ZITADEL

A cloud-native open-source Identity and Access Management platform built in Go. ZITADEL features event-sourced architecture for complete audit trails, a Terraform provider for GitOps identity management, and a multi-tenant Organization model ideal for B2B SaaS — available self-hosted or as a managed cloud service.

What is ZITADEL?

ZITADEL is a modern alternative to Keycloak and Auth0, designed for cloud-native and Kubernetes-first environments. Written in Go, it starts in seconds and uses significantly less memory than Java-based IAM platforms. The event-sourced data model means every state change produces an immutable event — your audit log is built-in, not bolted on.

For B2B SaaS, ZITADEL's Organization model is its killer feature: each of your enterprise customers gets their own org with independent SSO configuration, branding, and user management. Your app receives the customer's org ID in every token, making tenant isolation trivial to implement.

Quick Start (Docker)

# ZITADEL — self-hosted with PostgreSQL
docker run --rm -d   --name zitadel   -p 8080:8080   -e ZITADEL_MASTERKEY="MasterkeyNeedsToHave32Characters"   -e ZITADEL_DATABASE_POSTGRES_HOST=postgres   -e ZITADEL_DATABASE_POSTGRES_PORT=5432   -e ZITADEL_DATABASE_POSTGRES_DATABASE=zitadel   -e ZITADEL_DATABASE_POSTGRES_USER_USERNAME=zitadel   -e ZITADEL_DATABASE_POSTGRES_USER_PASSWORD=zitadel   -e ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE=disable   -e ZITADEL_EXTERNALDOMAIN=localhost   ghcr.io/zitadel/zitadel:latest start-from-init

# Admin UI: http://localhost:8080
# First-time setup wizard included

React SPA — PKCE Flow

// PKCE Authorization Code Flow (React SPA)
import { ZITADELAuth } from '@zitadel/react';

const zitadel = ZITADELAuth({
  issuer: 'https://issuer.zitadel.cloud', // or your self-hosted instance
  clientId: 'your-client-id',
  redirectUri: 'https://app.example.com/callback',
  scope: 'openid profile email',
});

// Trigger login
await zitadel.authorize();

// Get user info
const userInfo = await zitadel.userInfo();

Node.js JWT Validation

// Node.js backend — validate ZITADEL JWT
import { createRemoteJWKSet, jwtVerify } from 'jose';

const JWKS = createRemoteJWKSet(
  new URL('https://issuer.zitadel.cloud/oauth/v2/keys')
);

async function validateToken(token: string) {
  const { payload } = await jwtVerify(token, JWKS, {
    issuer: 'https://issuer.zitadel.cloud',
    audience: 'your-api-resource-id',
  });

  // payload.sub = user ID
  // payload['urn:zitadel:iam:org:project:roles'] = role map
  return payload;
}

// Express middleware
app.use(async (req, res, next) => {
  const token = req.headers.authorization?.split(' ')[1];
  if (!token) return res.status(401).json({ error: 'Unauthorized' });
  req.user = await validateToken(token);
  next();
});

Terraform Provider

# ZITADEL Terraform Provider — Infrastructure as Code
terraform {
  required_providers {
    zitadel = {
      source  = "zitadel/zitadel"
      version = "~> 2.0"
    }
  }
}

provider "zitadel" {
  domain           = "issuer.zitadel.cloud"
  insecure         = false
  port             = "443"
  jwt_profile_file = "service-account.json"
}

resource "zitadel_project" "my_project" {
  name   = "My App"
  org_id = data.zitadel_org.default.id
  project_role_assertion        = true
  project_role_check            = true
  has_project_check             = true
}

resource "zitadel_application_oidc" "spa" {
  project_id              = zitadel_project.my_project.id
  org_id                  = data.zitadel_org.default.id
  name                    = "SPA"
  redirect_uris           = ["https://app.example.com/callback"]
  response_types          = ["OIDC_RESPONSE_TYPE_CODE"]
  grant_types             = ["OIDC_GRANT_TYPE_AUTHORIZATION_CODE"]
  app_type                = "OIDC_APP_TYPE_USER_AGENT"
  auth_method_type        = "OIDC_AUTH_METHOD_TYPE_NONE"  # PKCE
  dev_mode                = false
}