Delegated access management

Hosted Login

Multifactor Authentication

Passwordless Authentication

Audit Trail

Identity Brokering

Platform

Service Accounts

Features

Easy integration

B2B (Business to Business)

Self Service

Existing identities

Secure authentication

Use Cases

Learn how to install, setup, and use ZITADEL.

Documentation

ZITADEL Cloud

Self-hosting

Trust center

Examples and Guides

Github Repository

Develop

Get Started

Contribute

Roadmap

Changelog

About Us

Jobs

Contact

Company

Read the blog

Sign up

Login

Pricing

Blog


![Recap of 2022 with people raising their glasses in the background](/blog/2022-12-29-best-of-zitadel-2022-00.png)

Another long year is slowly ending and it is almost time to drown our sorrows in champagne and turn a new page in life.
However, before we plunge too deeply into our fresh new year’s resolutions, we are taking a moment to reflect on the milestones we have reached this year and to express our gratitude for the overwhelming support we were given along the way. 

This brief recap showcases the most significant ways ZITADEL has improved in the year 2022. 

## We Raised $2.5 Million!
One of the most significant milestones in ZITADEL's development was the successful closing of our seed funding round led by [Nexus Venture Partners](https://nexusvp.com/).
Ever since the [big announcement](/blog/fundraising-nexus) saw the light in June, this generous grant has played a vital role in helping ZITADEL become the best open-source alternative for identity management needs. 

With this incredible achievement under our belts, we are beyond excited to see what else we can accomplish with our remarkable supporters and valued customers on our side.

## Introducing our next major release of ZITADEL
In August of 2022, ZITADEL underwent its most significant upgrade to date.
The new version introduced a [new selection of features and upgrades](https://github.com/zitadel/zitadel/releases/tag/v2.0.0) that ensure easier use, expanded compatibility, more value for your money and, as always, still the highest possible data security. 

The most significant changes brought on by V2.x include the following: 
- [New Virtual Instances](/blog/introducting-v2-0#:~:text=New%20Virtual%20Instances,by%20the%20platform.)
- Extended database compatibility to [PostgreSQL](/blog/postgresql-support)
- [More Social Logins](/blog/social-logins#:~:text=ZITADEL%20will%20support,for%20all%20users.) and
- [Easier Development](/blog/introducting-v2-0#:~:text=Easier%20to%20Develop,features%20more%20straightforward.)
- The implementation of [SAML 2.0](/blog/saml-support)

While the development team focused on new upgrades and implementations, the UI and UX department was responsible for enhancing ZITADEL's visual appeal and ease of use.
With the help of a reimagined navigation system, content filters, keyboard shortcuts, and [many more new features](https://github.com/zitadel/zitadel/issues/2944), the new console of ZITADEL is now easier to use than ever before.

## Relaunch Of Our Cloud Service
Concurrently with the release of  ZITADEL’s new version, we also relaunched our cloud service. Instead of being limited to single organizations, each of our customers can now set up new instances - an own logically separated setup of ZITADEL - from our customer portal. This also came with features to make ZITADEL Cloud invisible to your users, like using a custom domain for your login page and defining your own SMTP server for emails.

Given all of the improvements ZITADEL undertook this year, it was time for us to revisit our cloud pricing structure as well. We swiftly identified the path the adjustments should take concerning our core philosophy of not placing a premium on security features: 

To allow users to gradually expand the platform based on their organization’s specific needs, we have removed subscription tiers and their respective feature locks altogether.
With these changes implemented, our users are granted a platform that scales along the rest of your infrastructure requirements with [more features](/blog/pricing-updates-v2) to enjoy than ever.

Our pricing also differentiates us in the market and resembles the cost of infrastructure more closely than a per-seat cloud service. We are the best identity management platform for not only consumer identities but also your B2B customers/partners. With that, we wanted to create more reasonable pricing that works for all your identities, and you don’t have to worry about any unpredictable costs.

## New Findings With Pentest
As a team behind the platform handling sensitive data, we firmly believe that a transparent working process is essential for establishing trust in our project and cloud service. Accordingly, we highly prioritize publicizing the findings of our systemic security screenings. 

In November of 2022, we tested ZITADEL against the [OWASP Top Ten risks](https://owasp.org/www-project-top-ten/) and the configuration of our systems with the help of an external party.
With just one significant issue instantly resolved throughout the test, we were glad to find that the platform was assessed as confidential.
If you are interested in a more detailed overview of the results, feel free to [read the full report](/blog/2022-12-01-pentest-results-h2-2022-01.pdf).

As an additional effort to promote transparency, we have decided to reduce the number of sub-processors with access to customer data.
Our updated [Trust Center](/trust) displays a coherent list of every relevant provider and the specific data they have access to.

## Rising Blog Readership

Every week, our [ZITADEL Blog](/blog) is enriched with new stories, news, updates and opinions all about authentication and cybersecurity. While our articles have generally enjoyed an incredible rise in readership this year, three posts must be highlighted for drawing a particularly remarkable number of visitors.

Here are the TOP 3 articles from 2022 that you found most intriguing:

- [#3](/blog/smishing): Smishing - How to Recognize Dangerous Text Messages
- [#2](/blog/jwt-vs-opaque-tokens): JWT vs. Opaque Tokens
- [#1](/blog/magic-links): Magic Links - Are They Actually Outdated?

[![Thumbnail of our blog Are magic links outdated?](/blog/2022-06-22-magic-links-00.png)](/blog/magic-links)

## ZITADEL Beyond The Digital World
As a team working on a platform all about cybersecurity, it likely is not surprising that most of our work is done virtually. This year, however, we were granted some incredible opportunities that helped us expand our horizons and spread the word about ZITADEL beyond the digital world. 

These were the most notable events and conferences we visited in 2022:

- [Swiss Cybersecurity Days](https://swisscybersecuritydays.ch/) (SCSD): The largest cybersecurity convention in Switzerland, featuring world-renowned experts and politicians.
- [Gophercon UK](https://www.gophercon.co.uk/): A conference and workshop dedicated to Go programming information and training
- [Devoxx UK](https://www.devoxx.co.uk/): A conference for developers to learn, sharpen their skills and get hands-on experience with the latest tech
- [Websummit](https://websummit.com/): An event in Lisbon bringing together 70,000+ people to redefine the tech industry
- [Startup Nights](https://startup-nights.ch/): A convention in Winterthur with over 5’000 startups presenting their services and products

![Fabienne, Silvan, Max, and Florian in front of our ZITADEL booth at Websummit](/blog/2022-12-29-best-of-zitadel-2022-01.png)

## And Finally: A Thank You

While we are very proud of how far our authentication solution has come in 2022, it would be disingenuous for our team to take all the credit for this success. Our valued customers, supporters and anyone who takes time out of their day to interact with ZITADEL are all crucial factors in our growth as a startup. 

We are profoundly grateful for your trust in ZITADEL and look forward to seeing what more we can achieve together in the upcoming year and beyond.


This brief recap showcases the most significant ways ZITADEL has improved in the year 2022. We are profoundly grateful for your trust in ZITADEL!

The Best Of ZITADEL 2022


With our recent release of [version 2.5.0](https://github.com/zitadel/zitadel/releases/tag/v2.5.0) of ZITADEL we introduce Support for Security Assertion Markup Language (SAML) as an additional technology standard used for authentication.
Our goal with ZITADEL is to build the best identity and access management platform for the serverless era.
With the addition of the standard we significantly extend the range of applications you can integrate and identity providers you can use for SSO.

Until today we provided Support for the more modern authentication standard OpenID Connect (OIDC).
Our [zitadel/oidc](https://github.com/zitadel/oidc) library for golang, which is being used in ZITADEL, also passed the [OpenID Connect certification](/blog/openid-connect-certification).
We still recommend to use OIDC, especially when you're working with Single-page-applications, Mobile native clients, REST APIs, or when it's stimply a tie between OIDC and SAML, as we have [discussed in a previous blog](/blog/saml-vs-oidc).

Nevertheless, there are still a lot of enterprise applications that can only handle SAML for SSO.
So if you would like to use your existing identites to sign-into tools like Atlassian, Gitlab, Google Workspace, AWS, Citrix Netscaler, etc. you need to do so via SAML.
While we are hoping that OpenID Connect replaces SAML over time, we decided to offer SAML support in ZITADEL, so that you don't have to worry about this fact.

To get started you might want to checkout [our guides how to integrate different applications](https://zitadel.com/docs/guides/overview).
For more technical details you might want to refer to the [SAML Endpoints](https://zitadel.com/docs/apis/saml/endpoints).

With our implementation we follow the given [open standards for SAML](https://github.com/zitadel/saml#Resources) and support the most relevant [SAML features](https://github.com/zitadel/saml#Features).
While we support POST- and Redirect-Binding we opted to leave out the more secure Artifact-Binding for now, as only few clients support the latter and most likely opt for the more conventient OIDC alternative.

We release SAML as an early feature. Although we have tested ZITADEL agains multiple applications, we expect to find some issues around clients being not conformant with the standard, or some technical problems over the next couple of weeks.

If you run into any technical problems or have specific questions, please raise an [issue over on Github](https://github.com/zitadel/saml) or [ask in our Discord](https://zitadel.com/chat) for help.


With the latest version of ZITADEL we introduced support for the security a session markup language protocol which gives you a broad range of new options for Single-Sign-On with your favorite apps

Does your application only support SAML? Fear not, ZITADEL can help you!


In our ongoing effort to build the best identity and access management platform for the serverless era, we extend the database compatibility of our solution.
We are happy to announce that with the recent [release of version 2.3.0](https://github.com/zitadel/zitadel/releases/tag/v2.3.0) ZITADEL supports the PostgreSQL database model.

Up until now ZITADEL was only available with CockroachDB as storage.
As already noted back in our talk with CockroachDB, which you can [find on our Blog](/blog/how-we-built-it-cockroach-labs), right from the start we considered going with plain PostgreSQL as storage.
But opted for CockroachDB first for the cloud-native approach and shared-nothing architecture which gave us great benefits in running globally-scalable and zero-downtime service for customers.

Over time, however, we have received more requests from our community to provide support for alternative databases.
As many already operate or use a managed PostgreSQL database for their own services, this helps reduce the learning curve and overhead in managing different database setups.
With that we've heard your wishes and implemented PostgreSQL support for ZITADEL. It is available for self-hosting setups from today in a beta stage.

To get started checkout the [Guide in our Docs](https://zitadel.com/docs/guides/manage/self-hosted/database#postgres). Note that you need to overwrite the values of the [base configuration](https://zitadel.com/docs/guides/manage/self-hosted/configure) with these values.

As mentioned above, this is an early feature. ZITADEL has been tested against a plain-vanilla PostgreSQL database. If you run into any technical problems or performance issues, please raise an [issue over on Github](https://github.com/zitadel/zitadel) or [ask in our Discord](https://zitadel.com/chat).

We extend the database compatibility of ZITADEL with support for PostgreSQL databases in addition to CockroachDB.

You wanted PostgreSQL? We got you covered.

Given the explosive popularity of cloud services in recent years, we are now increasingly seeing organizations of all sizes seeking to utilize Software as a Service applications. While **SaaS is generally an ideal deployment option for businesses seeking a pre-configured platform**, many such applications are solely equipped with a single-tenant architecture, thus significantly **limiting the addressed use cases**. Therefore, if your organization is looking for a SaaS provider with enhanced scalability, a high level of customization and the opportunity for a Business-to-Business (B2B) use case, we strongly recommend **looking into the concept of multitenancy**.

This article will discuss multitenancy's definition and its benefits over a single-tenant SaaS architecture.

## What is multitenancy?

In a nutshell, multi-tenant architecture is a **cloud-oriented ecosystem** that uses scalable, available, and resilient architecture, allowing **one SaaS application to support multiple tenants**. It has the primary purpose of **sharing a database and codebase** across all clients with a similar data structure while their **data remains logically separated**.

At its core, multitenancy is conceptually similar to an **apartment complex**. Within this context, the apartment building represents a single SaaS environment that hosts multiple tenants (customers).

![](/blog/2022-08-17-multitenancy-02.png)

The business providing the multi-tenant SaaS application takes on the role of the construction enterprise and landlord. In this example, this buisness is called Apolon. Apolon’s SaaS solution serves three clients: Miho, Posh, and Cyane; the tenants of the “apartment.” While the **tenants share** their computational, networking, and storage **resources, their personal data is isolated** **and invisible to each other**; reminiscent of the fact that real-life apartment renters do not have unsolicited access to other flats either.

If you view multiple apartments of the same complex, you will likely find that despite their differences in furnishings and decorations, each flat shares the **same fundamental architecture**. The concept of a multi-tenant SaaS environment functions according to a similar scheme: While Apolon’s core application functionality is reused for each of its customers, they can **customize the certain aspects of their experience**, such as login according to their respective organization’s attributes (f.e. colors, logo, selected secondary login-factors, etc.).

To regulate access to specific aspects of the application, tenants generally **assign specific roles to each member of their organization**. Thus, each member of the organization automatically **receives the corresponding authorization** that their role entails.

## The Benefits

While the previous chapter explained the structure of a multi-tenant architecture as a metaphor for an apartment complex, within that same context, a single-tenant architecture would be best represented by tract housing. With these real-life parallels of these two technical concepts established, the differences they hold over each other become increasingly evident. The following paragraphs list **the most significant benefits multitenancy has over single-tenant architecture**.

### Shared resources and bases - Easier implementation

In the case of tract housing, the lots (SaaS) are constructed by the same enterprise (the business providing the single-tenant SaaS) and are, therefore, akin to apartments, identical in their fundamental architecture. However, unlike households within the same complex, the tenants of tract houses **do not share any commodities:** The environment only **serves a single customer**. For this reason, each tenant of a single-tenant architecture **requires dedicated computing, network, and storage resources, as well as data- and codebases** that would need to be **individually integrated** into each environment.

SaaS applications with a multitenant architecture, such as ZITADEL, include a **single codebase** along with a **code repository** with a few branches. By not having to individually implement every branch of code to a potentially large number of tenants, the **deployment process is easily carried out with the help of just one command** (one-click-deployment).

### Freehand maintenance

Similar to the maintenance of an apartment complex, in which the association maintains all expected amenities, the SaaS vendor is responsible for several aspects of database upkeep. To lift some weight off the provider’s shoulders, the multi-tenant server is **regularly launching automated upgrades and optimizations**, thus **preserving the performance and agility** of the application.

### Lower prices

The **shared commodities and responsibilities** provided by a multi-tenant architecture also result in **lower fees for the SaaS vendor:** Instead of paying for multiple deployment and maintenance processes individually provided to every tenant, the **cost of the environment is shared**. As a result of these low and predictable ongoing costs, the application can generally be sold for a set subscription price.

### Higher scalability and easy customization

Most multi-tenant SaaS applications provide tenants the ability to **scale on demand**. Furthermore, since every additional user receives access to the same basic software, the process of scaling has far **fewer infrastructure implications** than within a single-tenant solution.

Multitenancy also allows for a **facile, coding-free customization process**. For example, ZITADEL’s SaaS solution allows each tenant to personalize their login flow by determining the Federation (Azure AD, Google Workspace, etc.), password policies, colors, logos, domains and login multi-factors.

### Support for B2B

One of the most common use cases of multitenancy is within a B**usiness to Business (B2B)** context. Due to its formerly mentioned advantages, we recommend a SaaS with a multi-tenant architecture to B2B vendors that wish to **provide isolation and branding for their clients' organizations** without wasting money, time and resources.

## In Conclusion

The **resource-sharing capabilities** of multitenant services allow them to function with **lower infrastructure and maintenance costs** while simultaneously providing **higher operational effectiveness**. Despite the environment’s shared commodities, the **affordable multi-tenant SaaS solution of ZITADEL** ensures each tenant complete privacy regarding their data, a highly customizable login flow and on-demand scaling.

To lean more about ZITADEL, feel free to contact us anytime on our ZITADEL [Discord Server](https://zitadel.com/chat). Alternatively, you can reach us on our [Twitter](https://twitter.com/zitadel), [Linkedin](https://www.linkedin.com/company/zitadel/) or [Github](https://github.com/zitadel/zitadel) pages or on our [Website](https://zitadel.com/contact).

This article discusses multitenancy's definition and its benefits over a single-tenant SaaS architecture.

Everything you need to know about Multitenancy


As a result of many months of diligent effort from our community and developers, we are thrilled to finally announce the first significant upgrade to our Identity & Access Management (IAM) platform: ZITADEL Version 2.0. Discover a new selection of features and upgrades that ensure easier use, expanded compatibility, more value for your money and as always, still the highest possible data security.

This new upgrade is a massive milestone in the product’s lifespan, bringing us a big step ahead in providing developers with the best open-source alternative for all their identity management and authentication needs.

This article briefly lists the most noteworthy changes brought on by V2.0. For further information on the update and a migration guide, check out the [Release Notes](https://github.com/zitadel/zitadel/releases/tag/v2.0.0).

<p align="center">
  <strong>We're on <a href="https://www.producthunt.com/posts/zitadel">ProductHunt</a> and <a href="https://news.ycombinator.com/">HackerNews</a> today. <br/> Thanks for all the support from our great community!</strong>
</p>

## What is ZITADEL?

The journey of ZITADEL began in 2019 when an inspired startup team envisioned creating a **developer-first, open-source approach to solving identity management**. This vision resulted in a set of engineering and design principles, ultimately leading to the release of Version 1 in late 2020.

Within these two years, ZITADEL has established itself as a unique turnkey open-source platform that offers developers unprecedented flexibility by combining the best aspects of older IAM solutions, such as the **ease of Auth0 and the versatility of Keycloak**. Thanks to its secure login, user management, multi-factor authentication, social logins, authorization management and great APIs, ZITADEL exists to provide a **safe and customizable authentication server for software products**, be it in a self-hosted or Software as a Service (SaaS) version.

Thus, with the help of ZITADEL, your organization can s**pend more time and effort in building your main product and growing your business** while your login needs are taken care of.

## What’s new?

### New Virtual Instances

The introduction of virtual instances brings another significant change to our platform. Previously, when users wanted to operate a complete ZITADEL instance in addition to single organizations, they had to **upgrade their system from a public cloud service** or self-host their ZITADEL. Version 2.0 aimed to lift this barrier by granting **every ZITADEL user their own virtual instance free of charge**. As a result, users can now fully configure their instance policies for each organization instead of relying on the ones previously predetermined by the platform.

Suppose your organization needs an additional system or two (for example, for testing and production, respectively). In that case, you have the option to run multiple isolated ZITADEL instances simultaneously that share the underlying process and infrastructure. With the help of this communal framework, users are **spared the efforts of individually configuring each additional instance**.

Beyond the previously mentioned benefits of higher convenience, customization, and reduced cost, the **possession of a ZITADEL instance comes with some additional perks**, such as:

- The ability to configure multiple custom domains (such as login.mycompany.ch) and access to a simple route if you ever need to migrate them
- The possibility to send transactional e-mails from your mail server
- Configurable notification channels (SMTP, Twillio)
- A selectable [data residency](/blog/data-residency) (Switzerland, global, or GDPR-compliant regions)
 
### Easier to Develop

Setting up a local development environment that mirrors production can be time-consuming. By **facilitating the overall process in Version 2.0**, our goal is to relieve some of the developers' burdens and **make implementing new features more straightforward**.

New features that should facilitate development:

- [Terraform provider](https://registry.terraform.io/providers/zitadel/zitadel/latest/docs) to make ZITADEL easy to use in GitOps flows
- [Helm Chart](https://github.com/zitadel/zitadel-charts) for our Kubernetes users
- Compatibility with serverless platforms, such as Knative and Google Cloud Run
- All services (Login, APIs, Assets, etc.) now run under one IP and port and are being routed through their paths
- Reworked [ZITADEL Docs](https://zitadel.com/docs/) to better reflect our users’ needs.

### Pricing Update

One of the most notable upgrades of our Cloud Service, running the Version 2.0, is the **reimagining of our cloud pricing system**. The idea behind this change is to facilitate the processes of getting started with ZITADEL and gradually expand the platform based on your organization’s specific needs.
To achieve this goal, we have decided to **remove subscription tiers and their respective feature locks altogether**.
With the help of the new **“Pay as you go”** pricing model, customers of ZITADEL are **freed from the restrictions of a predefined feature bundle**.
They can therefore experiment with much more of what ZITADEL has to offer **without hitting a paywall**.

More information on our new free features and the ZITADEL Cloud pricing model can be found in [this article](/blog/pricing-updates-v2).

### What’s next for ZITADEL?

While Version 2.0 has been a huge stepping stone in our product’s journey, in this ever-evolving digital world, the work of a platform handling sensitive data is never over. With new technological changes, enhanced security requirements, and sneakier cybercriminal tactics gradually emerging, ZITADEL must do its best to **retain its position as an innovative and highly secure open-source IAM solution**.

By constantly keeping track of the newest technological modernizations and evaluating individual feedback from its users, the team behind the platform always manages to set new goals to work towards. The following months of this year will bring an **extensive list of new features currently in development**.

**Features coming soon to ZITADEL:**

- SAML 2.0 – A new protocol alternative to OIDC
- More [Social Login options](/blog/social-logins)
- Significant improvements to the [Register Flow UX](/blog/six-ways-zitadel-will-improve-2022#3-improvements-based-on-prototype-feedbacks) based on user feedback
- Extend the database support to [Postgres](https://github.com/zitadel/zitadel/issues/3898)
- Each additional planned feature is listed on our [Roadmap](https://zitadel.com/roadmap).


As a result of many months of diligent effort from our community and developers, we are thrilled to finally announce the first significant upgrade to our Identity & Access Management (IAM) platform - ZITADEL Version 2.0.

Introducing ZITADEL Version 2.0!


Access tokens, as the name suggests, are an essential part of Identity and Access Management (IAM) Services: They are used to grant access to client resources. Since they contain such sensitive data, access tokens must be kept confidential in transit and in storage; the respective application should therefore ensure that the token is not accessible to other apps on the same device.

Access tokens come in different formats, all of which have their respective uses. So far, ZITADEL has allowed **JSON Web Token (JWT) Profile** for authentication of Service Accounts. This month, we are expanding the possibilities of our platform by introducing **Personal Access Tokens (PAT)** that can be enabled along with an existing JWT profile.

In this Article, I will explain **why we have chosen to introduce PAT** in addition to JWT, **which audience this change will benefit** and **how PAT can be implemented** into the ZITADEL console.

As a first step, it is essential to know what JWT and PAT have to offer.

## JSON Web Tokens (JWT) and their application

JSON Web Token (JWT), is a compact and **self-contained** open standard used to **share security information between a client and a server** in a structured format (JSON). It is commonly used as an access token (for authorization and securing APIs) by specific protocols such as OAuth 2.0.

The use of access tokens is that they must be passed upon every request of an application to access routes, services, or resources (f.e. APIs) to confirm the user's authorization. Some solutions **might not support JWT Profile for Machine-to-Machine (M2M) communication**, although it is the preferred method to authenticate Service Accounts in terms of security.

## Personal Access Tokens (PAT) and why they are needed

Personal Access Tokens are **opaque tokens**, i.e. no information can be extracted from the token itself, that enable granular access to a specific resource. This procedure is generally useful for interrogation with 3rd-party systems that use the respective platform to store records, and don't want to proxy all the protected resources via their system. In the case of ZITADEL, PATs were implemented to **provide an alternative method of authentication for Service Accounts**.

Although not as secure as JWT Profile, PATs are helpful for service users that have **trouble integrating their Service Accounts with the preferred method**. If this type of problem arises, it is advised to enable PAT along with JWT Profile. The token will grant access to all rights assigned to the user (within ZITADEL itself (manager roles) or in other projects by user grants). You should always limit the lifespan of a PAT and refresh regularly (e.g. every 30 days) to minimize security risks.

## How to set up PATs on the ZITADEL console

Should you be interested in using Personal Access Tokens, it is vital to know how it is done. In this chapter, we show you a step-by-step tutorial on how to enable PATs on the [ZITADEL Console](https://console.zitadel.ch/).

Upon signing into the ZITADEL Console, navigate to the Menu on the left of your screen. On the top left, **select the organization** you wish to assign the token to (here: Test2). Next, click on the menu item **“Service Benutzer / Service User”**.

![](/blog/2022-03-03-new-personal-access-token-01.png)

Clicking the “Service Benutzer / Service User” menu item should lead you to the page pictured below. To create a new Access Token, scroll down to the option called **“Access Tokens”** and click on the button **“+Neu / +New”**.

![](/blog/2022-03-03-new-personal-access-token-02.png)

A small new window should pop up on your screen, asking you to **define a custom expiration for the token** you are about to generate. If you wish for your PAT to **only be valid through a specific timespan**, enter the desired expiration date into the input field or select it using the calendar icon on the right, then click the button **“Hinzufügen / Add”**.

![](/blog/2022-03-03-new-personal-access-token-03.png)

Whether you chose to enter an expiration date or not, upon pressing the **“Hinzufügen / Add”** button, another small window should be revealed. The message in red will **warn you to copy the long token code, for you will not be able to access this code again**. To do so, **click on the clipboard icon** next to it. Once the code is copied, you can close the small window by pressing the **“Schliessen / Close”** button.

![](/blog/2022-03-03-new-personal-access-token-04.png)

Following the previously listed steps should result in the creation of a Personal Access Token for your desired organization. Finally, the copied token code can be embedded **as a bearer token in the authorization header** into the ZITADEL application via a third-party service.

See our [documentation](https://zitadel.com/docs/) for more details.

![](/blog/2022-03-03-new-personal-access-token-05.png)

## In Conclusion

If you are a service user and have trouble with integrating your accounts with JWT Profile, consider enabling a Personal Access Token along with JWT Profile.

Should you have questions regarding PATs, JWTs or any other related (or unrelated) topics, feel free to contact us anytime on our ZITADEL [Discord Server](https://zitadel.com/chat). Alternatively, you can reach us on our [Twitter](https://twitter.com/zitadel), [Linkedin](https://www.linkedin.com/company/zitadel/) or [Github](https://github.com/zitadel/zitadel) pages or on our [Website](https://zitadel.com/contact).


In this article, we will explain why we have chosen to introduce PAT in addition to JWT, which audience this change will benefit and how PAT can be implemented into the ZITADEL console.

New Personal Access Tokens (PAT): A game changer for Service Users


Ever since we have officially launched our IAM-Platform in May of 2021, we have had the pleasure to serve hundreds of customers, who have put their trust in us. As a company that always strives for innovation in an ever-changing digital world, our biggest goal is to provide our customers with the best possible user-experience and the most value for their money by constantly keeping ZITADEL up-to-date: In this article, we describe 6 great upgrades coming soon to our platform, that help making this goal a reality.

## 1. More social login options

Whether Google, Microsoft, or Apple ID - Most of us have already used some of our social identities to facilitate sign-ups on third-party applications and websites. This login method not only saves valuable time by not requiring the completion of a registration form, but also spares you the effort of remembering yet another password. This year ZITADEL will strive to **heavily expand the number of its Identity Providers**, assuring its users a comfortable login via their preferred social identity. Whereas thus far, ZITADEL has exclusively supported OIDC compliant providers, this restriction will soon be completely removed in order to provide a wider range of options.

A list of social identity providers soon available on ZITADEL:

- Apple ID
- Microsoft Live
- Github
- Gitlab
- Microsoft Tenants (AzureAD)

… And hopefully many more to come!

## 2. SAML 2.0 - New protocol alternative

In 2021, ZITADEL officially implemented **OpenID Connect (OIDC)**, a highly accessible authentication protocol, excellently suited for HTML5/JavaScript applications. Despite it being an ideal choice in terms of user-friendliness, scalability, and lightweight handling, as a new protocol, OIDC has yet to evolve in terms of establishing a more complex security system.

To allow our users the choice of a viable alternative, we are planning to **additionally introduce the other adopted industry standard for authentication, SAML 2.0** (Security Assertion Markup Language). Like OIDC, SAML allows a service provider to delegate the authentication and authorization of users wishing to access it, to a central authentication server (identity provider). Both standards are utilized in various SSO solutions, however, SAML is universally more trusted in enterprise- and government-scale activities due to its age.

This new, simultaneous access to both protocols will give you more options on which method of authentication you want to use. To enjoy the benefits of both standards to their fullest, you also have the possibility to adopt a **hybrid usage**: Since the **two protocols serve different purposes**, the standards can diverge between each of your applications. For instance, while OIDC is the ideal choice for mobile-centered apps, SAML finds its primary implementation in web programs, where complex identity data is required. Whichever features you prioritize; the range of possibilities is wider than ever!

## 3. Improvements based on prototype feedbacks

The key to ensuring a highly accessible and frictionless user experience is to **focus on satisfying the audience**. To achieve this goal, it is essential to have the audience **test and evaluate the product first-hand**: This method is called prototyping. Ideally, every new iteration of the product (or in this case: website) should be reviewed by diverse members of the user-base and optimized accordingly. After all: Evaluating prototypes can spark new ideas for future innovations.

In December of 2021, we invited a group of users (aged 16-44) of varying digital-affinities, to test the registration flow, including the existing 2-Factor-Authentication of ZITADEL. Upon carefully reviewing every feedback, we could identify some common user pain points that are impairing the authorization experience. For this reason, in 2022 we will **improve the registration process by implementing the following changes**:

- Ensuring higher accessibility by removing exclusionary language (Technical jargon).
- Providing support for users with help and information texts.
- Adding “passwordless” as a registration method - no more passwords needed.
- Clearing user flow where next actions are clearly highlighted.
- A new, optimized user interface for the existing management website.
- Smaller optimizations of buttons and descriptions, minimizing possible confusion.

## 4. Accessible and exportable Usage Metrics

As a platform working with sensitive data, it is especially important for ZITADEL to be constantly improved to meet tomorrow's increasing standards. With the help of usage metrics, we are able to continuously measure the platform's effectiveness and thus rapidly identify and fix potential inefficiencies. These metrics are **not only excellent tools of risk reduction, but also help us improve operational quality**, thus keeping ZITADEL sustainable.

In 2022, we will **display the most important usage metrics together with useful business metrics in our Console**. Such metrics are shown as a sequence of data points over an interval of time, and include:

- Number of active users
- Number of successful vs. unsuccessful login attempts
- Number of new registrations

Additionally we will improve reporting capabilities, thus making **data more easily readable and exportable for your administrators**. One example of such a report is a list of users for a given organization. With the new reporting capabilities you can add a column showing whether a user has enabled 2FA, filter that column by users who have not yet enabled 2FA and export the values to a structured data format.

## 5. Your own instance - New customized domain and data location

At ZITADEL, we strongly believe that security features should not cost extra. Accordingly, all our tiers include unlimited IAM resources and all required security features. So far, when you wanted to operate a complete ZITADEL instance, and not only single organizations, our customers had to **upgrade from a public cloud service to a dedicated ZITADEL instance** or self-host their ZITADEL; therewith only customers of dedicated ZITADEL could enjoy the benefits of complete autonomy over where this system is operated, on which domain it runs, when it should be updated and which default settings should be stored. Whereas this upgrade granted our customers some notable privileges over those potentially constrained by the limitations that come with a shared system, **this advantage will no longer be a feature you have to pay for**.

In 2022, we will launch an **upgrade to every subscription-tier**, that gives you the maximum value for your money: Not only will every subscriber, regardless of their tier, be **granted a virtual instance**, you will now be able **fully configure your own instance policies for each of your organizations** instead of relying on the ones previously predetermined by ZITADEL.

**The benefits of this change include:**

- **A domain that's yours only** - now you can let users login on subdomain such as login.mycompany.ch
- Send transactional emails from your own Mail server
- Choose where your data is stored and processed - whether Switzerland, Europe or global GDPR compliant regions, the location is yours to pick.

In view of these major upgrades that will be made available for every subscription-tier, you might be wondering what further benefits a higher tier could provide. Alongside more customization possibilities, which are already a given, subscribers of our **STANDARD** and **ADVANCED plans** will receive **dedicated private instance**, completely independent from a shared system: Not only will a private instance grant you data isolation from those of other customers, it will also supply **more deployment options regarding infrastructure providers** (such as Azure, AWS and Scaleway) and a wider selection of **data regions**.

## 6. It will be easier to develop ZITADEL

Building a local development environment that mirrors production can be a truly time-consuming workflow. In 2022, we are planning to introduce some significant improvements that should lift some weight off of developers shoulders, by **facilitating the overall process**; implementing new features will soon be easier than ever!

**Following new changes will facilitate the development process:**

- Quickstart will be made possible by executing a single command that will automatically run every asset which was formerly needed to be launched manually (including CockroachDB).
- The ZITADEL binary will be provided for different operating systems and architectures in addition to container images.
- By soon making our product roadmap publicly accessible, you will be able to gain an insight into the features we are planning to implement, as well as the ones currently in development.
- The Documentation will be enhanced with new guides and the decision making will be made public.

## The takeaway

As we have entered a new year, we would once again like to thank you for having put your trust in ZITADEL in 2021. Hopefully, we can successfully express our gratitude to our loyal customers by always improving our platform to make it the best it can be. The team is looking forward to another successful year and we hope to hear your opinion on our new changes!

Should you have questions regarding these improvements or any other related (or unrelated) topics, feel free to contact us anytime on our ZITADEL [Discord Server](https://zitadel.com/chat). Alternatively, you can reach us on our [Twitter](https://twitter.com/zitadel) (btw. our new handle is just zitadel), [Linkedin](https://www.linkedin.com/company/zitadel/) or [Github](https://github.com/zitadel/zitadel) pages or on our [website](https://zitadel.com/).


In this article, we describe 6 great upgrades coming soon to our platform, that help making this goal a reality.

6 New ways ZITADEL IAM will improve in the year 2022


## Description

We were busy since our last Into the CAOS and want to share some updates around ZITADEL and what is planned in the near future.

We will also talk about new features such as Metadata, Actions, new policies as well as what did not go so well.

<br />
<div className="my-4">
  <YouTubeExtended
    videoId={"RZJkNX7s7Zk"}
    containerClassName={"youtube-container"}
    stopsTitle="Topics covered"
    stopList={[
      { name: "Highlights from the past weeks", time: "1:50" },
      { name: "Metadata", time: "5:20" },
      { name: "Handling External Identity Providers", time: "7:06" },
      { name: "Actions", time: "9:00" },
      { name: "Lockout policy", time: "17:00" },
      { name: "Query Side", time: "21:06" },
      { name: "Question to Lockout policy", time: "25:21" },
      { name: "Native Backup", time: "28:19" },
      { name: "OpenAPI/Swagger", time: "30:10" },
      { name: "Issues and learnings", time: "33:29" },
      { name: "New languages", time: "39:38" },
      {
        name: "How to use ZITADEL for Product vs. Organizations",
        time: "42:36",
      },
      { name: "Roadmap", time: "54:31" },
      { name: "Penetration test", time: "58:40" },
    ]}
  ></YouTubeExtended>
</div>

## References

- [Swisscom Cybersecurity Startup Challenge](https://www.swisscom.ch/en/magazine/start-up/startup-challenge-security/)
- [DINAcon Awards](https://awards.dinacon.ch/gewinner2021/)
- [API Documentation](https://zitadel.com/docs/apis/introduction/)
- [Internationalization Documentation](https://zitadel.com/docs/guides/manage/customize/texts#internationalization)
- [Smartive - Built with ZITADEL](https://zitadel.com/blog/success-story-smartive-bin)
- [Pentest results](https://zitadel.com/blog/pentest-results-h1-2021)

## Discuss features

- [Discussion: Metadata on Orgs](https://github.com/zitadel/zitadel/discussions/2454)
- [Discussion: Project settings](https://github.com/zitadel/zitadel/discussions/2263)


We were busy since our last Into the CAOS and want to share some updates around ZITADEL and what is planned in the near future.

Into the CAOS | No 2.


## Description

The team behind ZITADEL shares what we developed over the summer, what issues we encountered on the way, and what is planned in the near feature.

<br />
<div className="my-4">
  <YouTubeExtended
    videoId={"b95LK2oiIiw"}
    containerClassName={"youtube-container"}
    stopsTitle="Topics covered"
    stopList={[
      { name: "Team", time: "5:25" },
      { name: "Privatelabeling", time: "8:00" },
      { name: "Passwordless", time: "12:03" },
      { name: "Query Optimization", time: "17:00" },
      { name: "Postmap rings 😂", time: "20:50" },
      { name: "OIDC RP Certification", time: "21:33" },
      { name: "Sentry", time: "26:10" },
      { name: "New Nextjs template / example", time: "32:05" },
      { name: "Quick Demo Privatelabeling in Console", time: "33:12" },
      { name: "Issues and how we solved them", time: "37:05" },
      {
        name: "Upcoming: Extending external identity providers",
        time: "56:05",
      },
      { name: "Next up: What’s coming to ZITADEL", time: "1:01:28" },
    ]}
  ></YouTubeExtended>
</div>

## References

- [Software Architecture / Query Models / CQRS](https://zitadel.com/docs/concepts/architecture/software)
- [Certification OIDC RP Library in Go](https://github.com/zitadel/oidc)
- [Examples / Templates](https://zitadel.com/docs/sdk-examples/introduction)


The team behind ZITADEL shares what we developed over the summer, what issues we encountered on the way, and what is planned in the near feature.

All posts/ #features