Why choose ZITADEL over Authentik or Keycloak?
ZITADEL occupies a precise niche in the open-source authentication platform ecosystem. Unlike Authelia (authentication proxy without its own user management) or Authentik (feature-rich full-stack IdP), ZITADEL is tailored for development teams that need enterprise-grade IAM from day one: native multi-tenancy, complete gRPC + REST APIs, official Terraform provider.
Its main advantage over Keycloak: lightweight footprint. ZITADEL consumes under 100 MB of RAM at idle, whereas Keycloak rarely starts under 512 MB — a decisive argument for entry-level VPS.
Prerequisites
- A ServOrbit VPS (2 vCPU / 2 GB RAM recommended, Ubuntu 24.04)
- A domain or subdomain pointing to the VPS IP (or the free ServOrbit subdomain)
- ⚠️ The domain must be configured BEFORE installation: ZITADEL locks its OIDC
issuerat first boot — it can no longer be changed afterwards
Install ZITADEL from the Marketplace
Installation in 3 steps
Create the VPS
From your ServOrbit client area, choose the VPS range and click Configure. In the Application field, select ZITADEL. Enter your domain (e.g.
auth.yoursite.com).If you do not have a domain, the free ServOrbit subdomain is available immediately — HTTPS included.
Automatic startup
The installation script automatically generates the
MASTERKEY(AES-256 key), PostgreSQL password and admin password, then launches PostgreSQL 16 and ZITADEL via Docker Compose. Typical duration: 2 to 4 minutes.Access the console
Once installation is complete, your credentials are displayed in the client area.
- URL:https://<your-domain>/ui/console
- Username:admin
- Password: the generated passwordLog in and start by changing your password.
Create your first OIDC application
Once logged in to the ZITADEL console:
1. Go to Projects → Create
2. Name your project (e.g. My App)
3. Click Add Application
4. Choose the type: Web (for server-side apps), Native (mobile/desktop) or API (machine-to-machine)
5. For a Web app, choose PKCE (recommended) and enter your Redirect URIs
ZITADEL automatically generates the Client ID. Note the discovery endpoint: https://<your-domain>/.well-known/openid-configuration.
Integrate ZITADEL with your self-hosted applications
ZITADEL integrates natively with all applications that support OIDC. Common integration examples:
- Gitea: OAuth2 → Authentication → add OAuth2 source → enter Client ID/Secret + discovery endpoint
- Grafana:
[auth.generic_oauth]ingrafana.iniwith the ZITADEL discovery endpoint - Nextcloud:
Social LoginorOpenID Connect user backendplugin - n8n:
N8N_AUTH_*environment variables pointing to the ZITADEL IdP
Multi-tenant management: organisations and projects
One of ZITADEL's strengths is its native multi-tenant model. You can create multiple Organisations (e.g. each customer of your SaaS), each with its own users, groups and security policies.
Each organisation can have its own Projects and custom Roles. JWT tokens automatically include the user's roles in the organisation.
Tip: enable passkeys from the start
In the ZITADEL instance settings, enable Passkey/WebAuthn authentication. Your users can authenticate without a password from their browser — a far superior experience to classic passwords.
Install ZITADEL via the ServOrbit Marketplace
You can install ZITADEL directly from the [ServOrbit Marketplace](/marketplace/security/zitadel): VPS pre-configured with Docker Compose, nginx, HTTPS and secrets generated automatically. No shell commands required.
