Skip to content

Self-host Zitadel

updated Jul 2026prices checked · Aug 2026Install verified on Ubuntu 26.04 · Aug 2026 · how we test

A cloud-native, open-source identity and access management platform — OIDC, SAML, and passwordless auth with multi-tenancy built in, a self-hostable alternative to Auth0 and Okta.

Auth0 / yr$420
Self-hosted / yr~$55
You keep$365/yr
Pocket the difference — spin it up on a cheap VPS in minutes.Start free on Kamatera → (opens in new tab)

Key facts

CategorySSO & Identity
LicenseAGPL-3.0
StackGo
Min RAM1024 MB
Dockeryes
Difficulty
Our recommendation

Choose Zitadel when you want a modern, API-first identity platform — passwordless and multi-tenant from the ground up, often described as "a modern Keycloak". It's a strong fit for building auth into your own products. Note it's AGPL-licensed; if that's a problem for your organisation, authentik (MIT core) or Keycloak (Apache-2.0) avoid it.

What you need

  • Any VPS with at least 1024 MB of RAM
  • A domain you control — most self-hosted setups need HTTPS in front of them
  • About the better part of a day

Install

Run these commands on your server:

# Zitadel — official docker-compose quickstart
curl -LO https://raw.githubusercontent.com/zitadel/zitadel/main/deploy/compose/docker-compose.yml
curl -LO https://raw.githubusercontent.com/zitadel/zitadel/main/deploy/compose/.env.example && cp .env.example .env
docker compose up -d --wait
vps picksBest VPS for self-hostingbenchmarked quarterly · re-priced monthly

What you take on

Zitadel is modern and capable, with two things worth checking before you adopt it:

non-negotiableIt's AGPL-3.0. The licence carries network-copyleft obligations that some companies won't accept — confirm it's compatible with your use before you build on it.
non-negotiableIt needs its database. Zitadel is event-sourced on Postgres — give it a real database and back it up; it is the source of truth for every identity.
non-negotiableThe ecosystem is younger. It's newer than Keycloak, so there are fewer third-party guides and integrations — strong docs, but you'll blaze a few trails.

An alternative to

Auth0 →

Head-to-head

SSOAug 2026
Zitadel
vs
authentik

Two modern IdPs, built for different jobs.

Read the verdict →
SSOAug 2026
Zitadel
vs
Keycloak

The JVM incumbent vs. a modern, lighter Go alternative.

Read the verdict →

More in SSO & Identity

SSO & Identity

Authelia

A lightweight, open-source authentication and authorization server providing 2FA and SSO via a forward-auth portal in front of your reverse proxy — a self-hosted gatekeeper for existing apps, not a full identity provider.
Go
moderateRead guide →
SSO & Identity

authentik

An open-source identity provider supporting SAML, OAuth2/OIDC, and LDAP — a flexible, self-hostable alternative to Auth0, Okta, and Azure AD with a visual flow-based login builder.
PythonGoTypeScript
moderateRead guide →
SSO & Identity

Keycloak

A mature, enterprise-grade open-source identity and access management server — SSO, SAML, and OpenID Connect with user federation, built on Quarkus and backed by Red Hat.
JavaQuarkus
hardRead guide →
SSO & Identity

Pocket ID

A simple, self-hostable OIDC provider that lets users sign in to your apps with passkeys only — no passwords, built for small self-hosted setups that just need lightweight SSO.
GoSvelteKit
easyRead guide →

We use analytics cookies (Google Analytics, PostHog) to see which guides are useful. No ad networks, no cross-site tracking. See our privacy policy.