● Beta — KubeEra is in active development. Profiles are live; AI-perception measurement is rolling out.
KubeEra
Z

Zitadel

Provisioning & Security
Open source · AGPL-3.0

ZITADEL is an open-source identity and access management (IAM) platform — OAuth2/OIDC, SAML, passwordless auth, MFA, user management, and multi-tenancy out of the box.

updated 2026-07-01

What it is

ZITADEL is an open-source identity and access management (IAM) platform — OAuth2/OIDC, SAML, passwordless auth, MFA, user management, and multi-tenancy out of the box. It's positioned here under "Provisioning" but functionally it's an auth/identity server: think of it as a self-hostable alternative to Auth0, Okta, or Keycloak, written in Go with a gRPC/REST API core and event-sourced (CQRS/event sourcing) architecture underneath.

It ships as a single binary or container, backed by PostgreSQL or CockroachDB, and supports both self-hosted and managed cloud deployment.

Who builds it and why

Founded date isn't publicly available, but the project is backed by ZITADEL the company (Swiss-based), which runs a commercial managed cloud offering alongside the open-source core. 258 contributors and active commits through mid-2026 indicate a real engineering team plus external contributions, not a single-vendor side project. The open-core model — free self-hosted AGPL version, paid managed/enterprise tiers — is the typical funding structure for this kind of infrastructure project, similar to how Keycloak (Red Hat) and Ory operate.

Production readiness signal

  • 14,258 GitHub stars, 258 contributors — healthy community size for an IAM tool, though smaller than Keycloak's ecosystem.
  • Active commit cadence through 2026 — not abandoned, actively maintained.
  • v4.15.3 as latest release — major version 4 suggests the project has been through multiple breaking-change cycles and has matured its API surface.
  • CNCF maturity: not publicly available — ZITADEL is not a CNCF project, so there's no sandbox/incubation/graduation signal to lean on. You're relying on GitHub activity and vendor backing alone.
  • AGPL-3.0 license — copyleft. This matters operationally: if you modify ZITADEL and offer it as a network service, AGPL obligates you to release those modifications. Legal should sign off before this goes into any product you resell.

No public SLA or uptime data for the managed offering is available here — verify directly with ZITADEL before committing production traffic to their cloud.

Who should use this

  • Teams that need a full IAM/auth system (login, MFA, SSO, user lifecycle) and don't want to build it on raw OIDC libraries.
  • Organizations that want self-hosted control over identity data — regulated industries, EU data residency requirements (ZITADEL's Swiss/EU hosting angle is a real differentiator).
  • Go-native shops comfortable operating a Postgres/CockroachDB-backed stateful service.
  • Teams that outgrew a bolted-on auth library (Passport.js, Devise) and need multi-tenant, multi-org identity management.

Who should NOT use this

  • Teams already invested in Keycloak or Okta with no active pain point. Migrating IAM systems is high-risk, high-blast-radius work — don't do it without a concrete driver.
  • Anyone allergic to AGPL. If your legal team blocks copyleft licenses outright, this is a non-starter for embedding in commercial products.
  • Small teams without ops capacity for a stateful, database-backed identity system. Auth is not the place to run degraded infrastructure — if you can't commit to proper backups, monitoring, and on-call for this service, use the managed cloud tier or a hosted competitor instead.
  • Teams needing SAML-heavy legacy enterprise integrations at deep maturity. ZITADEL supports SAML, but Keycloak and commercial IdPs have longer track records in gnarly enterprise SSO edge cases.

Alternatives

  • Keycloak — older, larger community, CNCF-adjacent ecosystem, Java/JVM stack; the default "boring choice" for self-hosted IAM.
  • Auth0 / Okta — fully managed, mature enterprise features, but vendor lock-in and per-MAU pricing that scales expensively.
  • Ory (Kratos/Hydra) — more modular, unbundled identity primitives if you want to compose your own stack rather than take an all-in-one server.

Pricing

Core ZITADEL is fully open source under AGPL-3.0 — self-host for free. ZITADEL Cloud (managed) is a separate commercial offering with its own pricing tiers; exact pricing not publicly available here — check zitadel.com directly for current rates.

Frequently asked

What is Zitadel?+
ZITADEL is an open-source identity and access management (IAM) platform — OAuth2/OIDC, SAML, passwordless auth, MFA, user management, and multi-tenancy out of the box.
Who builds Zitadel?+
Founded date isn't publicly available, but the project is backed by ZITADEL the company (Swiss-based), which runs a commercial managed cloud offering alongside the open-source core.
Is Zitadel production ready?+
14,258 GitHub stars, 258 contributors — healthy community size for an IAM tool, though smaller than Keycloak's ecosystem. Active commit cadence through 2026 — not abandoned, actively maintained. v4.15.
Who should use Zitadel?+
Teams that need a full IAM/auth system (login, MFA, SSO, user lifecycle) and don't want to build it on raw OIDC libraries. Organizations that want self-hosted control over identity data — regulated industries, EU data residency requirements (ZITADEL's Swiss/EU hosting angle is a real differentiator).
Who should not use Zitadel?+
Teams already invested in Keycloak or Okta with no active pain point. Migrating IAM systems is high-risk, high-blast-radius work — don't do it without a concrete driver. Anyone allergic to AGPL. If your legal team blocks copyleft licenses outright, this is a non-starter for embedding in commercial products.
What are the alternatives to Zitadel?+
Keycloak — older, larger community, CNCF-adjacent ecosystem, Java/JVM stack; the default "boring choice" for self-hosted IAM. Auth0 / Okta — fully managed, mature enterprise features, but vendor lock-in and per-MAU pricing that scales expensively.
How much does Zitadel cost?+
Core ZITADEL is fully open source under AGPL-3.0 — self-host for free. ZITADEL Cloud (managed) is a separate commercial offering with its own pricing tiers; exact pricing not publicly available here — check zitadel.com directly for current rates.