicuto](https://github.com/doncicuto) added expiration date information for service users’ keys. Keys expire at midnight (UTC), and that information was previously not displayed to users.
* [vigneshsankariyer1234567890](https://github.com/vigneshsankariyer1234567890) realized we were misaligned with our login button in the email verification and fixed it, while [github-tijlxyz](https://github.com/github-tijlxyz) corrected a mistake in our keycloak migration guide
* [bjw-s](https://github.com/bjw-s) and [pisarz](https://github.com/pisarz) improved our charts allowing additional pod labels and introducing parametrization to probe schemes
* [PaulHiryliuk](https://github.com/PaulHiryliuk) and [petrmifek](https://github.com/petrmifek) helped by reviewing and improving  Czech and Russian translations

We are really grateful to receive all the big and small contributions and the countless feedback and improvement ideas. In case you want to contribute, start with our [contribution guide](https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md).

### Additional resources

* [On our blog: Test your web app login flow with Postman](https://zitadel.com/blog/testing-login-with-postman)
* [ROSS Index: ZITADEL as one of the top trending open-source startups in 2023](https://runacap.com/ross-index/annual-2023/)
* [Transforming Identity and Access Management with Event Sourcing](https://thenewstack.io/transforming-identity-and-access-management-with-event-sourcing/)
* [ZITADEL as Identity Provider for NetBird](https://docs.netbird.io/selfhosted/identity-providers)
* [Load testing ZITADEL using K6](https://medium.com/@harsha_reddy/load-testing-zitadel-using-k6-a68328c89b33)


Updates on ZITADEL, and tips and tricks in making your identity infrastructure easier and more effective for March 2024. This edition includes improvements to the console, new docs resources, and things we are working on right now.

Product Newsletter March 2024


We're excited to share with you some of our product updates, and tips and tricks in making your identity infrastructure easier and more effective.
This is the February 2024 edition of our newsletter.

## Feature highlights

Our team shipped more than 91 improvements and features in February across all ZITADEL components. Here are some of the highlights in February 2024.

### Organization metadata

With organization metadata, you are able to assign arbitrary information to an organization. This could be, for example, information such as a hierarchical relationship, an internal tenant identifier, or billing information.

With the latest improvements developers can now use the organization metadata in the [complement token flow](https://zitadel.com/docs/apis/actions/complement-token) in Actions. Developers can include a user’s organization metadata into tokens that can be read by receiving applications. An [example on using organization metadata in Actions](https://github.com/zitadel/actions/blob/main/examples/org_metadata_claim.js) is available in our repository.

### Improvements to the official Terraform provider

With the release v1.1.0 of ZITADEL’s official Terraform provider, you can add SAML applications. Moreover, you can generate service user secrets and import service users with an existing secret.

Additionally to the changes mentioned above, we shipped various bug fixes, stability improvements, and enhancements of our documentation.

Make sure to upgrade to the latest version [2.46.0](https://github.com/zitadel/zitadel/releases/tag/v2.46.0) to benefit from the latest features. Consult the [Technical Advisories](https://zitadel.com/docs/support/technical_advisory) for breaking behavior and upgrade recommendations. 

The latest stable version is 2.37.3. You can find the [version of our stable release](https://zitadel.com/docs/support/software-release-cycles-support#stable) information in our documentation.

## More sample apps to secure your favorite language

![Available example apps for zitadel in different programming languages and frameworks such as Angular, Flutter, Go, Java, NestJS, Next.js, Python Django, Python Flask, React, PHP Symfony, Vue.js](/blog/2024-02-29-zitadel-product-newsletter-01.png)

We continued with sample applications to make your authentication and authorization easier in February. These changes also come with a fresh look in our documentation. Have a look at the new example applications:

* [Python Django](https://zitadel.com/docs/sdk-examples/python-django)
* [React](https://zitadel.com/docs/sdk-examples/react)

Are you missing an example or SDK in your favorite language? [Vote and join the discussion](https://github.com/zitadel/zitadel/discussions/7376)

## Tip of the month: Managers are privileged users

Managers are users who have privileged permissions to make changes within ZITADEL itself. This could be changing configurations, creating new users, or assigning roles within an organization.

For example, you can assign a Manager role to the first user of a new organization. With that, you can enable the user to configure SSO and login policies or assign roles to their team in self-service.

Developers can assign a Manager role to service users to make changes via API instead of using the Console.

[Learn how to use Managers](https://zitadel.com/docs/guides/manage/console/managers)

## Building together: Contributions & feedback

### Shape the new user API

We’re actively looking for feedback on our User API. The API is based on the new User Schema, which will allow developers to define the fields of the user, permissions of Managers and users to edit fields, and more.

[Give feedback on the user API](https://github.com/zitadel/zitadel/discussions/7423)

### Community contributions

In February our community contributed over 18 features and fixes to ZITADEL. Our thanks go out to everyone who contributed.

* [jkroepke](https://github.com/jkroepke) made valuable contributions to the oidc library
* [doncicuto](https://github.com/doncicuto) provided several UI fixes to the console
* [dvob](https://github.com/dvob), [mdarii](https://github.com/mdarii), and [filips](https://github.com/filips) contributed important improvements and bug fixes on the operations and deployment functionality.
* [yordis](https://github.com/yordis), [tired-engineer](https://github.com/tired-engineer), [omarmoo5](https://github.com/omarmoo5), and [accir](https://github.com/Accir) helped us fix various typos and improve our documentation

Thanks again for all the big and small contributions, and the countless feedback and improvement ideas. In case you want to contribute, start with our [Contribution Guide](https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md).

## What we’re working on

The team works continuously to deliver new features, improvements, and bug fixes. You can review the high-level items on our public [roadmap](https://zitadel.com/roadmap). This month, we started working on these important features. Make sure to subscribe and receive a notification once they are done.

* [Actions V2](https://github.com/zitadel/zitadel/issues/7235), called Executions, allow developers to customize the behavior of ZITADEL. Actions exist today already but are limited to certain flows and triggers. The upgraded version of Actions will allow developers to manipulate requests, manipulate the response, react to events, or hook into predefined trigger points.
* [ZITADEL CLI](https://github.com/zitadel/zitadel/issues/6669), aka. zcli, allows developers to send commands to ZITADEL from the CLI.
* [Impersonation](https://github.com/zitadel/zitadel/issues/7208) enables a functionality to impersonate users to act on behalf of other users. Impersonation will be limited to configurable user groups and will be logged in the audit trail.

## Additional resources

* [Integration guide: MockSAML](https://zitadel.com/docs/guides/integrate/identity-providers/mocksaml)
* [Hosted login vs. custom login user interface](https://zitadel.com/docs/guides/integrate/login/login-users)
* [Log actions to stdout](https://zitadel.com/docs/apis/actions/modules#log)
* [Prevent users from accessing ZITADEL console](https://zitadel.com/docs/guides/solution-scenarios/restrict-console)
* [Why we moved ZITADEL Cloud from CockroachDB to PostgreSQL](https://zitadel.com/blog/move-to-postgresql)


Updates on ZITADEL, and tips and tricks in making your identity infrastructure easier and more effective for February 2024. This edition includes details about the new organization metadata feature, latest examples, and things we are working on right now.

ZITADEL Product Newsletter for February 2024


## Introduction

ZITADEL Cloud recently made a notable shift in its database choice by moving from CockroachDB to PostgreSQL. This operational change was influenced by several factors, which we will explain in this blog. We took proactive steps to inform our valued customers about this infrastructure shift, and we've successfully completed the transition to PostgreSQL within our cloud service. Currently, we are actively working on revising our documentation and examples to reflect this change, i.e., prioritize PostgreSQL over CockroachDB. 
ZITADEL Cloud exclusively operates on Google Cloud Platform (GCP), which plays a significant role in our decision-making process. Our choice to adopt PostgreSQL was made smoother due to our seamless integration with GCP's managed database service, Cloud SQL. This fully managed, highly available PostgreSQL environment enabled us to tap into the scalability, reliability, and security features that GCP offers, all while benefiting from PostgreSQL's strong performance and efficiency.

Additionally, our aim to minimize the involvement of subprocessors and reduce reliance on third-party entities, including our previous discontinuation of Cloudflare services, played a significant role in this decision. This approach aligns with our goal of reducing dependencies on external partners, which not only simplifies control but also decreases the risk of data leakages.

Let’s dive into some of the key factors that drove this shift. 

## Data Residency and Control Concerns

One of the primary drivers behind our switch was concerns about how we managed data and where it was stored. With CockroachDB Dedicated, while we could set data storage regions, controlling the movement of log files and preventing data from ending up in unintended places was a real challenge. That challenge led us to difficulties in assuring our customers that their data would exclusively reside in their designated regions, ultimately influencing our decision to transition to PostgreSQL.

Shifting to PostgreSQL within GCP’s Cloud SQL environment gave us stronger tools for enforcing data residency within specific geographical boundaries. This was and still is vital for complying with regional data protection laws and building trust with our customers.

## Technical Factors 

### Improved Latency and Efficiency

Our decision to switch was also motivated by the need to improve latency and streamline infrastructure efficiency. CockroachDB's global distribution model, while really advantageous for high availability, introduced higher latency and required more compute resources, leading to higher costs. In contrast, PostgreSQL, with its simpler architecture, enabled us to handle larger workloads with improved latency and reduced compute requirements. As a result, ZITADEL Cloud experienced significant enhancements in database query performance and overall system responsiveness. These improvements were particularly noticeable in our reduced API latency.

### Scalability and Infrastructure Optimization

Our decision to shift to PostgreSQL was also rooted in a thorough analysis of our infrastructure needs. For example, running a CockroachDB cluster required 3 nodes per region, each equipped with 8 CPUs and 32 GB of RAM, operating at around 40-50% capacity. In contrast, PostgreSQL allowed us to achieve similar results with significantly fewer resources with 4 CPUs and 16GB of RAM, making our infrastructure utilization more efficient.

Scalability was another factor in our choice. GCP's ability to offer robust configurations combined with PostgreSQL's efficient scaling capabilities allowed us to confidently handle growing workloads. Whether we need to scale vertically or horizontally, PostgreSQL's architecture, coupled with GCP's infrastructure, provides the flexibility we need.

Recent advancements in cloud infrastructure have made PostgreSQL an even more attractive option. We can now vertically scale to machines with substantial resources, like 128 CPUs and nearly a terabyte of memory, addressing our previous scalability concerns in the past. Additionally, PostgreSQL's operational flexibility, including the ability to adjust database costs for different operations and utilize read replicas, gives us more options for scalability and performance optimization.

### Operational Flexibility and Ease of Use

Moving to PostgreSQL also made our operational processes more straightforward. Running a dedicated PostgreSQL cluster in each region provides us with greater flexibility in how we handle tasks like isolated schema changes and rollouts, making data management smoother and less expensive.
For example, optimizing for PostgreSQL was easier due to its non-distributed nature, allowing for straightforward use of transaction IDs. This simplicity was in contrast to the complexities associated with CockroachDB's logical timestamps. PostgreSQL presented a more deterministic and less resource-intensive approach.

## Cost Effectiveness

Financial factors also weighed in our decision-making process. Operating a CockroachDB cluster incurred considerably higher costs compared to a similar configuration with PostgreSQL on Cloud SQL. For instance, we noted that a CockroachDB cluster with 3 nodes (8 CPUs, 32 GB RAM each) was almost three times as expensive as a PostgreSQL setup (4 CPUs, 16 GB RAM) while offering comparable performance per region. This cost difference, coupled with a more straightforward scaling model, made PostgreSQL a more economically viable option.

## Conclusion

The decision to embrace PostgreSQL wasn't straightforward and was influenced by a blend of considerations, including data residency assurance, reduced latency requirements, cost-efficiency, operational flexibility, optimization simplicity, and scalability potential.

It's worth noting that CockroachDB remains extremely valuable, particularly in scenarios where high availability is a non-negotiable requirement, even if it means sacrificing a bit of speed. Essentially, it boils down to a classic trade-off between latency and availability, which you see in all distributed systems. If achieving the lowest possible latency while accommodating minor availability trade-offs is your goal, PostgreSQL emerges as the preferred choice. On the other hand, if ensuring rock-solid availability takes precedence and you can tolerate slightly higher latency, then opting for a CockroachDB cluster is the recommended route. Naturally, cost considerations also factor into this evaluation.






This article delves into ZITADEL Cloud's shift from CockroachDB to PostgreSQL and the reasons behind this database transition.

Why We Moved From CockroachDB to PostgreSQL


We're excited to share with you some of our product updates, and tips and tricks in making your identity infrastructure easier and more effective. 

### New sample apps in VueJS, PHP, and Java

We have set ourselves the goal to make your life as easy as possible —at least for your authentication and authorization needs. Check out these newly added examples and guides for PHP, Vue, and Java to get started in minutes:

* [PHP Symphony](https://github.com/zitadel/example-symfony-oidc)
* [VueJS](https://github.com/zitadel/zitadel-vue)
* [Java](https://github.com/zitadel/zitadel-java)

Are you missing an example or SDK in your favorite language? Let us know by opening an improvement idea. 

[Create an improvement idea](https://github.com/zitadel/zitadel/issues/new/choose)

### Tip of the day: Invite users outside of your organization

![user_grants](/blog/2024-01-31-zitadel-product-newsletter-01.png)

Maybe you didn’t know, but you can invite users from other organizations and assign them authorizations just as for internal users. This is what we call “user grants”, they work the same as for organization grants, but for users.

Do you have partners or agencies managing your customers' organizations on behalf of them? Maybe have a look at user grants and see if that could help you to make this process easier.

[Read more about multi-tenancy](https://zitadel.com/blog/multi-tenancy-with-organizations)

### Build or buy? Anyways, lunch was on us

This month we started a webinar series “Lunch & Learn. First to start was Fabienne, our Head of Product & Co-Founder taking on the topic “Build or Buy?”.

What are build and buy decision factors? And when does the complexity of modern identity management really come into play when rolling your own auth?

Did you miss it? We published the first webinar of the series on our [YouTube channel](https://www.youtube.com/watch?v=xn_yNzWKfIA&t=315s), including the Q&A with our participants.

Make sure to register for our future webinars on topics such as Beyond Community Bug Fixing, Penetration Testing, or making your applications more secure. Recordings of future webinars will be published only later this year, so make sure to register for the webinar.

[Register for our next webinar](https://share-eu1.hsforms.com/1SPAf60K9QO-QqF7Vqp6s8Q2dljbt)

### What else has changed in ZITADEL?

* We shipped many bug fixes and performance improvements in January
* Improvements in how errors are handled and logged for OpenID Connect functionalities
* Added more functionality (GetUserByID) to the resource-based API, as part of deprecating our service-oriented APIs
* You can now define some resources by name rather than id only when using our [Terraform Provider](https://github.com/zitadel/terraform-provider-zitadel). This should make it easier for many users to apply the same configuration to different environments.

Remember that the latest stable version is 2.37.3. You can find the [version of our stable release](https://zitadel.com/docs/support/software-release-cycles-support#stable) information in our documentation. Make sure to check the [Technical Advisories](https://zitadel.com/docs/support/technical_advisory) for breaking behavior and upgrade recommendations.

### Contributions

We received 18 contributions to our products through our community in January. Thank you very much for your continuous support!

* [doncicuto](https://github.com/doncicuto) provided several fixes to login and console, making it easier for users to navigate, configure, and login to ZITADEL, and contributed a feature to search for users by their email address
* [jkroepke](https://github.com/jkroepke) contributed features and fixes to our OIDC package, improving error messages
* Our Helm Chart received valuable improvements from  [thomaspetit](https://github.com/thomaspetit), [arnouthoebreckx](https://github.com/arnouthoebreckx), and [raunodepasquale](https://github.com/raunodepasquale)
* [tafaust](https://github.com/tafaust) contributed a NodeJS-NestJS example
* [ahmednfwela](https://github.com/ahmednfwela) kindly improved the Flutter example
* [lukasver](https://github.com/lukasver) and [tstenner](https://github.com/tstenner) helped us find errors and typos in our docs

Thanks again for all the big and small contributions, and the countless feedback and improvement ideas. In case you want to contribute, start with our [contribution guide](https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md).

### Additional resources

* [New Guide: Onboard your customers and users](https://zitadel.com/docs/guides/solution-scenarios/onboarding)
* [Hands-on Introduction to ZITADEL | Rawkode Livestream](https://www.youtube.com/watch?v=ctkmwzHgIPs&list=WL&index=3)
* [Exciting ZITADEL Features to Watch for in 2024](https://zitadel.com/blog/upcoming-features-2024) 
* [Built with ZITADEL: CrossClassify's Fraud Prevention Solution](https://zitadel.com/blog/success-story-crossclassify)
* [Built with ZITADEL: Open Systems' IAM Strategy for Global Networks](https://zitadel.com/blog/success-story-open-systems)


Updates on ZITADEL, and tips and tricks in making your identity infrastructure easier and more effective for January 2024

ZITADEL Product Newsletter


<img
    src="/blog/2024-01-18-upcoming-features-2024-01.jpg" 
    width="100%"
    alt="Banner Image"
    style={{ margin: '0 auto' }}
  />

## Upcoming Features

After [a year of solid growth and improvements in 2023](https://zitadel.com/blog/recap-2023), we are already gearing up for what 2024 has in store for ZITADEL. Our focus is always on how we can make things better for you, and it’s not just about keeping up; it's about paving the way forward.

In this post, we want to give you a sneak peek into some of the key features on our [roadmap](https://github.com/orgs/zitadel/projects/6/views/1) for 2024. These features and enhancements will help make ZITADEL more intuitive, responsive, and, most importantly, aligned with your needs. We are excited to share these developments and continue our journey together in enhancing your experience with our platform. Here are the top features and offerings for 2024:

### 1. Authentication Examples and SDKs for the Most Used Languages

ZITADEL will be rolling out more easy-to-understand examples and SDKs this year. Whether you are working on a frontend or backend project, you will find clear, hands-on examples that show you how to integrate ZITADEL's authentication into your app. For frontend apps, you will see more examples with session management, user roles, and even how to handle user profiles. For the backend, you will see examples on how to handle various types of access control. All of them will use recommended OIDC libraries or SDKs. 

After setting the stage with these examples, ZITADEL's next move is to bring in more SDKs for languages like Java, Python, and PHP. We are planning to take them up a notch, showing you how to interact with ZITADEL APIs for more complex tasks, like managing user profiles or setting up security features. There will also be a wide range of languages and integration patterns. Whether you are coding in Python, PHP, or Java, or working on a mobile app, there is something in the pipeline for you. Plus, we are looking into making ZITADEL play nice with popular third-party tools. See this [epic](https://github.com/zitadel/zitadel/issues/5124) for more details. 

### 2. ZITADEL Cloud’s Data Region Expansion: Introducing US and EU Hosting in 2024

This year, ZITADEL is taking a significant step forward in its service offerings with the introduction of data regions in the US and EU (European Union). This move is all about giving customers more control and assurance over where their data is hosted.

Data location is a big deal. It's about knowing the specific region, which could be a country or a group of countries, where your data lives. ZITADEL understands that for many businesses and users, where their data is stored is as important as how it is stored. 

ZITADEL's cloud service is already offering a range of regions through Google Cloud Platform. These include:

- **Global:** This is the broadest option, where your data can be hosted in any of the cloud regions offered by ZITADEL’s provider.

- **Switzerland:** For those who prefer their data to stay in Switzerland, this option ensures hosting exclusively within the Swiss region.

- **GDPR Safe Countries:** This is for those who want to align with GDPR guidelines. Data is hosted within EU member states and other countries recognized as adequate under GDPR.

And the big news for this year:

- **US and EU Regions:** Recognizing the demand and importance of these regions, ZITADEL is set to offer cloud instances in both the US and the EU. This expansion means increased flexibility and more choices for businesses and individuals with specific needs or preferences for data hosting in these areas. We expect this expansion to go live by early Q1. As always, keep an eye on our website for the most current information regarding available regions.


### 3. Say Hello to Customizable User Schemas

ZITADEL is about to roll out a game-changer for businesses managing user data—[customizable user schemas](https://github.com/zitadel/zitadel/issues/6433)! This update responds to the growing demand for flexibility in user information management, allowing businesses to tailor user data fields to their specific needs and compliance requirements.

The new user schema feature in ZITADEL enables complete customization of user data fields. Businesses now have the freedom to determine which fields are necessary and which are not, eliminating the need to fill irrelevant fields. This flexibility also extends to defining which fields users can manage on their own and which ones require admin oversight.

Most importantly, despite the customizations, the user sign-in process will remain straightforward. ZITADEL ensures that the system works seamlessly without additional configurations. The update also promises efficient performance, with validations happening swiftly to ensure a smooth user experience. We are keeping it simple and user-friendly. 

We will enhance the user object structure to include a variety of fields like unique IDs, schema types, contact information, and custom profile fields, aligning with various user types. The introduction of a diverse range of authenticators will further enrich user interaction, catering to different security and access needs.

Incorporating JSON Schema Validation, the new feature allows robust validation of fields, ensuring data integrity and compliance. This flexibility also extends to management methods, with comprehensive options for creating, updating, and deleting users and schemas. Keep an eye out for this; it's going to make life a whole lot easier!


### 4. Custom Actions for Every Event and API Request

ZITADEL will be [extending actions to let you create custom actions](https://github.com/zitadel/zitadel/issues/7235) for every event, API call, and the functions you are already used to in ZITADEL. This means you can now tailor custom workflows to fit your exact needs. With this feature, you will be able to add your code, your own rules, right into ZITADEL's events and API calls. Whether it's an event in the system or an API request you are making, you will be able to hook in custom actions. 

- **Event-Based Actions:** You can attach actions to specific events within ZITADEL. After the event is stored, you decide when your custom action should kick in.

- **API Request Actions:** Similarly, for any API request, you can define actions to occur at different stages—during the request or in the response phase.

- **Multi-Event Actions:** And here's the kicker-you can create actions that run across multiple events. Think of it as a way to implement a consistent response or workflow across various parts of the system.

For developers, this feature is a game-changer. It means you can integrate ZITADEL more deeply into your systems and workflows. You are no longer just reacting to a few points during code execution—you gain the full flexibility of the programming language of your choice to customize the behavior of ZITADEL and react to events in real time. This level of customization is unprecedented and will unlock new ways of leveraging ZITADEL for your projects.



### 5. Streamlining User Management with Outbound Provisioning via SCIM

In 2024, ZITADEL will roll out a pretty cool feature that's going to make life a lot easier for businesses using Single Sign-On (SSO)—[outbound provisioning with SCIM (System for Cross-domain Identity Management)](https://github.com/zitadel/zitadel/issues/6601), and it's all about simplifying how user accounts sync up with external systems and applications.

Many SSO systems need a user account to already exist in their platform. Plus, these accounts must stay updated, especially when someone's status changes in the identity provider. This can get tricky when you're juggling multiple systems.

Understanding the need for pre-existing user accounts in many SSO systems, and the importance of keeping user statuses in sync with Identity Providers (IdPs), ZITADEL's solution focuses on extended actions. These allow for real-time updates and custom integrations with third-party systems, overcoming the challenges posed by standard SCIM implementations. This approach is not only more flexible but also caters to diverse use cases, offering businesses the ability to tailor their user management workflows.

Extended actions offer several advantages:
- They adapt to various third-party systems, allowing for a more personalized approach to user management.
- Changes in user accounts are instantly reflected across systems, ensuring up-to-date information.
- Supporting SCIM and generic API endpoints, this feature broadens the scope of integration possibilities.

The new feature enhances functionality through:
- Changes in user status automatically initiate actions, enabling immediate response to user management events.
- Fine-tuned control over actions based on user metadata or attributes.
- Options for executing REST calls or utilizing a SCIM module, enhancing data synchronization flexibility.
- Including all aspects of user management like creating, reading, updating, deleting, enabling/disabling users, and schema discovery.
- Detailed Documentation and Testing: Ensuring ease of integration and understanding.


### 6. Enhancing Team and Organization Onboarding with Improved Invitation Flows

ZITADEL is addressing a vital need in the B2B sector: [better and more intuitive ways to invite team and organization members](https://github.com/zitadel/zitadel/issues/7083). Recognizing the importance of streamlined team management and onboarding processes, ZITADEL is set to introduce enhanced invitation flows that cater to the specific requirements of business-to-business scenarios.

The proposed solution focuses on empowering managers to invite new users to their organization effortlessly. Here’s what it entails:

- **Email Invitations:** Users can be invited through an email containing a registration link specific to the organization from which the invite was sent.

- **SSO Integration:** If Single Sign-On is enabled, invitees have the option to sign up using an external identity provider, enhancing the ease of the onboarding process.

- **Customizable Email Texts:** The content of the invitation emails can be tailored to match the organization's tone and branding, offering a personalized touch.


This update is more than just about inviting members; it’s about enabling comprehensive team management within an application. This includes creating a new organization, appointing an admin user, configuring security settings like SSO and 2FA, and assigning roles to users. ZITADEL aims to make this process as intuitive as possible, addressing the common challenge of balancing authentication, authorization, and self-service configuration in cloud solutions.

ZITADEL recognizes that creating a custom onboarding experience is a frequent requirement. The new update will make it easier to understand and implement various methods for user registration, whether it’s through username/password, external IdPs, or social logins.
This feature will further enhance the critical aspects of the B2B onboarding process. 


### 7. User Group Authorizations

In 2024, ZITADEL will also introduce [user group authorizations](https://github.com/zitadel/zitadel/issues/5822), a game-changing feature for administrators. This update streamlines the way permissions and roles are managed by leveraging group-based authorizations. Its key advantages are:

- **Group-Based Access Control:** Admins can now manage permissions at the group level, rather than for individual users, saving time and reducing complexity.

- **Easy User and Group Management:** Features include creating, updating, searching, and deleting groups. Users can be added effortlessly or removed from these groups.

- **Merged Authorizations:** A standout feature where individual user roles are seamlessly combined with their group roles, enhancing flexibility and ensuring comprehensive access rights.

- **Integrated Authorization Visibility:** Group authorizations are integrated into tokens and user information, maintaining consistency across the platform.

In essence, ZITADEL's user group authorizations simplify and enhance access management, making it more efficient for administrators, especially in larger organizations. 


## Let's Go

As we wrap up our preview of what 2024 holds for ZITADEL, we are genuinely excited and hope you are too. A lot of hard work is going into developing these features, and we're eager for you to start using them. Make sure to stay tuned for our release announcements.

Your continuous support and feedback are what drive us. So, thank you for being an integral part of our journey. Here's to a groundbreaking year ahead!







This article provides an insightful overview of the exciting new features and updates that ZITADEL is set to roll out in 2024.

All posts/ #community