Skip to content

Identity Provider Comparison — Zitadel vs Keycloak vs authentik vs Ory

Summary

Self-hostable identity providers (IdPs) issue identities and tokens (OIDC, OAuth 2.0, SAML); they do not store application secrets. That is the job of Vault, ESO and SOPS, covered in the Secrets Management Comparison. This page compares Zitadel, the only IdP with a full topic page in this knowledge base, against three common alternatives. Keycloak, authentik and Ory facts come from their release notes and repositories (see Sources) and are shallower than the Zitadel topic; treat this page as a starting point, not an evaluation.

Quick Reference

Dimension Zitadel Keycloak authentik Ory (Kratos + Hydra)
Shape Single Go binary + Next.js Login V2 app Java server on Quarkus with built-in themes Python/Django core; server entrypoint and proxy outpost rewritten from Go to Rust in 2026.8 Headless Go services: Kratos (identity), Hydra (OAuth 2.0 / OIDC), plus Keto and Oathkeeper
Latest version (2026-09) v4.19.1 (2026-09-23) 26.7.4 (2026-09-16); 26.7.0 feature release 2026-07-09 2026.8 (2026-08-18), patches 2026.8.x OSS 26.2.0 (2026-03-20); Enterprise License builds v26.3.x (for example v26.3.17, 2026-09-24)
License AGPL-3.0 core; Apache-2.0 protos; MIT login app and clients Apache-2.0 MIT, except authentik/enterprise/ (separate enterprise license) Apache-2.0 (OSS); Ory Enterprise License (OEL) for enterprise builds
Governance / vendor ZITADEL (Swiss company) CNCF Incubating (since 2023-04) Authentik Security Ory Corp
Storage PostgreSQL 14 to 18 only; event sourcing + CQRS Relational database (for example PostgreSQL, MySQL, MariaDB) PostgreSQL SQL database (see Ory docs)
Multi-tenancy Instances > organizations > projects, project grants Realms; Organizations inside a realm (supported since 26.0) Brands (per-domain branding and flows); tenant isolation not reviewed (TBD) Via OEL ("advanced scaling, multi-tenancy") or Ory Network
Login UI Hosted Login V2 (replaceable, built on public Session API) Built-in themeable login Built-in flows and stages editor None: you build it (headless)
Managed offering Zitadel Cloud (same codebase) None from the project; commercial support via vendors such as Red Hat build of Keycloak authentik Enterprise (self-hosted) Ory Network

Which One Should I Pick?

Start from licensing constraints and how much UI you want to own.

flowchart TD
    Q1{"Need a headless API and<br/>your own login UI?"}
    Q1 -->|"Yes"| Q1b{"Need SCIM, SAML or<br/>org SSO self-hosted?"}
    Q1b -->|"No"| ORY["Ory Kratos + Hydra (OSS)"]
    Q1b -->|"Yes"| ORYE["Ory with Enterprise License<br/>or Ory Network"]
    Q1 -->|"No"| Q2{"AGPL acceptable for<br/>your use of the IdP?"}
    Q2 -->|"No"| Q3{"Want the largest ecosystem<br/>and CNCF governance?"}
    Q3 -->|"Yes"| KC["Keycloak"]
    Q3 -->|"No"| AK["authentik<br/>(MIT core)"]
    Q2 -->|"Yes"| Q4{"B2B SaaS with per-customer<br/>orgs, or event-sourced audit?"}
    Q4 -->|"Yes"| ZIT["Zitadel"]
    Q4 -->|"No"| Q5{"Need forward-auth proxy,<br/>LDAP or RADIUS for legacy apps?"}
    Q5 -->|"Yes"| AK
    Q5 -->|"No"| KC
Scenario Leaning Why
B2B SaaS, customer-managed orgs and roles Zitadel Organizations and project grants are primitives; Cloud and self-hosted share code
Enterprise SSO with a big plugin and integration ecosystem Keycloak Mature Java SPI ecosystem, CNCF Incubating, Apache-2.0
Homelab or internal apps behind a reverse proxy authentik Proxy outposts, flow editor, MIT core
Fully custom UX, API-only identity Ory Headless Kratos + Hydra; Apache-2.0 OSS
Avoid copyleft obligations for a modified, network-served fork Keycloak, authentik or Ory Zitadel core is AGPL-3.0 (legal review or commercial license)

Feature Notes

Capability Zitadel Keycloak authentik Ory
OIDC / OAuth 2.0 Yes, OpenID Certified OP Yes Yes; OpenID Certified (OP and logout profiles) as of 2026.8 Hydra (OAuth 2.0 / OIDC provider)
SAML 2.0 IdP and federation to external SAML IdPs Yes; SAML step-up authentication supported in 26.7 Yes; WS-Federation added in 2026.2 OEL / Ory Network
SCIM SCIM 2.0 server (inbound provisioning) SCIM API in preview (26.7) SCIM provider (outbound provisioning) OEL / Ory Network
Passkeys / MFA Passkeys first, TOTP, U2F, OTP WebAuthn, OTP WebAuthn, TOTP and other stages Kratos WebAuthn / passkeys, TOTP
Extensibility Actions V2 (HTTP webhooks) Java SPIs Python expression policies, flows and stages Webhooks, you own the UI
Audit trail Event store is the audit log Admin and login events Event log TBD (not reviewed)
Recent security activity Several critical login-flow advisories Jul-Sep 2026 (patch to v4.19.1+) 26.7.4 fixed six CVEs (two unauthenticated DoS) Security fixes in 2026.x patch releases OEL promises SLA-backed CVE patches; OSS best effort

Patch cadence matters for every IdP

All four projects shipped security fixes in mid-2026. An IdP sits in every login path, so pin a supported version and track advisories: Zitadel supports only v4, authentik supports the two most recent releases, Keycloak ships frequent 26.x patches, and Ory directs production users to OEL builds for guaranteed CVE fixes.

How It Relates to Secrets Management

An IdP and a secrets store meet at workload and human authentication, not at storage.

flowchart LR
    USER["Engineer"] -->|"OIDC login"| IDP["IdP<br/>(Zitadel, Keycloak,<br/>authentik, Ory Hydra)"]
    IDP -->|"ID token / groups claim"| VAULT["Vault OIDC / JWT auth method"]
    VAULT -->|"token with policies"| USER
    POD["Pod ServiceAccount"] -->|"Kubernetes auth"| VAULT
    VAULT -->|"dynamic DB credentials"| POD

Zitadel's own guidance is that machine users and personal access tokens exist but it is "an IdP, not a key vault" (Zitadel: When Zitadel Fits).

Open Questions

  • Performance and resource footprint under comparable load: no neutral benchmark was found. TBD.
  • Ory OSS vs OEL version alignment: OSS repositories show 26.2.0 (2026-03-20) while OEL builds are at v26.3.x; how often OSS catches up is not documented. TBD.
  • Keycloak and Ory OpenID certification status for current versions was not re-verified for this page. TBD.

Sources