DOCSEARCHbyAlgolia
Submit Docs

ZITADEL Documentation

website·Indexed 35 days ago

https://zitadel.com/docs

Identity infrastructure for developers providing a hardened, extensible turnkey solution for authentication. Documentation includes deployment options, key concepts, engineering principles, and integration guides for various frameworks including Next.js, React, Go, Java Spring Boot, and Python (Django, FastAPI, Flask), as well as support for standard OIDC and OAuth2 libraries.

Tokens
259.7K
Snippets
1.4K
Records
2.3K
Agent score
71%

What's inside ZITADEL

  1. Overview of ZITADEL APIs

    ZITADEL provides several APIs accessible via gRPC and REST to interact with its functionality programmatically. The APIs are categorized by their purpose:

    • Auth API: Used by authenticated users for account-related tasks. It uses the user's own token (based on the sub claim) and does not require a service account.
    • Management API: Used by organization administrators for administrative tasks.
    • Admin API: Used for instance-level administrative functions.
    • System API: Available only for self-hosted deployments for superordinate control; it cannot be accessed by service accounts and requires specific settings.

  2. Overview of ZITADEL Actions

    ZITADEL Actions allow developers to programmatically react to specific events within the Identity and Access Management system using custom JavaScript scripts. These scripts are executed based on specific triggers called Flows, enabling customizations such as modifying tokens, calling external APIs during login, or altering authentication flows.

  3. Overview of the Zitadel PHP Management API Client

    The Zitadel PHP Client is an official library for programmatically managing resources (e.g., users, projects, settings) in a Zitadel instance via the v2 Management APIs.

    Important Constraints:

    • Management Only: This is a Management API Client, not an Authentication SDK. It is designed for server-to-server communication and should not be used for end-user login flows. For user authentication, use a standard OIDC library.
    • Incubation Stage: The library is currently incubating; APIs may evolve and introduce breaking changes. Use caution in production environments.

  4. Overview of ZITADEL Custom Domains

    ZITADEL Custom Domains allow organizations to personalize the authentication experience by replacing the default ZITADEL domain with their own domain name (e.g., login.example.com or auth.companyname.com). This ensures brand identity is maintained throughout the authentication process, increasing user trust and providing a seamless experience.

  5. Overview of Zitadel SCIM v2.0 implementation

    Zitadel provides a SCIM v2.0 service provider interface to standardize the management of instance resources, facilitating automated user provisioning and deprovisioning. The base URL for the SCIM endpoint is https://${CUSTOM_DOMAIN}/scim/v2/{orgId}.

  6. Overview of Passkeys and Passwordless Authentication in ZITADEL

    ZITADEL supports passwordless authentication using Passkeys, which leverage public-key cryptography based on FIDO2 and WebAuthn standards. Instead of passwords, users authenticate using device-native biometrics (fingerprint, Face ID) or PINs. This provides a phishing-resistant login experience that is platform-agnostic across supporting devices.

  8. Overview of the Zitadel Java Client

    The Zitadel Java Client is an official Management API Client for the JVM (Java 11+) used for server-to-server communication to programmatically manage Zitadel resources (e.g., creating users, managing projects, and updating settings).

    Important Note: This is a Management API Client, not an Authentication SDK. It is not intended for handling end-user login flows; for user authentication, use a standard OIDC library like Spring Security. The library is currently in an incubating stage and may introduce breaking changes.

  9. Overview of ZITADEL Actions Function Manipulation

    ZITADEL Actions allow you to define a target (an external HTTP endpoint) that is triggered when a specific ZITADEL function is executed. This is primarily used for integrating external systems, adding custom claims to OIDC/SAML tokens, or modifying user metadata during authentication flows.

  10. Overview of ZITADEL user login methods

    End users can authenticate with ZITADEL using three primary methods:

    1. Local Accounts: Using username, password, MFA, or Passkeys.
    2. Social Login: Using providers like Google, Apple, or GitHub.
    3. External Identity Providers (IdP): Organization-managed providers such as Entra ID, LDAP, or Okta.

  12. Overview of the ZITADEL Login App

    The ZITADEL Login app is a Next.js application that replaces the legacy Golang embedded login. It implements the OIDC standard by proxying requests to the ZITADEL backend and utilizing the session API. The app supports both OIDC-context authentication and direct user authentication for self-service account management. It uses branding, policies, and settings defined at the instance or organization level.