Repository: zitadel/zitadel
Stars: 13547
.cursorrules
Cursor Rules for ZITADEL
You are working in the ZITADEL monorepo.
ALWAYS read AGENTS.md files in this order:
1. Root AGENTS.md
2. The nearest scoped AGENTS.md for the files you are changing
If you touch Go code or run Go tooling, inspect go.mod first for the required Go version/toolchain.
Use verified Nx targets only. If a target is unclear or missing, run pnpm nx show project <project>.
- Root Context: AGENTS.md
- API App: apps/api/AGENTS.md
- Login App: apps/login/AGENTS.md
- Docs Site: apps/docs/AGENTS.md
- Management Console: console/AGENTS.md
- Backend Internal: internal/AGENTS.md
- Proto Definitions: proto/AGENTS.md
- Shared Packages: packages/AGENTS.md
- Functional UI Tests: tests/functional-ui/AGENTS.md
README.md
<p align="center">
<img src="./apps/docs/public/img/logos/[email protected]#gh-light-mode-only" alt="ZITADEL Logo" max-height="200px" width="auto" />
<img src="./apps/docs/public/img/logos/[email protected]#gh-dark-mode-only" alt="ZITADEL Logo" max-height="200px" width="auto" />
</p>
<p align="center">
<a href="https://vscode.dev/redirect?url=vscode://ms-vscode-remote.remote-containers/cloneInVolume?url=https://github.com/zitadel/zitadel" alt="Open in Dev Container">
<img src="https://img.shields.io/static/v1?label=Dev%20Containers&message=Open&color=blue" /></a>
<a href="https://github.com/zitadel/zitadel/blob/main/LICENSE" alt="License">
<img src="https://badgen.net/github/license/zitadel/zitadel/" /></a>
<a href="https://bestpractices.coreinfrastructure.org/projects/6662">
<img src="https://bestpractices.coreinfrastructure.org/projects/6662/badge"></a>
<a href="https://github.com/semantic-release/semantic-release" alt="semantic-release">
<img src="https://img.shields.io/badge/%20%20%F0%9F%93%A6%F0%9F%9A%80-semantic--release-e10079.svg" /></a>
<a href="https://github.com/zitadel/zitadel/actions" alt="ZITADEL Release">
<img alt="GitHub Workflow Status (with event)" src="https://img.shields.io/github/actions/workflow/status/zitadel/zitadel/build.yml?event=pull_request"></a>
<a href="https://zitadel.com/docs/support/software-release-cycles-support" alt="Release">
<img src="https://badgen.net/github/release/zitadel/zitadel/stable" /></a>
<a href="https://goreportcard.com/report/github.com/zitadel/zitadel" alt="Go Report Card">
<img src="https://goreportcard.com/badge/github.com/zitadel/zitadel" /></a>
<a href="https://codecov.io/gh/zitadel/zitadel" alt="Code Coverage">
<img src="https://codecov.io/gh/zitadel/zitadel/branch/main/graph/badge.svg" /></a>
<a href="https://github.com/zitadel/zitadel/graphs/contributors" alt="Contributors">
<img alt="GitHub contributors" src="https://img.shields.io/github/contributors/zitadel/zitadel"></a>
<a href="https://discord.gg/YgjEuJzZ3x" alt="Discord Chat">
<img src="https://badgen.net/discord/online-members/YgjEuJzZ3x" /></a>
</p>
<p align="center">
<a href="https://openid.net/certification/#OPs" alt="OpenID Connect Certified">
<img src="./apps/docs/public/img/logos/oidc-cert.png" /></a>
</p>
The Identity Infrastructure for Developers
ZITADEL is an open-source identity and access management platform built for teams that need more than basic auth. Whether you're securing a SaaS product, building a B2B platform, or self-hosting a production IAM stack — ZITADEL gives you everything out of the box: SSO, MFA, Passkeys, OIDC, SAML, SCIM, and a battle-tested multi-tenancy model.
No vendor lock-in. No compromise on control. Just a robust, API-first identity platform you can own.
---
🏡 Website | 💬 Chat | 📋 Docs | 🧑💻 Blog | 📞 Contact
---
Why ZITADEL
We built ZITADEL to handle the hardest IAM challenges at scale — starting with multi-tenancy.
| | ZITADEL | FusionAuth | Keycloak | Auth0/Okta |
|---|---|---|---|---|
| Open-source | ✅ | ❌ | ✅ | ❌ |
| Self-hostable | ✅ | ✅ | ✅ | ❌ |
| Infrastructure-level tenants | ✅ Instances (High scale) | ✅ Tenants | 🟡 Realms (Scaling limits) | ❌ (Multi-tenant = multi-account) |
| B2B Organizations | ✅ Native & Unlimited | 🟡 via Entity Management | ✅ (Recent addition) | 🟡 (Plan/Account dependent) |
| Full audit trail | ✅ Comprehensive Event Stream* | 🟡 Audit logs | 🟡 Audit logs | 🟡 Audit logs |
| Passkeys (FIDO2) | ✅ | ✅ | ✅ | ✅ |
| Actions / webhooks | ✅ | ✅ | 🟡 via SPI | ✅ |
| API-first (gRPC + REST) | ✅ | 🟡 REST only | 🟡 REST only | 🟡 REST only |
| SaaS + self-host parity | ✅ | ✅ | ➖ N/A | ➖ N/A |
ZITADEL Cloud and self-hosted ZITADEL run the same codebase.
Key differentiators for architects:
- Relational core, event-driven soul — every mutation is written as an immutable event for a complete, API-accessible audit trail. Unlike systems that log only select activities, ZITADEL provides a comprehensive event stream that can be audited or streamed to external systems via Webhooks.
- Strict multi-tenant hierarchy — Identity System → Organizations → Projects, with isolated data and policy scoping at multiple levels
- API-first design — every resource and action is available via connectRPC, gRPC, and HTTP/JSON APIs
- Zero-downtime updates and horizontal scalability without external session stores
---
Get Started in 3 Minutes
ZITADEL Self-Hosted
Docker Compose — up and running in under 3 minutes
curl -LO https://raw.githubusercontent.com/zitadel/zitadel/main/deploy/compose/docker-compose.yml \
&& curl -LO https://raw.githubusercontent.com/zitadel/zitadel/main/deploy/compose/.env.example \
&& cp .env.example .env \
&& docker compose up -d --waitFull deployment guides:
- Docker Compose
- Kubernetes
Need professional support for your self-hosted deployment? Contact us.
ZITADEL Cloud (SaaS)
Start for free at zitadel.com — no credit card required. Available in US · EU · AU · CH. Pay-as-you-go pricing.
---
Integrate with the V2 API
ZITADEL exposes every capability over a typed API. Here's how to create a user with the V2 REST API:
curl -X POST https://$ZITADEL_DOMAIN/v2/users/human \
-H "Authorization: Bearer $ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"username": "[email protected]",
"profile": { "givenName": "Alice", "familyName": "Smith" },
"email": { "email": "[email protected]", "sendCode": {} }
}'Explore the full API reference — including connectRPC and gRPC transports — or jump straight to quickstart examples.
---
Features
Authentication
- Single Sign On (SSO) · Username/Password · Passkeys (FIDO2 / WebAuthn)
- MFA: OTP, U2F, OTP Email, OTP SMS
- LDAP · Enterprise IdPs and social logins
- OpenID Connect certified · SAML 2.0 · Device authorization
- Machine-to-machine: JWT Profile, PAT, Client Credentials
- Token exchange and impersonation
- Custom sessions for flows beyond OIDC/SAML
- Hosted Login V2
Multi-Tenancy
- Identity brokering with pre-built IdP templates
- Customizable B2B onboarding with self-service for customers
- Delegated role management to third parties
- Domain discovery
Integration
- gRPC, connectRPC, and REST APIs for every resource
- Actions: webhooks, custom code, token enrichment
- RBAC · SCIM 2.0 Server
- Audit log and SOC/SIEM integration
- SDKs and example apps
Self-Service & Admin
- Self-registration with email/phone verification
- Administration Console for orgs and projects
- Custom branding per organization
Deployment
- PostgreSQL (≥ 14) · Zero-downtime updates · High scalability
Track upcoming features on our roadmap and follow our changelog for recent updates.
---
Showcase
Login V2
Our new, fully customizable login experience — documentation
---
Adopters & Ecosystem
Used in production by organizations worldwide. See the full Adopters list — and add yours by submitting a pull request.
- SDKs: All supported languages and frameworks
- Examples: Clone and use our examples
---
How To Contribute
ZITADEL is built in the open and welcoming to contributions of all kinds.
- 📖 Read the Contribution Guide to get started
- 💬 Join the conversation on Discord
- 🐛 Report bugs or request features via GitHub Issues
Contributors
<a href="https://github.com/zitadel/zitadel/graphs/contributors">
<img src="https://contrib.rocks/image?repo=zitadel/zitadel" />
</a>
Made with contrib.rocks.
---
Security
Security policy: SECURITY.md
Vulnerability Disclosure Policy — how to responsibly report security issues.
Technical Advisories are published for major issues that could impact security or stability in production.
License
AGPL-3.0 — see LICENSING.md for the full licensing policy, including Apache 2.0 and MIT exceptions for specific directories.