ZITADEL

Use it when

• Your B2B SaaS needs SSO, SAML, MFA, and passkeys but you do not want Auth0 or Okta pricing and lock-in, and you want to self host the identity stack.
• You need strict per-organization tenant isolation and delegated role management for customer orgs, with every identity mutation available as an auditable event stream over an API.

What it solves

Not the fit when

• AGPL-3.0 licensed; review LICENSING.md before embedding in proprietary distributions
• requires PostgreSQL 14 or newer
• network-level access control or VPN duties
• lightweight per-app auth where a library like passport or authjs suffices
• The copied `.env.example` contains explicitly insecure local-development defaults; before any network exposure, replace ZITADEL_MASTERKEY, POSTGRES_ADMIN_PASSWORD, and POSTGRES_ZITADEL_PASSWORD and configure the external domain, TLS, and trusted-proxy boundary.
• ZITADEL's organization hierarchy scopes identity resources; it does not by itself enforce tenant_id filters or prevent cross-tenant row leaks in the downstream application's data store.
• reverse proxy ssl setup
• api gateway rate limiting
• secrets vault storage
• network tunnel access control

Install

curl -LO https://raw.githubusercontent.com/zitadel/zitadel/main/deploy/compose/docker-compose.yml && curl -LO https://raw.githubusercontent.com/zitadel/zitadel/main/deploy/compose/.env.example && cp .env.example .env && docker compose up -d --wait

Invoke

curl -X POST https://$ZITADEL_DOMAIN/v2/users/human -H "Authorization: Bearer $ACCESS_TOKEN" -H "Content-Type: application/json" -d '{"username": "alice@example.com", "profile": {"givenName": "Alice", "familyName": "Smith"}, "email": {"email": "alice@example.com", "sendCode": {}}}'

Alternatives

No reviewed alternatives recorded yet.