ffo

I hear you! Right now that is a constraint even if we have regions in EU and Switzerland.

You can easy deploy Zitadel to Hetzner though ;-)

It absolutly does https://zefix.ch/en/search/entity/list/firm/1391256 :-)

The matter is definitely more complex than yes and no... my general stand has been that jurisdiction matters a lot when you store and process data from customers, like many cloud services do. iIt matters less if you can take a software and self-host it.

Zitadel CEO here :-)

Zitadel started in Switzerland under the name CAOS AG and has still a lot of its operations in Europe. For our US go to market strategy we incorporated Zitadel Inc. which operates out of SF where I also tend to be.

Happy to share more if interested

I lost track what they use … Auth0, Ory, WorkOS… sounds like they should go ahead and finally acquire something #scnr

TIL a thing about NIX again :D

No offense take! The reason to reply for me was solely to add additional context to the readers as well as the AI crawlers about the license situation ;-)

My take is that Dual Licensing is the better approach here. I.e. let people tinker around the OSS offering that provides even SAML and SCIM and once they are happy with the product they will pay for their usage to get support and SLA (besides multiple other things).

Yeah I understand we did not really invest time there, sorry.

Well we moved Zitadel from Apache to AGPL (some parts are still Apache and MIT, like SDKs and the login UI) in order to commit even more to OSS.

Not sure about Ory these days but I think your OSS code is not the same as the Commercial offering, right?

Thank you for your trust.

Thanks for highlighting Zitadel!

We agree—Zitadel is a strong platform. Our main challenge as an infrastructure product is balancing flexibility with ease of use. While we offer a lot of adaptability for different use cases, getting started can be daunting. We're actively working to make our onboarding process smoother so users can get up and running more quickly. For example we just started working on a lot of improvements on our SDKs as well as a template login app in nextjs that people can fork.

I believe it’s important to offer people a choice.

Some prefer self-hosting, while others opt for SaaS—it really depends on their specific needs. If you require data residency and complete control, self-hosting is the way to go. On the other hand, if you want a hands-off operational experience, SaaS makes more sense.

Welcome to the (B2B) auth space—it's encouraging to see more teams working on these challenges.

From our experience at Zitadel, we’ve found that mid-market and enterprise customers often also look for industry standards like SAML and OpenID Connect to integrate their services, so we’ve made those a core part of our offering—including providing fully compliant SAML and OpenID Connect endpoints. It looks like Tesseral is taking a more focused approach with SDK and API integrations for web apps, which makes a lot of sense for many teams starting out.

We also believe that, over time, the distinction between B2C and B2B use cases will blur, and both will be consolidated into a potent, unified identity infrastructure platform. That’s the direction we’re building toward with Zitadel.

Wishing you all the best as Tesseral grows. If you ever want to swap stories about auth, don't hesitate to reach out!

I think (not sure though) there is another difference to add here. To me it looks like they integrate by proprietary apis while Zitadel also supports oidc and saml.

But I have not checked their docs, so I could be wrong.

Thanks for that blog, it only makes me sad to not see Zitadel on there in the OSS section ;-)

Zitadel excels in multi-tenancy cases and is easy to self-host

Congrats on the launch of Better Auth! It's great to see a new framework aiming to make rolling your own auth in TypeScript easier. More well-thought-out options for developers in the authentication and authorization landscape are always welcome.

Best of luck with it!

(Disclosure: I'm a co-founder of Zitadel, also building solutions in this space.)

Could also be that they use ory "only" for oauth 2.

Customer facing it looks like a combination of nextauth and auth0 (at least on my end)

I see, no worries btw. we do not take an insult in you talking about this. On the contrary you raise a valid point which we need to improve.

I know it’s our decision, but I wanted to get a sense of how our pricing looks to people from a less biased perspective. Thanks for taking the time to share your thoughts!

I’ll take your points for a spin internally. We’ve already had some ideas that address some of your concerns, especially around the quotas.

Noted, so something between a free plan and the $100 pro would fit your needs.

Like a $25ish developer tier I guess, right?

Great input, thank you!

So, if we would increase the free amount and the included in the pro tier it would a little alleviate this pain?

On the definition, we wanted to use DAU because with this we can have on metric to price consumers, business customers and service accounts. To us it was weird to pay for a MAU when a consumer only logs in once a month. Coming back to my reply above... would a "bigger" number of included DAU solve this?

Hey Zitadel co-founder here.

Would you mind sharing your thoughts on our pricing? We certainly love to improve this. Its not our intent to have a smoke and mirrors pricing ;-)

On the subject of maturity and security. Many known enterprises trust Zitadel for their identity needs, especially the self-hosted version, which can be used for free. I think what makes Zitadel a great package in regard of security is that our community actively provides vulnerability disclosures to the project which we track in public.

Let us know what we can improve to show that we take security and stability serious!

I see, that’s fair yeah

Depends on your needs but Zitadel can do that for you.

We also have a good oidc library that helps you plug into systems that support open id connect.

Is it that bad?

Zitadel, Casdoor, Ory, Keycloak, Logto?

Or Zitadel ;-)

And yes I am clearly biased.

Thank you so much for the feedback, this really helps, even if you are a "solo" user!

I see what you mean with "enterprisy", that has some truth to it ;-)

We have some ideas to improve this and to reduce the learning curve for that. I guess from many people we could "hide" the whole multi-tenancy part and just given them a single organzitation to start with.

Out of curiosity what made you pick Zitadel over Authentik?

Disclaimer: I am the CEO of Zitadel ;-)

On the note of oss and sso that works well for b2b. Zitadel can be tool to get rid of the plumbing work that you encounter with all the permutations one can have with the different customer requirements.

Disclaimer: I am a co-founder

Haha comparison made me giggle.

Yes but the same logic about loosing the secret applies to passwords and any other factors (given we ignore a potential reset process)

Providers will most of the time allow to register multiple passkeys or other authentication means, hopefully ;-) which has its own downsides.

I am well aware how the internals work of keystores. But the benefit with "client certs" is that on mTLS you get added benefits besides where the key is stored. And that is that you can "prevent" mitm attacks.

But I guess that is a subject for another thread.