DOCSEARCHbyAlgolia
Submit Docs

ZITADEL Documentation

website·Indexed 35 days ago

https://docs.zitadel.com/

ZITADEL is an identity infrastructure for developers providing a hardened, extensible turnkey solution for authentication. The documentation covers deployment options, key concepts, engineering principles, and integration guides for various frameworks including Next.js, React, Go, Java Spring Boot, and Python (Django, FastAPI, Flask), as well as support for standard OIDC and OAuth2 libraries.

Tokens
257.1K
Snippets
1.3K
Records
2.2K
Agent score
60%

What's inside ZITADEL

  1. Overview of ZITADEL Service Accounts

    Service accounts in ZITADEL represent non-human entities used for secure machine-to-machine communication, such as backend services or applications interacting with APIs. Unlike human users, they do not use traditional login methods (username/password). When combined with Administrator permissions, they are used to manage ZITADEL resources via its APIs.

  2. Overview of ZITADEL Caching

    ZITADEL provides a built-in caching mechanism to speed up the lookup of frequently needed objects for internal business logic (e.g., instance information in middleware). Unlike HTTP caches, ZITADEL's cache uses active invalidation when an object is updated. This feature is currently in experimental beta.

  3. Overview of the Zitadel Node.js Management API Client

    The Zitadel Node.js Client is an official package for Node.js (20+) that provides idiomatic access to Zitadel's v2 Management APIs. It is designed for server-to-server communication to manage resources (e.g., creating users, managing projects, updating settings).

    Important: This is a Management API Client, not an Authentication SDK. It is not intended for handling end-user login flows; for user authentication, use a standard OIDC library.

    Note: This library is currently in an incubating stage and may introduce breaking changes.

  4. Overview of the Zitadel Ruby Client

    The Zitadel Ruby Client is an official Management API Client for Ruby (3.1+) designed for server-to-server communication to manage Zitadel resources (e.g., creating users, managing projects).

    Important: This is a Management API Client, not an Authentication SDK. It is not intended for end-user login flows; for user authentication, use a standard OIDC library.

    Note: This library is currently in an incubating stage and may introduce breaking changes.

  5. Overview of ZITADEL Actions

    ZITADEL Actions allow you to define targets (webhooks) that are called when specific functions are triggered within your ZITADEL instance. This is primarily used to integrate with external systems, execute custom code during OIDC or SAML flows, or inject specific claims into tokens.

  6. Overview of the ZITADEL Login App

    The ZITADEL Login app is a Next.js-based implementation that replaces the legacy Golang embedded login. It implements the OIDC standard by proxying requests to the ZITADEL backend and utilizing the session API. The app supports both OIDC-context authentication and direct user self-service (account management without an OIDC flow). It uses branding, policies, and settings defined at the instance or organization level.

  7. Overview of User Roles in ZITADEL

    ZITADEL distinguishes between two types of roles:

    1. Application-specific roles: Custom roles defined by the developer (e.g., admin, accountant, employee).
    2. ZITADEL-specific manager roles: Built-in administrator roles used for platform management (e.g., IAM_OWNER, ORG_OWNER, PROJECT_OWNER).

    Role assignments (also referred to as authorizations or user grants) pair these roles with users or service accounts.

  8. Overview of ZITADEL JWT Identity Provider (JWT IdP)

    A JWT Identity Provider (JWT IdP) allows ZITADEL to accept a JSON Web Token (JWT) issued and signed by an external system as proof that a user has already been authenticated. ZITADEL does not perform the authentication itself but relies on the validity of the provided JWT. This is primarily used for silent SSO between legacy applications and new applications managed by ZITADEL, or when federating with systems that can issue JWTs but are not full OpenID Connect providers.

  9. Overview of ZITADEL Actions v2

    ZITADEL Actions v2 allows developers to modify ZITADEL's behavior on specific API calls, events, or functions to meet custom business requirements not supported out-of-the-box. Common use cases include domain-specific data validation during user creation, automating role assignments based on external groups (e.g., ADFS 2016+), storing custom metadata for application integration, and restricting registration based on email domains.

  10. Overview of ZITADEL Actions

    The Action API allows you to customize and extend ZITADEL by defining targets and executions. This enables custom workflows triggered by API requests, responses, events, or specific functions. Common use cases include automating user provisioning to external systems, implementing IP blocking/rate limiting, setting up application resources upon organization creation, and adding custom claims to tokens.

  11. Overview of Domain Discovery in ZITADEL

    Domain discovery allows ZITADEL to route users to specific organizations based on their login identifier (typically an email address). This is primarily used in B2B or SaaS scenarios where different customers (organizations) require different authentication methods, such as routing users with @alpha.com to an organization using an external Identity Provider (IdP) and users with @beta.com to an organization requiring MFA and passwords.

  12. Overview of ZITADEL Actions for function manipulation

    ZITADEL Actions allow you to enhance instance functionality by creating targets (external HTTP endpoints) that are triggered when specific functions are executed. This is primarily used for integrating external systems, adding custom claims to tokens, or executing external code during OIDC or SAML flows.