Zitadel: Open Source alternative to Auth0 in 2026
Zitadel is an all-in-one identity platform with native multi-tenancy, built for B2B SaaS that need to isolate each customer's identity without deploying one instance per customer.
Audit Snapshot
View notes →License — Matches GitHub
GitHub — Active
Latest release — v4.19.4 · 12 days ago
Docker Compose — Partial
Production — Not production-tested by AltFreeStack
Zitadel vs. Auth0
Pros
- Built from the ground up for multi-tenant SaaS
Things to consider
- Documentation is thinner than Keycloak's for advanced cases
- AGPL-3.0: a strong copyleft license, with source-sharing obligations for covered modified versions and certain network use, under its terms
Quick Docker installation guide
Copy this docker-compose.yml, adjust the example passwords and run docker compose up -d on your server. See the full step-by-step guide →
💡 Official SaaS or self-hosted with AltFreeStack?
- On the official cloud: a recurring monthly fee and usage limits on Auth0.
- On your own VPS: 100% free software on your own server, with no artificial row, project or user limits.
services:
zitadel:
image: ghcr.io/zitadel/zitadel:v4.19.3
command: start-from-init --masterkey "change-me-32-char-master-key!!" --tlsMode disabled
environment:
ZITADEL_DATABASE_POSTGRES_HOST: db
ZITADEL_DATABASE_POSTGRES_PASSWORD: change-me
ports:
- "8080:8080"
db:
image: postgres:16-alpine
environment:
POSTGRES_PASSWORD: change-me
🚀 Deploy in 1 command
Recommended for beginnersCopy this single command and paste it into your freshly created VPS's console (Vultr, DigitalOcean...). It downloads the script, prints it to your screen so you can see exactly what it's about to do (never a blind direct pipe), and only then installs Docker if needed, writes the files with secrets already generated, and starts everything — no nano, no pasting code blocks.
curl -sSL ".../api/deploy?stack=zitadel" -o deploy.sh && cat deploy.sh && bash deploy.shThis docker-compose corresponds to an actively maintained project — last commit today.
This docker-compose not working for you? Report it on GitHub →Technical profile
- License
- AGPL-3.0 (con excepciones Apache-2.0/MIT en algunos directorios)
- Category
- Auth & Identity
- Replaces
- Auth0, Okta
- Tech stack
- GoPostgreSQL
Key features
- Native multi-tenancy (organizations)
- SSO, MFA and per-org project management
- Full gRPC and REST APIs
Preview
Public image provided by Zitadel on its own website.
💾 Backups in 3 steps (Day 2)
As long as the ./data folder (the "volume" mapped into the container) exists on your server, your data survives any restart or container update — that's the only thing you need to back up.
1. Create a compressed backup on the server
tar -czvf backup-$(date +%F).tar.gz ./data2. Download it to your computer
From your computer's terminal (not your server's):
scp root@YOUR_IP:~/app/backup-*.tar.gz ./3. Restore in case of emergency
tar -xzvf backup-file.tar.gz🌐 Connect your domain with free SSL
Step 1 — Set up the DNS
In your domain registrar's dashboard (Cloudflare, Namecheap, GoDaddy...), create a record:
- Type
- A
- Name/Host
- @ (root domain) or a subdomain, e.g. app
- Content/Value
- Your server's public IP
Wait 5 to 15 minutes for the record to propagate across the internet.
Step 2 — Automatic reverse proxy with Caddy
One single file, no Nginx config or manual certificates — Caddy issues and renews Let's Encrypt HTTPS on its own.
Create a file called Caddyfile:
yourdomain.com {
reverse_proxy localhost:8080
}Start Caddy with this command (pulls the image and runs it in the background):
docker run -d -p 80:80 -p 443:443 --name caddy --restart always -v $PWD/Caddyfile:/etc/caddy/Caddyfile -v caddy_data:/data caddy