Overview

ZITADEL is an open-source identity and access management platform built for teams that need more than basic authentication. It provides hardened identity infrastructure as a turnkey solution, handling everything from user registration and password management to complex multi-tenant authorization with role-based access control (RBAC). ZITADEL is written in Go and designed for high security, featuring FIPS 140-3 compliance and a strong emphasis on cryptographic best practices.

ZITADEL’s unique architecture is built on event sourcing and Command Query Responsibility Segregation (CQRS), providing a complete audit trail of every identity event — user creation, permission changes, failed logins, and more. This makes it exceptionally well-suited for regulated environments and organizations that need a tamper-proof history of identity operations. It exposes both a gRPC and a REST API, and ships with a modern Angular-based administration console.

Key Features

• Event-Sourced Architecture: Complete, immutable audit log of every identity event with CQRS-based read and write separation.
• Multi-Tenancy: Native organization and project hierarchy for B2B and B2C scenarios with isolated user directories.
• OpenID Connect & OAuth 2.0: Full OIDC provider with support for all grant types, including device authorization and token exchange.
• SAML 2.0: Support for SAML 2.0 in addition to modern OIDC, bridging legacy and modern applications.
• Passkeys & FIDO2: Passwordless authentication with WebAuthn passkeys, including hardware security key support.
• FIPS 140-3: Government-grade cryptographic module compliance for regulated industries.
• SCIM 2.0: Standardized user provisioning API for integrating with HR systems and downstream applications.
• RBAC & Custom Claims: Role-based access control with customizable claims and permission inheritance per organization.

Use Cases

• B2B SaaS platforms requiring multi-tenant identity with organization-level isolation.
• Regulated industries needing FIPS 140-3 compliance and immutable audit trails.
• Building custom authentication infrastructure with fine-grained RBAC and custom claims.
• Replacing commercial solutions like Auth0 or Firebase Auth with a self-hosted alternative.

Platforms

Linux, Docker, Kubernetes (also available as a cloud-managed service)

Licence

AGPL-3.0 (open source)

Website

zitadel.com | github.com/zitadel/zitadel