Zitadel

Teams outgrow simple authentication the moment they start selling to other companies. ZITADEL is an open source identity and access management platform built for that point, giving SaaS products, B2B platforms and self-hosted stacks single sign on, MFA, passkeys, OIDC, SAML, SCIM and a multi-tenancy model in one deployment.

The architecture pairs a relational core with an event-driven design where every mutation is written as an immutable event, so the audit trail is a complete stream you can read through the API or push to outside systems with webhooks. Tenancy runs from the identity system down to organizations and projects, with isolated data and policy scoping at each level.

Everything the platform does is reachable over a typed interface.

• API-first surface: every resource and action is exposed over connectRPC, gRPC and HTTP JSON APIs.
• Authentication breadth: passkeys, OTP by app, email or SMS, LDAP, social and enterprise identity providers, and machine to machine flows.
• Actions: webhooks and custom code enrich tokens or run at defined points in a flow.
• Provisioning: a SCIM 2.0 server and role retrieval cover onboarding and authorization for enterprise customers.
• Self-service: registration with email and phone verification, an administration console, and branding set per organization.

Self-hosting runs on PostgreSQL 14 or newer and installs through Docker Compose or Kubernetes, with zero-downtime updates and no external session store to scale horizontally. The hosted service runs the same codebase, so moving between the two is not a change of product.