Zitadel
Passkeys-first, multi-tenant identity in one stateless Go binary - the lightest full IdP in the catalogue.
One-click deploy, from $13/mo on a Miget plan.
Zitadel is the newest generation of identity server: passkeys as a first-class login method, multi-tenant organizations baked into the data model (each B2B customer gets an org with its own users, policies, and branding), and custom logic via JS actions - all in a single stateless Go binary that idles around half a gigabyte.
The deployment is the cleanest in the identity lane: one container plus the managed Postgres, fully env-configured, with the masterkey as the only generated secret. The one sharp edge is flagged loudly: the external domain is baked into instance data at first setup - set the final domain before the first deploy.
For B2B SaaS builders the comparison is Okta and WorkOS: $6/user/month with a $1,500 annual minimum on one side, $125/month per SSO connection on the other. Zitadel ships SSO connections and orgs as ordinary features of a $13/month stack.
Upstream project: Zitadel
#what you get
- Passkeys-first login, plus OIDC, OAuth2, and SAML
- Multi-tenant organizations - built for B2B SaaS
- JS actions for custom claims, hooks, and logic
- Single stateless binary: all state in managed Postgres
- Self-service org onboarding and branding per tenant
- AGPL-3.0 (since v3) - unmodified self-hosting unaffected
#topology
| Service | Role | Public |
|---|---|---|
| zitadel | identity server (:5000) | yes |
| db | Postgres - managed service on Miget, container locally | no |
#miget sizing
// this stack needs
2 GiB RAM · 5 GB disk · 2 services
Upstream quotes ~512 MB for the binary; 1 GiB gives password-hashing bursts room. Everything persistent lives in the managed Postgres - the container is disposable.
Hobby - recommended fit
$13/mo
1 vCPU · 2 GiB · 50 GiB disk
Headroom for your own apps: 2 GiB at $19/mo
Professional - production
$22/mo
1 vCPU · 2 GiB · 10 GiB disk
Dedicated resources, production SLOs - plan details
One Miget plan is a fixed pool of compute - the whole stack (managed databases included) deploys inside it, and anything left over runs your other apps. No per-service or per-seat math.
#vs. the managed service
What the hosted equivalents charge, against the flat Miget plan this stack fits on. Prices as of June 2026, sources linked.
| Service | Plan | Monthly | What you get |
|---|---|---|---|
| Zitadel on Miget ★ | 2 GiB plan | $13 | this whole stack, flat - no usage meters, and room left for your own apps |
| Okta | Starter Suite | ~$60 | $6/user/mo at 10 users; $1,500/year minimum contract |
| WorkOS | SSO connections | ~$125 | per SSO connection per month - each B2B customer with SSO is a new line item |
Zitadel models each B2B customer as an organization with its own SSO config - unlimited orgs and connections on the flat plan.
#vs. other PaaS
Estimated monthly cost of running this exact stack (2 GiB RAM, 5 GB disk, 2 containers) elsewhere, from published June 2026 rates.
| Platform | Est. monthly | Notes |
|---|---|---|
| Miget ★ | $13 flat | compose stacks first-class: one deploy, dedicated vCPU, managed Postgres/Valkey, volumes and TLS all included in the plan |
| Heroku | ~$100 | no volumes; nothing between 1 GB ($50) and 2.5 GB ($250) dynos - 2 GB containers cost far more than shown |
| DO App Platform | ~$29 | no persistent volumes - stateful containers need managed DBs/Spaces (base $5 Spaces included here) |
| Render | ~$26 | per-service instances (0.5 GB $7, 2 GB $25) - every container is its own paid service |
| Railway | ~$21 | usage-based ($10/GB RAM-mo); vCPU billed separately at $20/vCPU-mo on top |
| Fly.io | ~$13 | cheapest sticker price - but burstable shared CPUs (1/16 core; dedicated vCPUs cost ~2-3×), no compose deploys (one app per container, manual wiring), managed DBs billed extra |
Estimates assume RAM fully allocated at published on-demand rates - and sticker price isn't the whole comparison: the cheaper rows buy burstable shared CPUs, per-service wiring instead of a compose deploy, and managed databases billed separately. Heroku and DO App Platform have no persistent volumes at all - stateful stacks like this one need workarounds there.
#deploy it
On Miget
- Create a Compose Stack in app.miget.com pointing at the templates repository
- Set the stack path to
zitadel -
Set the required variables:
ZITADEL_MASTERKEY, exactly 32 charactersZITADEL_EXTERNALDOMAIN (+PORT=443, SECURE=true), the FINAL domain, set before first deploy - it is baked into instance data
- Deploy. Miget layers
compose.miget.yaml(RAM, privacy, volumes, managed services) automatically
Locally first?
Every template is portable, vanilla Docker Compose - the Miget overrides are ignored locally:
git clone https://github.com/deployable-sh/stacks
cd miget-compose-templates/zitadel
docker compose up -dSame files, same behavior. The template README covers connection strings and scaling notes.
#faq
Zitadel, authentik, or Keycloak?
Zitadel for passkeys-first UX, B2B multi-tenancy, and the smallest footprint; authentik for visual flow design and ops comfort; Keycloak for maximum protocol depth and enterprise lineage. All three are in this catalogue at $13-25/month - deploying two to compare costs less than a week of any identity SaaS.
What is the external-domain warning about?
Zitadel writes the domain into its instance data during initial setup - issuer URLs, org domains, and keys derive from it. Set ZITADEL_EXTERNALDOMAIN to your real domain (with EXTERNALPORT=443 and EXTERNALSECURE=true) before the first deploy; changing it afterward is a documented but painful procedure.
Does AGPL affect my apps that use it for login?
No - your applications only talk to Zitadel over OIDC/SAML, which creates no licensing relationship. AGPL obligations would only arise if you modified Zitadel itself and offered that modified version as a service.
How does it compare to Okta or WorkOS for B2B?
Okta Workforce starts at $6/user/month with a $1,500/year minimum; WorkOS charges $125/month per SSO connection. Zitadel makes each customer an organization with their own SSO config - unlimited orgs and connections, on the flat plan.
Ship Zitadel today
One compose stack, 2 GiB of RAM, from $13/month flat, and it runs on your laptop with the same files.