ZITADEL

Z

ZITADEL

ZITADEL - Identity infrastructure, simplified for you.

Join

questions-help-bugs

product-feedback-requests

Custom UI

Reading the documentation, I came up with two questions: - Is it possible to transform session tokens into JWT tokens? - Or use the OIDC flow to generate JWT tokens from your own UI?...

Azure Active Directory IDP / Invalid grant_type MSIS 9612

I’m currently working on integrating Zitadel with a self-hosted Azure Active Directory using the Generic OIDC option. At the redirect stage — when the authorization_code is sent back to Zitadel — I’m getting the following error (see attached screenshot): invalid grant_type MSIS9612. I don’t have access to the Active Directory admin panel. The client_id and client_secret are correct, and the redirect_uri in the browser matches the configuration in the IDP. ...
No description

[Bug] Zitadel Chart - v2 login 'wait-for-zitadel' fails with service mesh (linkerd) K8S

The wait-for-zitadel init container in the login deployment fails when running with Linkerd (probably Istio too). Problem: Zitadel v4 serves HTTP/2 on port 8080. The init container uses wait4x/wait4x:3.5 which only speaks HTTP/1.1. When it tries to check /debug/ready, it dies with: ```sh Error: net/http: HTTP/1.x transport connection broken: malformed HTTP response "\x00\x00\x12\x04..."...

Build image and push to ECR

Hello everyone, I cloned the repo and tried to build a local Docker image: DOCKER_BUILDKIT=1 docker build --file build/zitadel/Dockerfile . -t zitadel:local...

Zitadel v2beta API – ListOrganizationMetadata returns 404

Description: We are integrating Zitadel v2 beta APIs and encountered issues with the ListOrganizationMetadata endpoint. The call consistently returns 404 Not Found. Environment:...

Scoping to specific organization in JWT token

Hi there, I'm currently running Zitadel 4.2.7 self-hosted as the main authentication platform for a SaaS application. The application consists of a single-page frontend and a backend server. I have configured the ZItadel instance as follows: ...

Best practice to copy user id from Zitadel DB my App DB?

Should I use Actions after creation for this? I am completely new to Zitadel and Authentication in general.

Trouble adding IAMMember (aka Administrator)

Hi folks, I'm using a self-hosted instance of Zitadel v2.71.10. I am not able to upgrade to V3 or higher at this time. I am testing the IAMMember API with the following flow (wrapper functions):...

Import human users with the v2 API not working as expected

Environment: Zitadel Cloud Version: v4.3.3 We currently use the v1 APIs to create human users. The call to /management/v1/users/human/_import works as expected and the user receives an initialization email if the email address is not marked as verified or if no password is set. ...

Initial User not supported

Hi Zitadel team 👋 I'm self-hosting Zitadel (latest image from ghcr.io/zitadel/zitadel:latest) using the start-from-init command and setting all relevant ZITADEL_FIRSTINSTANCE_* environment variables. Here’s what works:...

Account linking failed in invite flow with idp

Version: Zitadel Cloud 4.3.3 Login v2 Steps: ...
No description

Logon issues with 4.3.2

With 4.3.1 I can logon as ususal on osx with fingerprint, but with 4.3.2 it seems the ui does not look same, seems some css is missing and I can no longer use fingerprint as it not even comes up. It simply states my browser is not compatible. However, when i revert back to 4.3.1 all works normal. here is a screen as it looks with 4.3.2...
No description

v4.3.2 missing binaries?

For the latest release tagged to 4.3.2 there are no platform specific binaries available. Request to download using latest tag fails: https://github.com/zitadel/zitadel/releases/latest/download/zitadel-linux-amd64.tar.gz...

v4.3.2 breaks CSS

Hello, looks like Zitadel v4.3.2 breaks the login page CSS. Check it out: https://account.indst.eu The previous version has no problem at all. If you open the browser console you can see the page it tries to get CSS from does not exist....

Passwordless authentication with email OTP

Hello everyone, I am an Authentik user and I am considering alternatives because I cannot make this workflow work in Authentik and honestly it's hard to use it. I manage my users manually. I create the users in Authentik with the respective emails. No passwords....

Are there any plans to update the Zitadel .NET SDK to use the latest API changes?

Hey everyone, I have a question, are there any plans to update the .NET SDK for Zitadel?

OTP Mail not sent

For some user no OTP Mail is sent. I can see that he created one, but no Emails are sent when he tries to log in. He complained that he does not receive the code by mail. In the screenshot you can see that he added the OTP and tried to login with the password, which succeeded. But no Mail is sent. I removed the OTP to see if he can register another one....
No description

upgrading from v2.65.10 to v2.66.0 error at setup

Hello i am upgrading our zitadel infrastructure to the newest version. Right now i have a problem upgrading from v2.65.10 to v2.66.0. i get the following error in the logs: zitadel-1 | time="2025-10-09T11:09:44Z" level=info msg="starting migration" caller="/home/runner/work/zitadel/zitadel/internal/migration/migration.go:66" name=40_init_push_func zitadel-1 | time="2025-10-09T11:09:44Z" level=info msg="execute statement" caller="/home/runner/work/zitadel/zitadel/cmd/setup/40.go:41" file=40_init_push_func.sql migration=40_init_push_func dzitadel-1 | time="2025-10-09T11:09:44Z" level=error msg="migration failed" caller="/home/runner/work/zitadel/zitadel/internal/migration/migration.go:68" error="40_init_push_func 40_init_push_func.sql: ERROR: at or near "(": syntax error (SQLSTATE 42601)" name=40_init_push_func...

Getting authRequestID v1 instead of authRequestId v2. Due to which createCallbackUrl API is failing.

We are encountering an issue where the authRequestID field is being returned in the v1 format (capital "ID") instead of the expected v2 format authRequestId (camelCase). This mismatch is causing the createCallbackUrl API to fail, as it appears to be strictly expecting the v2-compliant field name.

Reset password with code not working

Hello, for my user to change their password they call an endpoint on my api. the api gets a code and and builds the url to the code reset page. for that i use the c# grpc looking like this: var code = zitadelUserApi.PasswordReset(new Zitadel.User.V2.PasswordResetRequest() {...