Zitadel
| License | FOSS problems | Maintenance | SSO | Users | Tested |
|---|---|---|---|---|---|
| AGPL-3.0 | Single-vendor dual-licensed (AGPL or paid commercial) | Active | ✅ | Unlimited | ❌ |
Description
Zitadel is a Go-based, multi-tenant identity platform positioned as an open-source Auth0 alternative — a single binary plus PostgreSQL, with an event-sourced architecture that gives every auth/authz state change an immutable audit log by default, not as bolted-on logging.
Features
- OIDC, SAML, SCIM, MFA, FIDO2/passkeys — all included in the free self-hosted Community Edition, no MAU limits.
- Multi-tenancy — built for B2B SaaS use cases (multiple organizations under one deployment), more than this project needs but not something you pay extra to get.
- Lightweight — ~100MB RAM, single Go binary, closer to Rauthy's footprint than Keycloak's.
Usage patterns
Same central-SSO role as the rest of this catalog. The multi-tenancy is the one genuinely distinct capability — irrelevant for a single-user/single-org setup like this project's, relevant if ever managing identity for multiple separate organizations from one deployment.
License and governance
Changed from Apache-2.0 to AGPL-3.0 in 2025 — core/backend/console/hosted-login are AGPL, while API/proto/SDK layers stay Apache-2.0 specifically to avoid AGPL's copyleft reaching client code. A commercial license is available as a paid alternative to the AGPL terms (single-vendor dual-licensing), though notably no CLA — contributions are accepted under Apache-2.0 rather than requiring contributors to assign rights the way a CLA would. Worth distinguishing from Nextcloud/CiviCRM's CLA-based dual-licensing in this same catalog — a real difference, not just wording.
Conclusion
Why you would — lightweight like Rauthy, but with a more complete feature set and a genuinely useful built-in audit trail, without Keycloak's resource overhead.
Why you wouldn't — the 2025 AGPL relicensing is recent enough that its practical implications (community reaction, any impact on the ecosystem around it) are still settling; and the single-vendor dual-license model means the company's own commercial incentives shape the project's direction more directly than a foundation-governed option like Keycloak. See Setup for the actual deploy attempt and known open questions.
Sources: Zitadel self-hosted, Zitadel: Moving to AGPL 3.0, Zitadel Licensing FAQs