ZITADEL

ZITADEL is an open source identity and access management platform built for teams that need more than basic authentication. It provides SSO, MFA, passkeys, OIDC, SAML, and SCIM out of the box, with a multi-tenancy model designed for B2B products, and the same codebase runs both the managed cloud service and self-hosted deployments. The project also exposes a typed API for every capability, so creating a user or configuring a policy can be scripted the same way in production as it is explored in the docs. Compared against FusionAuth, Keycloak, and Auth0/Okta in its own README, ZITADEL specifically calls out infrastructure-level tenant isolation and a full event-sourced audit trail as differentiators for teams building multi-tenant B2B products.

Key features

• Passkeys and MFA: Supports FIDO2/WebAuthn passkeys alongside OTP via app, email, and SMS.
• Native multi-tenancy: A strict hierarchy of Identity System, Organizations, and Projects with isolated data and policy scoping at each level.
• Event-sourced audit trail: Every mutation is written as an immutable event, giving a comprehensive, API-accessible audit log rather than selective logging.
• API-first design: Every resource and action is available through gRPC, connectRPC, and REST APIs.
• Actions and webhooks: Run custom code or token enrichment logic in response to events without forking the platform.
• B2B onboarding: Customizable, self-service onboarding flows for organizations, with delegated role management to third parties.
• Zero-downtime updates: Built for horizontal scaling and updates without external session stores.

Self-hosting and deployment

ZITADEL Self-Hosted can be running in under three minutes using Docker Compose: download the compose file and the example env file, copy it to .env, then run docker compose up -d --wait. Kubernetes deployment guides are also available for production setups, along with documentation covering zero-downtime updates and horizontal scaling once an instance is live. ZITADEL Cloud offers a free tier with no credit card required, available in the US, EU, AU, and CH regions, and runs the same codebase as the self-hosted version so behavior stays consistent across both. Teams that need contracted support for a self-hosted deployment can also reach the ZITADEL team directly, which the project positions as an option for production instances rather than only community support channels like Discord.

Getting started

The V2 REST API accepts a straightforward JSON payload to create a user, for example a POST to /v2/users/human with an email, given name, and family name. The same operations are also available over connectRPC and gRPC for teams that prefer typed clients over REST, and the quickstart guide walks through generating credentials and making a first authenticated call end to end. SDKs and example apps are also published for common languages and frameworks, so most quickstarts don't require writing raw HTTP calls by hand.