Delegated access management

Hosted Login

Multifactor Authentication

Passwordless Authentication

Audit Trail

Identity Brokering

Platform

Service Accounts

Features

Easy integration

B2B (Business to Business)

Self Service

Existing identities

Secure authentication

Use Cases

Learn how to install, setup, and use ZITADEL.

Documentation

ZITADEL Cloud

Self-hosting

Trust center

Examples and Guides

Github Repository

Develop

Get Started

Contribute

Roadmap

Changelog

About Us

Jobs

Contact

Company

Read the blog

Sign up

Login

Pricing

Blog

A common task for many developer and security-centric teams is to provide an identity and access management (IAM) service.  Whether that component only consists of a sign-up form and a login page or a more complex infrastructure, the number one priority is always to provide a seamless functionality for your users.  Failure in implementation can have severe consequences. To reduce your risk and feel confident in your IAM platform, partnering seasoned professionals in the space ensures success.

Companies looking for authentication servers have the option to consider the solutions available in the market or build it themselves.  As each option presents its own set of benefits and drawbacks, teams are often overwhelmed to make the right choice.  In this article, we will cover the key pros and cons of each of the two options that help companies make the right decision for both short-term and long-term benefits.

### Benefits of a Custom-built Platform
1.  Built to your needs: Custom-built IAM platforms can be tailored to your organization's specific requirements.  With a custom solution, you have complete control over the user experience and the technology choices. You can design authentication flows that align with your brand and user journey, creating a seamless experience that doesn't feel disconnected from the rest of your application. This customization extends to crucial workflows like user onboarding, password resets, and permission management—all of which can be optimized for your specific use cases rather than following a generic approach.
2. Enterprise Integrations: Enterprise environments often present complex integration challenges that off-the-shelf IAM solutions struggle to address effectively. A custom-built IAM platform can be architected from the ground up to integrate seamlessly with your existing technology ecosystem, regardless of its complexity or uniqueness.
Legacy systems present a particular advantage for custom solutions. While many modern IAM platforms have limited support for older technologies or protocols, a custom solution can be built to bridge these gaps. Whether you're dealing with mainframe applications, custom LDAP schemas, or proprietary single sign-on systems developed in-house decades ago, a custom solution can be tailored to interface with these systems without compromise.
3. Control Over Data and Infrastructure: A custom-built IAM platform puts you in the driver's seat when it comes to data sovereignty and infrastructure decisions. This complete control means your organization retains ownership of user credentials, access patterns, and authentication logs—data that is often among the most sensitive your company manages.
For organizations in regulated industries such as healthcare, finance, or government, this control can become crucial. Custom solutions allow you to construct specific data residency requirements, ensuring user information never leaves particular geographic boundaries or jurisdictions. You can also implement custom encryption schemes that go beyond standard offerings, creating multiple layers of protection for particularly sensitive identity data.
4. No Vendor Lock-in: Building your own IAM platform frees your organization from the constraints of vendor dependencies. This independence means you're not tied to a particular company's business decisions, product roadmap, or pricing strategies. If a vendor decides to sunset a feature your business relies on or dramatically increases licensing costs, organizations using off-the-shelf solutions may find themselves scrambling to adapt.
Custom solutions also shield you from the impacts of acquisitions and mergers in the IAM market, which can often lead to discontinued products or significant changes in service quality and support. With your own platform, you maintain continuity regardless of market fluctuations.
5. Customized Compliance Implementation: Regulatory compliance requirements for identity management vary significantly across industries and regions. A custom IAM platform allows you to design compliance features that precisely address your specific regulatory landscape without unnecessary overhead.
For example, a custom platform can be built with GDPR's right to be forgotten as a core architectural principle rather than an afterthought. Healthcare organizations can design authentication workflows that inherently enforce HIPAA requirements. Financial institutions can implement multi-factor authentication schemas that directly align with specific banking regulations in their operating regions.
### Drawbacks of a Custom-built IAM Platform
While the benefits of custom-built IAM solutions are compelling, they come with significant challenges that organizations must carefully consider. The reality is that identity management is a specialized field requiring deep expertise in security, performance optimization, and regulatory compliance. Building your own platform means taking on the full burden of these complexities—often pulling focus and resources away from your core business objectives. The following drawbacks highlight why many organizations ultimately find that the apparent freedom of a custom solution can become a costly constraint.
1. Security Issues: A significant risk of building your own authentication server lies in its generally higher probability of security issues, which is usually due to a disproportionate time spent on building and not security implementation. Since keeping your users’ data safe is among the greatest responsibilities of the platform and the primary task of an IAM , it is essential to make sure an adequately established security system is given. One of the most obvious advantages specialized vendors have over DIY developers is the possession of a dedicated team with cybersecurity and software engineering expertise. The members of these teams can utilize their knowledge to create the best possible security system based on their diverse experiences.
IAM vendors commonly offer advanced security features, such as support for multi-factor authentication (MFA) and security keys (Yubikey etc.). Another security aspect where third-party IAM solutions prevail is pattern recognition: they can prevent attacks more easily due to their large user base, whereas a custom-made solution does not possess enough data to recognize suspicious patterns.
Keeping up with authentication best practices and standards becomes another insurmountable task for custom-built platforms, whereas IAM vendors can ensure compliance and adherence to standards.
2. Cost of Maintenance: Contrary to popular belief, you will likely find that building your own authentication server is not cheaper in the long run. While you might initially save money, that will quickly be compensated by the cost of development, maintenance, troubleshooting, upgrades, and the resources themselves that are needed for these procedures. Furthermore, you might find that unexpected expenses arise later on in your software’s lifetime: while initially you will likely implement a simple username + password login system, due to the high security requirements of a well-functioning authentication solution, you will most likely need to expand it with more complex features (f.e. Multi-Factor-Authentication, passwordless login options and more social logins).  Also, since your primary business is likely in an unrelated field to the IAM itself, the inevitable shift in your working context would entail additional costs. When considering a custom-built solution, it is therefore beneficial to evaluate if the needed investments over the lifetime of your product are ultimately less than the amount you would have to pay for the one-time fee of the purchasable alternative.  
Add in the scale by a factor of (n) to address a multi-tenancy requirement for each customer with their own settings, and the cost of maintenance grows exponentially.
3. Expensive, in all aspects: When creating anything from scratch, you should probably reckon with a lengthy production process. This not only delays the “time to value” of your business-critical applications as you first need to build the IAM platform before you can make your application available to your users.  This also applies to developing a service; given that authentication solutions require lots of API programming and complicated security features, fully building one might take at least a year as a full-time job. Since this service will handle sensitive data, the development of an adequately functioning security system also involves constant testing and optimizing, which should not be neglected to save time. The need for custom features also extends to the product phases well beyond the initial development: keeping your application functional and up to date requires you to additionally establish a maintenance system that will serve this purpose. Using an already established IAM solution would therefore likely save you several years of time, and money spent on essential resources.

![](https://cdn.sanity.io/images/y3uu7rkl/production/deeec64e2aa7e46f68c8de9addac4090ae2f3c80-2940x1656.png)
*Calculations based on our analysis*
### Benefits of Buying an IAM Platform
While custom-built IAM solutions offer some advantages, after examining the complex challenges of building one, it becomes clear why many organizations ultimately choose to purchase a dedicated IAM platform from specialized vendors. These purpose-built solutions offer numerous advantages that directly address the pain points of custom development.
1. Industry-Leading Security Expertise: Specialized IAM vendors focus exclusively on identity security, employing teams of security experts who dedicate their careers to staying ahead of emerging threats. This concentrated expertise translates into robust security practices that would be difficult for most organizations to replicate internally. Professional IAM solutions typically offer:
Regular security audits and penetration testing with third party partners
Rapid response and mitigation of vulnerabilities
Advanced threat detection and prevention capabilities
Compliance with the latest security standards and best practices and certifications
2. Faster Time to Market: Implementing a pre-built IAM solution dramatically accelerates your deployment timeline. What can typically take months or years to develop in-house can often be set up in weeks or even days with a vendor solution. This quick implementation means:
Your core products and services launch faster
Security enhancements reach your users more quickly
Development resources stay focused on your business differentiators
You realize return on investment sooner
3. Reduced Total Cost of Ownership: While the upfront licensing costs of purchased IAM solutions are visible line items in your budget, they typically represent a fraction of the total cost of building and maintaining a custom platform especially if you factor in the development time. A comprehensive IAM solution hence eliminates:
* Development costs for initial implementation of the security features
* Ongoing expenses for security updates and patching
* Infrastructure and operational overhead, especially for SaaS users
* Costs associated with specialized security talent acquisition and retention
* Expenses related to compliance certification and auditing

![](https://cdn.sanity.io/images/y3uu7rkl/production/6b2ba627a001746cc86e4499c29d15ae5f898fc1-2940x1648.png)

4. Continuous Innovation Without Internal Resources: Professional IAM vendors continuously improve their platforms, incorporating new authentication methods, security enhancements, and usability features as they emerge in the market. This ongoing innovation happens without draining your internal resources, allowing you to:
* Benefit from industry advancements automatically
* Support new standards and protocols without additional development
* Offer cutting-edge security features to your users
* Stay competitive with larger organizations that have more resources
5. Scalability and Reliability: Enterprise-grade IAM platforms are built from the ground up to handle massive scale with exceptional reliability. These solutions typically offer:
* High-availability architectures with redundancy built in
* Elastic scaling to handle usage spikes
* Global distribution for performance optimization
* Proven reliability under extreme load conditions
* Comprehensive monitoring and alerting options
6. Simplified Compliance Management: Managing compliance across multiple regulations (GDPR, HIPAA, SOC2, ISO27001, etc.) requires significant expertise and ongoing attention. Dedicated IAM platforms typically:
* Maintain compliance certifications so you don't have to
* Provide detailed audit logs and reporting
* Offer pre-built compliance frameworks for various industries
* Stay updated with evolving regulatory requirements
* Simplify your compliance audits with ready documentation
7. Professional Support and Expertise On-Demand: When issues arise (as they inevitably do), having access to specialized support can mean the difference between minor inconvenience and major business disruption. Established IAM vendors provide:
* 24/7 technical support from identity specialists
* Comprehensive documentation and implementation guides
* Professional services for complex deployments
* User community and knowledge sharing
* Training and certification programs


![](https://cdn.sanity.io/images/y3uu7rkl/production/18106bcce85f266ce752a3e24d3d7cba3b115fd6-2940x1654.png)

### Bringing the Best of Both Worlds with Zitadel 
Zitadel delivers enterprise-grade identity and access management without the development overhead of building your own solution from scratch. Unlike custom-built IAM systems that require significant engineering resources, ongoing maintenance, and security expertise, Zitadel provides a battle-tested, comprehensive solution out of the box. 
With Zitadel, organizations gain immediate access to modern authentication protocols, multi-tenancy support, robust user management, and authorization controls —all while avoiding the hidden costs, security vulnerabilities, and compliance challenges that often plague homegrown IAM implementations. By choosing Zitadel, your team can focus on core business objectives rather than reinventing complex identity infrastructure.
1. Developer-first, multi-tenant platform: As a developer-first multi-tenant platform, Zitadel gives you custom-level control with turnkey implementation - offering intuitive APIs, comprehensive SDKs, and detailed documentation that drastically reduces development resources while supporting complex multi-organization structures that would typically require months of custom coding. You can even build your own custom login UI using Zitadel's APIs while relying on its battle-tested security and standards implementation behind the scenes.
2. Flexible deployment: Zitadel offers the data sovereignty of custom solutions without the infrastructure burden. You have the ability to choose between the convenience of Zitadel Cloud with its zero-maintenance approach or the control of self-hosting in your own infrastructure - either way, you maintain full ownership of your identity data without the ongoing operational costs of a custom-built IAM platform.
3. Extensibility and Enterprise Integrations: Zitadel delivers adaptability at the level of a custom-built solution without the associated complexity of a custom-built IAM solution. Its extensive extensibility and enterprise integrations ensure seamless connection to your existing ecosystem through webhooks, actions, and pre-built connectors for enterprise systems, allowing for the same customization you get from building in-house without forking code, managing separate codebases, or compromising security.
### Get Started
Get started with  Zitadel, the comprehensive, ready-to-deploy Identity and Access Management platform  rather than building one from scratch. We offer the ideal authentication platform with flexible pricing, a variety of deployment options, extensive features, enterprise-grade security, and unlimited identities across all instances.

Have questions about authentication or anything else? Connect with us on the [Zitadel Discord Server](https://zitadel.com/chat). You can also find us on [LinkedIn](https://www.linkedin.com/company/zitadel/), [GitHub](https://github.com/caos/zitadel), [Bluesky](https://bsky.app/profile/zitadel.com), [Twitter](https://twitter.com/zitadel) or through our [website](https://zitadel.com/).

If you appreciate our work, please consider [giving us a star on GitHub](https://github.com/zitadel/zitadel). We value your support!

The Zitadel Identity and Access Management (IAM) platform offers a turnkey enterprise-grade platform for cloud-native organizations looking to move away from a custom-built IAM platform with modules that are expensive to maintain.

Stop Building and Maintaining Frankenstein IAM Platforms


At Zitadel every customer is granted their own virtual instance with unlimited identities that allows them to fully configure their instance to their needs. This includes choosing a deployment option which is most suitable for the unique needs, security requirements, budget, and resources of each individual organization.

Unlike most Identity and Access Management (IAM) offerings available today (such as Auth0 by Okta, Keycloak, etc.) Zitadel officially offers flexible deployment options – to deploy in Zitadel Cloud or to self-host in your preferred location. In this article, we will discuss our Cloud and self-hosted options to help you find the right solution for your project or business.

## Convenience and Speed-to-Market: Zitadel Cloud

### Pros:

Our public cloud option is ideal for any user who is intrigued by the idea of a hosted deployment model that is ready-to-use the moment you obtain it. Unlike the self-hosted alternative, Zitadel Cloud is pre-configured and automated, saving you the time and money spent on implementing, managing, and maintaining your platform. A virtual instance will automatically upgrade with new product improvements and security fixes without your intervention.

You also do not have to worry about expanding your infrastructure when your service gains new customers or sees usage spikes. Zitadel Cloud can help scale and handle resource allocation for you. A notable benefit also lies in the possibility of choosing a region that works best for your project to stay close to your users. The Zitadel platform is built to manage traffic from a global audience or constrain data to only a certain location, depending on your organization's needs. Both scenarios are possible through Zitadel Cloud, while we optimize and guarantee low latencies and high availability.

With the Zitadel Cloud, you also benefit from the operational security aspects, such as Distributed Denial of Service (DDoS) attack protection and automated certificate management. Zitadel is an open source platform and has the same open source releases available to both our cloud and self hosted environments. We take security seriously and go above-and-beyond so we take pride in publishing the results of our [penetration tests](https://zitadel.com/blog/pentest-results-h1-2021) done by external auditors, as soon as we mitigate issues.

As a “cherry on top”, we offer a true pay-as-you-go subscription method to keep the total cost of ownership (TCO) affordable to even strict budgets.

### Cons:

There are certain weaknesses relying on a Cloud deployment, which are easily outweighed by the convenience of a pay-as-you-go subscription for most customers. While most customers are satisfied with our infrastructure in terms of cloud provider and data location options, some want to choose their own infrastructure providers or data location. In this case self-hosting is the best option (we also partner with managed service providers in some areas if a dedicated instance of Zitadel is the preferred option). Both options are also viable in case a customer requires more flexibility of upgrade cycles or backup frequencies.

A common weakness in today's software is supply chain risk, where our open source model provides extraordinary transparency of code, dependencies, and processes, yet a customer relies on the quality of our technical and organizational measures to manage information security. We are continuously improving our information security and are ISO27001 certified. If your organization requires complete control over the technical and organizational measures, you should choose to self-host Zitadel.

Another challenge in a Cloud deployment lies in its less flexible options out of the box. While companies mostly offer a wide variety of templates to choose from, their number can't compete with the infinite customization possibilities that come with building your own platform. We do not recommend building your own identity management system, rather we promote our platform approach where customers can easily extend functionality of the platform by loosely coupling new components. This is supported by [Zitadel’s API-first approach](https://zitadel.com/docs/apis/introduction), SDK's in [various languages](https://zitadel.com/docs/sdk-examples/introduction), and programmatic extensibility through [Zitadel Actions](https://zitadel.com/docs/guides/manage/console/actions).

The summed-up benefits of Zitadel Cloud include:

- Receive a pre-configured and implemented platform – no need to bother with updates, backups, maintenance, and troubleshooting
- Operational security provided
- Automated backups and updates
- Availability guarantees and automatic scaling
- “Pay as you go” model with low total cost of ownership
- Choose the region that works best for you
- Technical support from the creators - we are here to help

## Complete Control: Self-hosted

### Pros:

Unlike Zitadel Cloud, the self-hosted version is hosted by you on your infrastructure. In the case of Zitadel, companies or individuals can deploy Zitadel on their preferred cloud provider or install it as an on-premise solution; Both of these options allow our customers to take full control over all aspects, instead of having to rely on our infrastructure and our technical and organizational processes. Zitadel is based on cloud-native principles and is designed to be deployed as containers, which makes it straightforward to run and operate on almost any platform.

Self-hosting is a great choice if you have the resources to set up and host your own Zitadel instances on custom infrastructure with your company's needs in mind. If implemented correctly, the features of a self-hosted platform even have the potential to surpass the security possibilities of Zitadel Cloud, making it an ideal alternative for firms working with sensitive data.

The key benefits of self-hosting include:

- Manage your platform with full control in your own cloud or hardware
- Be in control of your technical and organizational measures
- Fully customizable platform
- Self-hosting organizations can get commercial technical support with an SLA
- Highest possible security, if implemented accordingly

### Cons:

The setup cost and maintenance are often downsides of self-hosting, we recommend choosing this solution if your company already possesses internal resources to handle the hosting and is ready to pay the investment and upkeep. While we at Zitadel are happy to help with any issues, “support” still needs to be considered especially around the technical aspects of self-hosting. The responsibility of adequately hosting the platform lies solely in the hands of the company.

We also tend to discourage self-hosting your identity platform without an in-depth IT-knowledge. As the security measures must be manually installed and maintained, mistakes in the implementation can potentially lead to inadequate protection from intruders.

<figure>
  <img
    src="/blog/2025-02-04-zitadelcloudvsselfhosting.png"
    width="100%"
    alt="Figure 1: Benefits of Zitadel Cloud vs. Zitadel Self-Hosted"
  />
</figure>

## Which option to choose?

While both deployment options have their respective advantages, the self-hosted alternative will most likely benefit companies that aim to fulfill some very specific requirements or compliance goals. If your organization lacks internal staff with in-depth IT knowledge, the serious dangers of faulty implementation are not worth risking. The advantages of Zitadel Cloud outweigh those of self-hosted options for most organizations and are therefore generally the recommended path to take. For easier decision-making, we created this simplistic chart as a guide:

<figure>
  <img
    src="/blog/2025-02-04-cloudselfhostdecisionchart.png"
    width="100%"
    alt="Figure 2:  Handy Reference Chart to Decide if Zitadel Cloud or Zitadel Self-Hosted is the Right Choice"
  />
</figure>

Whether you choose to use Zitadel Cloud or host Zitadel yourself, Zitadel ensures the best possible deployment experience with its flexible pricing options, comprehensive set of features, guaranteed high security, and unlimited identities for all options. In the future, you can also decide to migrate from Zitadel Cloud to hosting it yourself.

Should you have questions regarding Zitadel Cloud, self-hosting, or any other related (or unrelated) topics, feel free to contact us anytime on our Zitadel [Discord Server](https://zitadel.com/chat), our [Bluesky](https://bsky.app/profile/zitadel.bsky.social), [Twitter](https://twitter.com/zitadel), [Linkedin](https://www.linkedin.com/company/zitadel/) or [GitHub](https://github.com/zitadel/zitadel) pages, or on our [Website](https://zitadel.com/contact).

As you find the project helpful, please be sure to [give us a star over on GitHub](https://github.com/zitadel/zitadel/stargazers).


A blog post detailing the use cases that best suit a self-hosted vs. cloud model for an IAM Platform while demonstrating the flexibility offered by Zitadel

Zitadel Self-Hosted vs. Cloud: Making the Right Choice


We've developed a new TypeScript-based login system to streamline the authentication process for our customers. This solution offers a **flexible**, **customizable**, and **self-hostable** login experience.

By providing a ready-to-use login solution, we aim to reduce development time and effort for our customers. The open-source nature of the project allows for easy customization and adaptation to specific business needs.

Our immediate goal is to enable customers to self-host the login system. In the future, we plan to fully integrate this new login system into our cloud offering, providing a more robust and secure authentication experience. We plan to initiate the first cloud integration by the end of February. New customers will be automatically provisioned with the new cloud-based login. Existing customers will have the flexibility to migrate their entire instance or individual applications at their preferred time.

The new TypeScript login system offers several key improvements:

- **Leverages Modern Technology**: By utilizing our newly developed [session APIs](https://zitadel.com/docs/apis/resources/session_service_v2), we've significantly enhanced the security and performance of the authentication process.
- **Enhanced Features**: The system introduces new features such as user invitation flows and passkey-only authentication, providing greater flexibility and convenience for our users.
- **Improved Developer Experience**: The use of TypeScript, a widely adopted language in frontend development, makes the codebase more accessible and easier to contribute to. This encourages community involvement and fosters rapid development.

## Current State

Our primary goal for the TypeScript login system is to fully replace the existing login functionality within the current Zitadel version, which is shipped with Zitadel default. This will allow us to leverage the benefits of the new system, including its modular architecture and enhanced security features.

To achieve this, we are actively working on implementing the core features currently available in Zitadel, such as:

- **Authentication Methods**:
  - Username and Password
  - Passkeys
  - Multi-Factor Authentication (MFA)
  - External Identity Providers (OIDC, SAML, etc.)
- **OpenID Connect (OIDC) Compliance**: Adherence to the OIDC standard for seamless integration with various identity providers.
- **Customization**:
  - Branding options to match your organization's identity.
  - Flexible configuration settings to tailor the login experience.

The full feature list can be found [here](https://github.com/zitadel/typescript?tab=readme-ov-file#features-list).

As we continue to develop the TypeScript login system, we will provide regular updates on its progress and new capabilities.

<figure>
  <img
    src="/blog/2025-01-21-typescript-login-01.png"
    width="100%"
    alt="Login UI with authentication method loginname, Apple, Google OIDC, Google and GitLab"
  />
</figure>

## Limitations

For the first release we have excluded the following features:

- SAML 2.0 ([IdP](https://zitadel.com/docs/apis/saml/endpoints) & [SP](https://zitadel.com/docs/guides/integrate/identity-providers/mocksaml))
- [Generic JWT IDP](https://zitadel.com/docs/guides/integrate/identity-providers/jwt_idp)
- [LDAP IDP](https://zitadel.com/docs/guides/integrate/identity-providers/ldap)
- [Device Authorization Grants](https://zitadel.com/docs/guides/integrate/login/oidc/device-authorization)
- Timebased features
  - [Lockout Settings](https://zitadel.com/docs/guides/manage/console/default-settings#lockout)
  - [Password Expiry Settings](https://zitadel.com/docs/guides/manage/console/default-settings#password-expiry)
  - [Login Settings - Multifactor init prompt](https://zitadel.com/docs/guides/manage/console/default-settings#login-behavior-and-access)
  - [Force MFA on external authenticated users](https://zitadel.com/docs/guides/manage/console/default-settings#login-behavior-and-access)
- [Passkey](https://zitadel.com/docs/guides/manage/console/default-settings#passwordless)/[U2F Setup](https://zitadel.com/docs/guides/manage/console/default-settings#multifactor-mfa)
  As passkey and u2f is bound to a domain, it is important to notice, that setting up the authentication possibility in the ZITADEL management console (Self-service), will not work if the login runs on a different domain
- [Custom Login Texts](https://zitadel.com/docs/guides/manage/console/default-settings#login-interface-texts) configurations are not used in the typescript login, if you want to customize them, fork the repository and change the texts to you liking

## Beta Testing

The TypeScript login system is currently in the beta testing phase. Your feedback is highly valuable in helping us refine and improve this new solution.

At your convenience please open any issues faced on our [Typescript Login GitHub repository](https://github.com/zitadel/typescript) to report bugs or suggest enhancements while more general feedback can be shared directly to the [corresponding discord thread](https://discord.com/channels/927474939156643850/1329100936127320175/threads/1329827099606782093).
Your contributions will play a crucial role in shaping the future of our login system.
Thank you for your support!

### Steps to start testing

The simplest way to deploy the new login for yourself is by using the [“Deploy” button in our repository](https://github.com/zitadel/typescript?tab=readme-ov-file#deploy-to-vercel) to deploy the login directly to your Vercel.

1. [Create a service user (ZITADEL_SERVICE_USER_ID) with a PAT](https://zitadel.com/docs/guides/integrate/service-users/personal-access-token#create-a-service-user-with-a-pat) in your instance
2. Give the user IAM_LOGIN_CLIENT Permissions in the default settings (YOUR_DOMAIN/ui/console/instance?id=organizations)
   [https://zitadel.com/docs/guides/manage/console/managers](https://zitadel.com/docs/guides/manage/console/managers)
3. Deploy login to Vercel: You can do so, be directly clicking the “Deploy” button at the bottom of the readme in our [repository](https://github.com/zitadel/typescript)
   <figure>
     <img src="/blog/2025-01-21-typescript-login-02.png" width="100%" alt="Deploy to vercel button" />
   </figure>
4. If you have used the deploy button in the steps before, you will automatically be asked for this step. Enter the environment variables in Vercel
   - ZITADEL_SERVICE_USER_ID
   - PAT
   - ZITADEL_API_URL (Example: https://my-domain.zitadel.cloud, no trailing slash)
5. Add the domain where your login UI is hosted to the [trusted domains](https://zitadel.com/docs/apis/resources/admin/admin-service-add-instance-trusted-domain) in ZITADEL (Example: my-new-zitadel-login.vercel.app)
6. Use the new login in your application. To implement the new login, choose one of the following options:
   1. Enable the new login in your application configuration: Add the URL of your new login UI to your application’s settings. Zitadel will automatically redirect users to the new login if they attempt to use the old one.
   2. Enable the loginV2 feature on the instance:Activate the LoginV2 feature in your Zitadel instance and specify the URL of your new login. This will apply the new login for all applications configured under your Zitadel instance. Example: https://my-new-zitadel-login.vercel.app. More details: [Zitadel Documentation](https://zitadel.com/docs/apis/resources/feature_service_v2/feature-service-set-instance-features)
   3. Update the issuer URL in your application configuration: Change the issuer domain in your application configuration to match the new login domain.

For more information read our [Login V2 documentation](https://zitadel.com/docs/guides/integrate/login/hosted-login#hosted-login-version-2-beta)

## Important Notes

- **User Creation**: The new TypeScript login utilizes the Session and User V2 APIs. Note that the User V2 API introduces some changes compared to the V1 API. Ensure you create users using the new V2 API to maintain compatibility.
- **External Identity Providers (IDPs)**: To enable login with external identity providers, such as Google or Apple, follow our existing setup guides. Ensure that you use the following redirect URL: $YOUR-DOMAIN/idps/callback.
- **Passkey/U2F Authentication**: These authentication methods are domain-bound. Since your new login operates on a different domain than the previous one, existing passwordless authentication (e.g., fingerprint, Face ID) and U2F methods cannot be reused. Additionally, when managed through the Zitadel console, they will be tied to the old domain. Note: To avoid this issue, consider running the new login on a subdomain of your current instance (e.g., myinstance.zitadel.cloud and login.myinstance.zitadel.cloud).

## Customization / Feature requests

If you have specific customization needs beyond the current capabilities of the Typescript login offering, please follow one of these two options:

1. **Fork the Repository**: By forking the [Typescript Login](https://github.com/zitadel/typescript) repository on GitHub, you can directly modify the source code to implement your desired features. This offers maximum flexibility and control over the login system.
2. **Build Your Own Login UI**: For full customization control, you can leverage our Session API to build your own login interface. This allows you to create a fully tailored experience that aligns perfectly with your application's design and functionality. A detailed guide on how to use the Session API is available [here](https://zitadel.com/docs/guides/integrate/login-ui).

## Future plans

Our roadmap for the TypeScript login includes several exciting developments:

### Short-term Goals

- **Feature Parity**: We will continue to implement the missing features listed above to ensure seamless migration.
- **Multi-tenancy**: We will enable multi-tenancy to support our cloud offering, allowing new users to directly access the new login experience while existing customers can migrate at their own pace.

### Long-term Vision

- **Self-Service Components**: We plan to introduce self-service components for the users like profile management, making it easier for you to integrate these functionalities into your applications without relying on our full-fledged management console.
- **Enhanced Customization**: We will explore options to further customize the appearance of the login page, allowing you to tailor it to your specific branding and design preferences.

By focusing on these areas, we aim to provide a powerful, flexible, and customizable login solution that empowers your applications.

Now it’s your turn. Do you have any suggestions for [improvement](https://github.com/zitadel/typescript/issues/new?template=improvement.yaml) or [bug reports](https://github.com/zitadel/typescript/issues/new?template=bug.yaml)? Explore the [repository](https://github.com/zitadel/typescript) and share your feedback in our [discord thread](https://discord.com/channels/927474939156643850/1329100936127320175/threads/1329827099606782093).


We've developed a new TypeScript-based login system to streamline the authentication process for our customers.

Introducing our New TypeScript Login


In our ongoing effort to build the best identity and access management platform for the serverless era, we extend the database compatibility of our solution.
We are happy to announce that with the recent [release of version 2.3.0](https://github.com/zitadel/zitadel/releases/tag/v2.3.0) ZITADEL supports the PostgreSQL database model.

Up until now ZITADEL was only available with CockroachDB as storage.
As already noted back in our talk with CockroachDB, which you can [find on our Blog](/blog/how-we-built-it-cockroach-labs), right from the start we considered going with plain PostgreSQL as storage.
But opted for CockroachDB first for the cloud-native approach and shared-nothing architecture which gave us great benefits in running globally-scalable and zero-downtime service for customers.

Over time, however, we have received more requests from our community to provide support for alternative databases.
As many already operate or use a managed PostgreSQL database for their own services, this helps reduce the learning curve and overhead in managing different database setups.
With that we've heard your wishes and implemented PostgreSQL support for ZITADEL. It is available for self-hosting setups from today in a beta stage.

To get started checkout the [Guide in our Docs](https://zitadel.com/docs/guides/manage/self-hosted/database#postgres). Note that you need to overwrite the values of the [base configuration](https://zitadel.com/docs/guides/manage/self-hosted/configure) with these values.

As mentioned above, this is an early feature. ZITADEL has been tested against a plain-vanilla PostgreSQL database. If you run into any technical problems or performance issues, please raise an [issue over on Github](https://github.com/zitadel/zitadel) or [ask in our Discord](https://zitadel.com/chat).

We extend the database compatibility of ZITADEL with support for PostgreSQL databases in addition to CockroachDB.

You wanted PostgreSQL? We got you covered.


As a result of many months of diligent effort from our community and developers, we are thrilled to finally announce the first significant upgrade to our Identity & Access Management (IAM) platform: ZITADEL Version 2.0. Discover a new selection of features and upgrades that ensure easier use, expanded compatibility, more value for your money and as always, still the highest possible data security.

This new upgrade is a massive milestone in the product’s lifespan, bringing us a big step ahead in providing developers with the best open-source alternative for all their identity management and authentication needs.

This article briefly lists the most noteworthy changes brought on by V2.0. For further information on the update and a migration guide, check out the [Release Notes](https://github.com/zitadel/zitadel/releases/tag/v2.0.0).

<p align="center">
  <strong>We're on <a href="https://www.producthunt.com/posts/zitadel">ProductHunt</a> and <a href="https://news.ycombinator.com/">HackerNews</a> today. <br/> Thanks for all the support from our great community!</strong>
</p>

## What is ZITADEL?

The journey of ZITADEL began in 2019 when an inspired startup team envisioned creating a **developer-first, open-source approach to solving identity management**. This vision resulted in a set of engineering and design principles, ultimately leading to the release of Version 1 in late 2020.

Within these two years, ZITADEL has established itself as a unique turnkey open-source platform that offers developers unprecedented flexibility by combining the best aspects of older IAM solutions, such as the **ease of Auth0 and the versatility of Keycloak**. Thanks to its secure login, user management, multi-factor authentication, social logins, authorization management and great APIs, ZITADEL exists to provide a **safe and customizable authentication server for software products**, be it in a self-hosted or Software as a Service (SaaS) version.

Thus, with the help of ZITADEL, your organization can s**pend more time and effort in building your main product and growing your business** while your login needs are taken care of.

## What’s new?

### New Virtual Instances

The introduction of virtual instances brings another significant change to our platform. Previously, when users wanted to operate a complete ZITADEL instance in addition to single organizations, they had to **upgrade their system from a public cloud service** or self-host their ZITADEL. Version 2.0 aimed to lift this barrier by granting **every ZITADEL user their own virtual instance free of charge**. As a result, users can now fully configure their instance policies for each organization instead of relying on the ones previously predetermined by the platform.

Suppose your organization needs an additional system or two (for example, for testing and production, respectively). In that case, you have the option to run multiple isolated ZITADEL instances simultaneously that share the underlying process and infrastructure. With the help of this communal framework, users are **spared the efforts of individually configuring each additional instance**.

Beyond the previously mentioned benefits of higher convenience, customization, and reduced cost, the **possession of a ZITADEL instance comes with some additional perks**, such as:

- The ability to configure multiple custom domains (such as login.mycompany.ch) and access to a simple route if you ever need to migrate them
- The possibility to send transactional e-mails from your mail server
- Configurable notification channels (SMTP, Twillio)
- A selectable [data residency](/blog/data-residency) (Switzerland, global, or GDPR-compliant regions)
 
### Easier to Develop

Setting up a local development environment that mirrors production can be time-consuming. By **facilitating the overall process in Version 2.0**, our goal is to relieve some of the developers' burdens and **make implementing new features more straightforward**.

New features that should facilitate development:

- [Terraform provider](https://registry.terraform.io/providers/zitadel/zitadel/latest/docs) to make ZITADEL easy to use in GitOps flows
- [Helm Chart](https://github.com/zitadel/zitadel-charts) for our Kubernetes users
- Compatibility with serverless platforms, such as Knative and Google Cloud Run
- All services (Login, APIs, Assets, etc.) now run under one IP and port and are being routed through their paths
- Reworked [ZITADEL Docs](https://zitadel.com/docs/) to better reflect our users’ needs.

### Pricing Update

One of the most notable upgrades of our Cloud Service, running the Version 2.0, is the **reimagining of our cloud pricing system**. The idea behind this change is to facilitate the processes of getting started with ZITADEL and gradually expand the platform based on your organization’s specific needs.
To achieve this goal, we have decided to **remove subscription tiers and their respective feature locks altogether**.
With the help of the new **“Pay as you go”** pricing model, customers of ZITADEL are **freed from the restrictions of a predefined feature bundle**.
They can therefore experiment with much more of what ZITADEL has to offer **without hitting a paywall**.

More information on our new free features and the ZITADEL Cloud pricing model can be found in [this article](/blog/pricing-updates-v2).

### What’s next for ZITADEL?

While Version 2.0 has been a huge stepping stone in our product’s journey, in this ever-evolving digital world, the work of a platform handling sensitive data is never over. With new technological changes, enhanced security requirements, and sneakier cybercriminal tactics gradually emerging, ZITADEL must do its best to **retain its position as an innovative and highly secure open-source IAM solution**.

By constantly keeping track of the newest technological modernizations and evaluating individual feedback from its users, the team behind the platform always manages to set new goals to work towards. The following months of this year will bring an **extensive list of new features currently in development**.

**Features coming soon to ZITADEL:**

- SAML 2.0 – A new protocol alternative to OIDC
- More [Social Login options](/blog/social-logins)
- Significant improvements to the [Register Flow UX](/blog/six-ways-zitadel-will-improve-2022#3-improvements-based-on-prototype-feedbacks) based on user feedback
- Extend the database support to [Postgres](https://github.com/zitadel/zitadel/issues/3898)
- Each additional planned feature is listed on our [Roadmap](https://zitadel.com/roadmap).


As a result of many months of diligent effort from our community and developers, we are thrilled to finally announce the first significant upgrade to our Identity & Access Management (IAM) platform - ZITADEL Version 2.0.

Introducing ZITADEL Version 2.0!


One of the most common tasks when developing a software is establishing an authentication and identity management system. Whether that system only consists of a sign-up form and a login page or a more complex infrastructure, **the number one priority should always be a** **seamless functionality**: Errors in the implementation can have **catastrophic consequences**. To assure that your software is secure and working as intended, your **identity management system should be implemented and managed by experts** with in-depth knowledge on the topic.

Companies on the lookout for an authentication server have the possibility to **buy functionality from third-party identity and access management (IAM) solutions**, such as ZITADEL. Most of these vendors consist of highly qualified IT-experts who are universally entrusted to **guarantee a safe and error-free IAM system** for software products. Despite a large supply of these purchasable solutions, some firms still choose to build their own authentication server in hopes of saving money or due to distrust in pre-built applications. While a **self-developed solution** might work for some, there are various **potentially unknown drawbacks** that companies should consider before settling for this method. In this article, I will discuss the risks and disadvantages of building your own authentication server.

## Common shortcomings of self-built Authentication Servers

### 1. Security Issues

The most significant risk of building your own authentication server lies in its generally **higher probability of security issues**. Since keeping your users’ data safe is among the greatest responsibilities of a platform and the primary task of an IAM server, it is essential to make sure an adequately established security system is a given. One of the most obvious advantages IAM vendors have over DIY developers is the possession of a **dedicated team with IT and engineering expertise**. The members of these teams can utilize their knowledge to create the **best possible security system** based on their diverse experiences. Additionally, IAM vendors commonly offer **advanced security features**, such as support for multi-factor authentication (MFA) and security keys. Another security aspect where third-party IAM solutions prevail is **error prevention**: They can **prevent attacks more easily due to their large user base**, whereas a custom-made solution does not possess enough data to recognize suspicious patterns.

### 2. Not as cheap as you think

Contrary to popular belief, you will likely find that **building your own authentication server is not cheaper in the long run**. While you initially save some money by not having to purchase the solution itself, it will quickly be **compensated by the cost of development, maintenance, troubleshooting, upgrades, and the resources** themselves that are needed for these procedures. It is also worth noting, that since your main product is likely in an unrelated field to the IAM itself, the inevitable **shift in your working context would entail additional costs**. When considering a handcrafted solution, it is therefore beneficial to evaluate if the needed investments over the lifetime of your product are ultimately less than the amount you would have to pay for the one-time fee of the purchasable alternative.

### 3. Complex and Time-consuming

When creating anything from scratch, you should probably reckon with a lengthy production process. The same principle applies to developing a server; given that authentication solutions **require lots of API programming and complex security features**, fully building one might take at least a year as a full-time job. Since the server will handle sensitive data, the development of an adequately functioning security system also involves **constant testing and optimizing**, which should not be neglected to save time. The need for handcrafted features also extends to the product phases beyond the initial development: Keeping your application functional and up to date requires you to **additionally establish a maintenance system** that will serve this purpose. Purchasing an already established IAM solution would therefore likely **save you several years of time, and money spent on essential resources**.

## What you can do instead

In conclusion, even if you are an experienced programmer or your company possesses a dedicated IT-team, you will likely find that **your time and effort will be better spent developing and optimizing your main product**. Afterall, facilitating the job of software developers by not having to worry about building a dedicated authentication server on top of programming every other aspect of their application is the primary reason third-party IAM solutions exist. **Buying functionally is therefore our clear recommendation if you strive for maximized security and wish to save time and money**.

Should you be worried about being restricted by the ready-to-use features of a third-party IAM platform, **ZITADEL customers** have the possibility to choose a **self-hosted deployment option**. While this method still requires more resources compared to the software as a service alternative, it allows you to have full control over your authentication system without having to create a whole server from scratch.

## The Takeaway

If you wish to receive a pre-established IAM solution instead of having to handcraft it yourself, **ZITADEL ensures** **the best possible authentication server** with its flexible pricing options, diverse deployment options, generous range of features, guaranteed high security and unlimited identities for all instances.

Should you have questions regarding authentication servers or any other related (or unrelated) topics, feel free to contact us anytime on our ZITADEL [Discord Server](https://zitadel.com/chat). Alternatively, you can reach us on our [Twitter](https://twitter.com/zitadel), [Linkedin](https://www.linkedin.com/company/zitadel/) or [Github](https://github.com/zitadel/zitadel) pages or on our [Website](https://zitadel.com/contact).

If you like the project, don't forget to [give us a star over on GitHub](https://github.com/zitadel/zitadel/stargazers). Thanks for the support.


Despite a large supply of purchasable solutions, some firms choose to build their own authentication server. While this solution might work for some, there are various potentially unknown drawbacks that you should consider before settling for this method.

The Truth About Building Your Own Authentication Server


At ZITADEL every customer is granted **their own virtual instance with unlimited identities**, that allows them to **fully configure their instance policies**. This includes choosing a deployment option which is most suitable for the unique needs, security requirements, budget, and resources of each individual organization.

In this article, we will discuss our Software as a Service (SaaS) deployment option, alongside our self-hosted alternative to help you find the right solution for your project or business.

_We are currently working on version 2 of ZITADEL, as described in our [last Blog “A Serverless Future”](https://zitadel.com/blog/a-serverless-future). With this new version of our cloud service, customers will get their own virtual instance of ZITADEL. In the meantime we are more than welcome to provide you with a dedicated installation manually. Get in touch with us._

## Software as Service (SaaS) – For the need for convenience

Our public cloud option is ideal for any user who is intrigued by the idea of a **hosted** deployment model that is **ready-to-use** the moment you obtain it: Unlike the self-hosted alternative, SaaS is **pre-configured and automated**, thus sparing you the time and money spent on implementing, managing, and maintaining your platform. Accordingly, a virtual instance will **automatically upgrade** with new product improvements, and security fixes without your intervention.

You also do not have to worry about expanding your infrastructure when your service gains new customers or sees usage spikes. Thanks to the SaaS model of ZITADEL **both scaling and resource allocation are being handled by us**. Another notable benefit lies in the possibility of **global or regional deployment**: An infrastructure built to manage traffic from a global audience or constrain data to only a certain location, depending on your needs. Both scenarios are possible through our SaaS service, while we optimize and guarantee **low latencies and high availability**.

With the cloud service you benefit from the **operational security** aspects, such as DDoS and DNS protection. ZITADEL itself is an **open source platform** and the same open source releases are deployed to our cloud service. With that you are able to analyze and validate the code of our application. We even go beyond that and publish the results of our [penetration tests](https://zitadel.com/blog/pentest-results-h1-2021) done by external auditors, as soon as we have mitigated any issues.

Despite it excelling in terms of security and convenience, the pay-as-you-go subscription method of SaaS allows for a **relatively low total cost of ownership**.

There are certain weaknesses relying on a SaaS deployment, which are easily outweighed by the convenience of a pay-as-you-go subscription for most customers. While most customers are satisfied with our infrastructure in terms of cloud provider and data location options, some want to **choose their own infrastructure providers or data location**. In this case self-hosting is a good option or a **dedicated instance of ZITADEL**, which is operated by us with respect to the custom terms and conditions of the client. Both options are also viable in case a customer requires **more flexibility of upgrade cycles or backup frequencies**.

A newly arose weak point in today's software is supply chain risk, where our **OpenSaaS model provides extraordinary transparency** of code, dependencies, and processes, yet a customer still relies on the quality of our technical and organizational measures to manage information security. We are continuously improving our information security and working towards a ISO27001 certification by the end of this year. In case you **want to have more control over the technical and organizational measures**, you should choose to **self-host ZITADEL** and get technical support through us.

Lastly, a further weak point in the SaaS deployment method lies in its **limited customization options**. While companies mostly offer a wide variety of templates to choose from, their number can&apos;t compete with the infinite customization possibilities that come with building your own platform. We do not recommend building your own identity management system, rather we **promote the platform approach** of ZITADEL, where customers can easily extend functionality of the platform by **loosely coupling new components**. This is supported by ZITADEL&apos;s API-first approach, SDK&apos;s in various languages, and **programmatic extensibility** through ZITADEL Actions.

**The summed-up benefits of SaaS include:**

- Receive a pre-configured and implemented platform – no need to bother with updates, backups, maintenance, and troubleshooting
- Operational security provided
- Availability guarantees and automatic scaling
- “Pay as you go” model with low total cost of ownership (TCO)
- Global and region specific deployment options
- Technical support - we are here to help

## Self-hosted – For the need for full control

As the name suggests, unlike the SaaS solutions which are operated by a third-party provider, self-hosted deployment is **hosted by you** on your infrastructure. In the case of ZITADEL, companies or individuals can deploy our software on their preferred cloud provider or install it as an on-premise solution; Both of these options allow them to take **full control over all aspects of their software**, instead of having to rely on our infrastructure and our technical and organizational processes. ZITADEL is based on **cloud-native principles** and is designed to be deployed as containers, which makes it straightforward to run and operate on almost any platform.

Self-hosting is an excellent choice if you have the resources to set up and **host your own instances** of ZITADEL on **custom infrastructure** with your company's needs in mind. If implemented correctly, the features of a self-hosted platform even have the **potential to surpass the security possibilities of SaaS**, making it an ideal alternative for firms working with sensitive data. However, since the **responsibility of adequately hosting the platform lies solely in the hands of the company**, a lot more effort and risk-taking is required for the implementation and operation of the platform. To lift some of this weight off your shoulders, **ZITADEL offers self-hosters commercial technical support with an SLA**.

Since the setup cost and maintenance are the most obvious downsides of self-hosting, we recommend choosing this solution if your company **already possesses internal resources to handle the hosting** **and is ready to pay the investment and upkeep**. Should your firm struggle with some technical aspects of self-hosting, our community or our team, respectively, is happy to aid regarding any of these issues.

With this said, we strongly discourage self-hosting your identity platform without in-depth IT-knowledge; since the security measures must be manually installed and maintained, **mistakes in the implementation can potentially lead to inadequate protection from intruders**.

**The summed-up benefits of self-hosting include:**

- Manage your platform with full control in your own cloud or hardware
- Be in control of your technical and organizational measures
- Fully customizable platform
- Self-hosters can get commercial technical support with an SLA
- Highest possible security, if implemented accordingly

## Which option to choose?

In conclusion, while both deployment options have their respective advantages, the **self-hosted alternative will most likely only benefit companies that aim to fulfill some very specific requirements**. Should your organization lack an internal staff with in-depth IT knowledge, the serious dangers of faulty implementation are most likely not worth risking. Accordingly, **the advantages of SaaS outweigh those of self-hosted options for most organizations** and are therefore generally the recommended path to take. Should you be on the fence regarding your choice, we created **this chart as a guide**:

<div className="dark:hidden">
  ![](/blog/2022-04-13-saas-vs-self-hosted-01-light.png)
</div>
<div className="hidden dark:block">
  ![](/blog/2022-04-13-saas-vs-self-hosted-01-dark.png)
</div>

## The Takeaway

Whether SaaS or self-hosting is the better choice for your organization, ZITADEL ensures **the best possible deployment experience** with its flexible pricing options, generous range of features, guaranteed high security and unlimited identities for all options.

Should you have questions regarding SaaS, self-hosting or any other related (or unrelated) topics, feel free to contact us anytime on our ZITADEL [Discord Server](https://zitadel.com/chat). Alternatively, you can reach us on our [Twitter](https://twitter.com/zitadel), [Linkedin](https://www.linkedin.com/company/zitadel/) or [Github](https://github.com/zitadel/zitadel) pages or on our [Website](https://zitadel.com/contact).

If you like the project, don&apos;t forget to [give us a star over on GitHub](https://github.com/zitadel/zitadel/stargazers). Thanks for the support.


We discuss our Software as a Service (SaaS) deployment option alongside our self-hosted alternative to help you find the right implementation for your business.

SaaS vs Self-hosted – How to Choose the Right Deployment Option


Ever since we have officially launched our IAM-Platform in May of 2021, we have had the pleasure to serve hundreds of customers, who have put their trust in us. As a company that always strives for innovation in an ever-changing digital world, our biggest goal is to provide our customers with the best possible user-experience and the most value for their money by constantly keeping ZITADEL up-to-date: In this article, we describe 6 great upgrades coming soon to our platform, that help making this goal a reality.

## 1. More social login options

Whether Google, Microsoft, or Apple ID - Most of us have already used some of our social identities to facilitate sign-ups on third-party applications and websites. This login method not only saves valuable time by not requiring the completion of a registration form, but also spares you the effort of remembering yet another password. This year ZITADEL will strive to **heavily expand the number of its Identity Providers**, assuring its users a comfortable login via their preferred social identity. Whereas thus far, ZITADEL has exclusively supported OIDC compliant providers, this restriction will soon be completely removed in order to provide a wider range of options.

A list of social identity providers soon available on ZITADEL:

- Apple ID
- Microsoft Live
- Github
- Gitlab
- Microsoft Tenants (AzureAD)

… And hopefully many more to come!

## 2. SAML 2.0 - New protocol alternative

In 2021, ZITADEL officially implemented **OpenID Connect (OIDC)**, a highly accessible authentication protocol, excellently suited for HTML5/JavaScript applications. Despite it being an ideal choice in terms of user-friendliness, scalability, and lightweight handling, as a new protocol, OIDC has yet to evolve in terms of establishing a more complex security system.

To allow our users the choice of a viable alternative, we are planning to **additionally introduce the other adopted industry standard for authentication, SAML 2.0** (Security Assertion Markup Language). Like OIDC, SAML allows a service provider to delegate the authentication and authorization of users wishing to access it, to a central authentication server (identity provider). Both standards are utilized in various SSO solutions, however, SAML is universally more trusted in enterprise- and government-scale activities due to its age.

This new, simultaneous access to both protocols will give you more options on which method of authentication you want to use. To enjoy the benefits of both standards to their fullest, you also have the possibility to adopt a **hybrid usage**: Since the **two protocols serve different purposes**, the standards can diverge between each of your applications. For instance, while OIDC is the ideal choice for mobile-centered apps, SAML finds its primary implementation in web programs, where complex identity data is required. Whichever features you prioritize; the range of possibilities is wider than ever!

## 3. Improvements based on prototype feedbacks

The key to ensuring a highly accessible and frictionless user experience is to **focus on satisfying the audience**. To achieve this goal, it is essential to have the audience **test and evaluate the product first-hand**: This method is called prototyping. Ideally, every new iteration of the product (or in this case: website) should be reviewed by diverse members of the user-base and optimized accordingly. After all: Evaluating prototypes can spark new ideas for future innovations.

In December of 2021, we invited a group of users (aged 16-44) of varying digital-affinities, to test the registration flow, including the existing 2-Factor-Authentication of ZITADEL. Upon carefully reviewing every feedback, we could identify some common user pain points that are impairing the authorization experience. For this reason, in 2022 we will **improve the registration process by implementing the following changes**:

- Ensuring higher accessibility by removing exclusionary language (Technical jargon).
- Providing support for users with help and information texts.
- Adding “passwordless” as a registration method - no more passwords needed.
- Clearing user flow where next actions are clearly highlighted.
- A new, optimized user interface for the existing management website.
- Smaller optimizations of buttons and descriptions, minimizing possible confusion.

## 4. Accessible and exportable Usage Metrics

As a platform working with sensitive data, it is especially important for ZITADEL to be constantly improved to meet tomorrow's increasing standards. With the help of usage metrics, we are able to continuously measure the platform's effectiveness and thus rapidly identify and fix potential inefficiencies. These metrics are **not only excellent tools of risk reduction, but also help us improve operational quality**, thus keeping ZITADEL sustainable.

In 2022, we will **display the most important usage metrics together with useful business metrics in our Console**. Such metrics are shown as a sequence of data points over an interval of time, and include:

- Number of active users
- Number of successful vs. unsuccessful login attempts
- Number of new registrations

Additionally we will improve reporting capabilities, thus making **data more easily readable and exportable for your administrators**. One example of such a report is a list of users for a given organization. With the new reporting capabilities you can add a column showing whether a user has enabled 2FA, filter that column by users who have not yet enabled 2FA and export the values to a structured data format.

## 5. Your own instance - New customized domain and data location

At ZITADEL, we strongly believe that security features should not cost extra. Accordingly, all our tiers include unlimited IAM resources and all required security features. So far, when you wanted to operate a complete ZITADEL instance, and not only single organizations, our customers had to **upgrade from a public cloud service to a dedicated ZITADEL instance** or self-host their ZITADEL; therewith only customers of dedicated ZITADEL could enjoy the benefits of complete autonomy over where this system is operated, on which domain it runs, when it should be updated and which default settings should be stored. Whereas this upgrade granted our customers some notable privileges over those potentially constrained by the limitations that come with a shared system, **this advantage will no longer be a feature you have to pay for**.

In 2022, we will launch an **upgrade to every subscription-tier**, that gives you the maximum value for your money: Not only will every subscriber, regardless of their tier, be **granted a virtual instance**, you will now be able **fully configure your own instance policies for each of your organizations** instead of relying on the ones previously predetermined by ZITADEL.

**The benefits of this change include:**

- **A domain that's yours only** - now you can let users login on subdomain such as login.mycompany.ch
- Send transactional emails from your own Mail server
- Choose where your data is stored and processed - whether Switzerland, Europe or global GDPR compliant regions, the location is yours to pick.

In view of these major upgrades that will be made available for every subscription-tier, you might be wondering what further benefits a higher tier could provide. Alongside more customization possibilities, which are already a given, subscribers of our **STANDARD** and **ADVANCED plans** will receive **dedicated private instance**, completely independent from a shared system: Not only will a private instance grant you data isolation from those of other customers, it will also supply **more deployment options regarding infrastructure providers** (such as Azure, AWS and Scaleway) and a wider selection of **data regions**.

## 6. It will be easier to develop ZITADEL

Building a local development environment that mirrors production can be a truly time-consuming workflow. In 2022, we are planning to introduce some significant improvements that should lift some weight off of developers shoulders, by **facilitating the overall process**; implementing new features will soon be easier than ever!

**Following new changes will facilitate the development process:**

- Quickstart will be made possible by executing a single command that will automatically run every asset which was formerly needed to be launched manually (including CockroachDB).
- The ZITADEL binary will be provided for different operating systems and architectures in addition to container images.
- By soon making our product roadmap publicly accessible, you will be able to gain an insight into the features we are planning to implement, as well as the ones currently in development.
- The Documentation will be enhanced with new guides and the decision making will be made public.

## The takeaway

As we have entered a new year, we would once again like to thank you for having put your trust in ZITADEL in 2021. Hopefully, we can successfully express our gratitude to our loyal customers by always improving our platform to make it the best it can be. The team is looking forward to another successful year and we hope to hear your opinion on our new changes!

Should you have questions regarding these improvements or any other related (or unrelated) topics, feel free to contact us anytime on our ZITADEL [Discord Server](https://zitadel.com/chat). Alternatively, you can reach us on our [Twitter](https://twitter.com/zitadel) (btw. our new handle is just zitadel), [Linkedin](https://www.linkedin.com/company/zitadel/) or [Github](https://github.com/zitadel/zitadel) pages or on our [website](https://zitadel.com/).


In this article, we describe 6 great upgrades coming soon to our platform, that help making this goal a reality.

All posts/ #self_hosting