Zitadel vs authentik: which open-source identity provider fits?

Zitadel and authentik are two of the most popular open-source identity providers, and they often end up on the same shortlist. They come from different directions: Zitadel is built for SaaS products that serve many customer organizations, with a managed cloud; authentik is built for securing a company's or a homelab's own apps, including ones that only speak LDAP, RADIUS or nothing at all. This comparison uses each project's documentation and pricing as of October 2026.

At a glance

License

This is often the deciding factor.

• Zitadel moved from Apache-2.0 to AGPL-3.0 with version 3 (announced March 2025, released May 2025). If you modify Zitadel and let users interact with it over a network, you must offer them your modified source. The login app and the client packages are MIT, so customizing the login UI doesn't trigger that. Zitadel sells a commercial license with Enterprise.
• authentik's core is MIT, which is about as permissive as it gets. Code in the authentik/enterprise/ directory is under authentik's Enterprise license: free for development and testing, but production use needs a subscription.

Teams that can't accept AGPL usually rule out Zitadel here; teams that can't run code under a commercial license usually just leave authentik's enterprise features off.

Pricing, and how Zitadel counts users

Zitadel Cloud is free for 100 daily active users and US$100 per month on Pro with 25,000 DAU included; Enterprise is custom-priced and can run on your own infrastructure. The fine print matters: Zitadel adds up the daily active user count of every day in the month. So 25,000 DAU is not 25,000 people: 1,000 employees who sign in every workday already use about 22,000. Zitadel doesn't publish a price for going over on its pricing page. Self-hosting the AGPL code is free.

authentik has no hosted version. The open-source edition is free, with community support only. Enterprise is $5 per user per month and $0.02 per external user per month, billed yearly, and adds features such as WS-Federation, Chrome device trust, mutual TLS and enhanced audit logging; Enterprise Plus starts at $20,000 a year.

For a workforce of 200 people, that's about $12,000 a year for authentik Enterprise, or a Zitadel Pro subscription if 200 people's daily sign-ins fit in 25,000 a month (they usually do).

Protocols and apps

Both are OpenID Connect and SAML identity providers, so modern web apps work with either.

The difference is the long tail. authentik's outposts let it act as an LDAP server, a RADIUS server, an authenticating reverse proxy for apps with no login of their own, and a remote access gateway (RDP, SSH, VNC). That's why it's popular in homelabs and for internal tools. Zitadel's documentation covers LDAP only as an upstream identity provider (Zitadel binds to your LDAP server to sign users in) and doesn't cover RADIUS or proxy authentication.

Multi-tenancy

Here Zitadel leads. A Zitadel instance holds many organizations, each with its own users, branding, login policy and identity providers, and project grants let a customer organization assign your app's roles to its own users. That maps directly onto B2B SaaS: each customer is an organization with self-service administration.

authentik's brands change the look and settings per domain, but applications, providers and users are shared. Real tenancy (a separate database schema per tenant) is an Enterprise feature that authentik marks as alpha.

Customization

• Zitadel Actions v2 call your own HTTP endpoints at defined points (before or after API requests, at function hooks, or when events happen), so custom logic lives in a service you write in any language.
• authentik flows and stages describe login, enrollment and recovery as configurable steps in the admin UI, and expression policies run Python inside authentik for custom decisions. It's very flexible, but anyone who can edit policies can run code on the server.

Running it yourself

• Zitadel: the API server (Go) and the login app (Next.js) as two containers, plus PostgreSQL. Everything is stored as events, which gives a complete audit history; the event store grows over time.
• authentik: a server and a worker container plus PostgreSQL; the Docker Compose guide asks for at least 2 CPU cores and 2 GB of RAM. Since 2025.10 it no longer needs Redis, but uses more PostgreSQL connections.

Which to choose

• Choose Zitadel if you're building multi-tenant B2B SaaS, want a managed cloud from the maintainers, and AGPL-3.0 (or a commercial license) is acceptable.
• Choose authentik if you're securing your own organization's apps, including legacy ones that need LDAP, RADIUS or a login proxy, and you're happy to self-host.

A third option: Casdoor

If you want parts of both, Casdoor is worth a look:

• Apache-2.0, with no separately licensed enterprise directory.
• Organizations for multi-tenant B2B, each with its own users, roles, identity providers and admins, like Zitadel.
• LDAP and RADIUS servers built in, plus forward authentication for reverse proxies, like authentik, and CAS for older apps.
• A managed cloud with a dedicated instance per customer, $24/month billed yearly, with no per-user or daily-active-user fees, or free to self-host on MySQL, PostgreSQL, SQLite and other databases.

Compare it directly with Zitadel and authentik, or see the four-way Casdoor vs Keycloak vs authentik vs Zitadel.

FAQ

Is Zitadel still open source? Yes. AGPL-3.0 is an OSI-approved open-source license; it just requires sharing modifications with network users. Versions before 3.0 were Apache-2.0.

Is authentik free? The open-source edition is free with no user limit. Enterprise features, such as WS-Federation and tenancy, need a paid license in production.

How much does Zitadel cost? Zitadel Cloud is free for 100 daily active users and $100 per month on Pro with 25,000 DAU, counted as the sum of each day's active users over the month. Enterprise is custom-priced. Self-hosting is free under AGPL-3.0.

Which is easier to self-host? Both need PostgreSQL and a couple of containers. authentik has more moving parts when you add outposts for LDAP, RADIUS or the proxy; Zitadel needs the API and login containers.