{
  "schema_version": 1,
  "generated_at": "2026-10-23T00:00:00.000Z",
  "canonical_url": "https://openlogs.fyi/tools/zitadel",
  "slug": "zitadel",
  "name": "Zitadel",
  "tagline": "Identity management server with single sign-on, passkeys and multi-tenant organizations.",
  "replaces": {
    "summary": "Paid identity and login services, such as Auth0.",
    "products": [
      {
        "slug": "auth0",
        "name": "Auth0",
        "vendor": "Okta",
        "url": "https://openlogs.fyi/alternatives/auth0"
      }
    ]
  },
  "stack": [
    {
      "kind": "language",
      "name": "Go"
    }
  ],
  "deployment_methods": [
    "docker_compose"
  ],
  "requirements": {
    "min_ram_mb": null,
    "min_cpu_cores": null,
    "source_url": null
  },
  "license": {
    "spdx": "AGPL-3.0",
    "class": "osi",
    "source_url": "https://github.com/zitadel/zitadel/blob/ce12560d2491f12bb96f20805ad532f7d6dd5875/LICENSE"
  },
  "business_model": {
    "value": "unknown",
    "notes": "The README at the pinned commit does not state a business model, so it stays unknown.",
    "source_url": "https://github.com/zitadel/zitadel/blob/ce12560d2491f12bb96f20805ad532f7d6dd5875/README.md",
    "checked_at": "2026-10-22"
  },
  "difficulty": {
    "value": "hard",
    "reason": "6 services, 4 volume mounts, 33 env values to set, host access: docker_socket. Heuristic score 8 of 11: hard."
  },
  "repository": {
    "owner": "zitadel",
    "name": "zitadel",
    "url": "https://github.com/zitadel/zitadel"
  },
  "compose_check": {
    "status": "config_ok",
    "validated_at": "2026-10-22",
    "summary": "config_ok on 2026-10-22"
  },
  "recipe": {
    "version": 1,
    "source_path": "deploy/compose/docker-compose.yml",
    "source_repo": "zitadel/zitadel",
    "source_commit_sha": "ce12560d2491f12bb96f20805ad532f7d6dd5875",
    "source_kind": "app_repo",
    "source_url": "https://github.com/zitadel/zitadel/blob/ce12560d2491f12bb96f20805ad532f7d6dd5875/deploy/compose/docker-compose.yml"
  },
  "install_steps": [
    {
      "order": 1,
      "kind": "prerequisite",
      "language": "text",
      "label": "Docker with the Compose plugin",
      "body": "A host with Docker and the Docker Compose plugin. This entry runs from a compose file.",
      "source_url": "https://github.com/zitadel/zitadel/blob/ce12560d2491f12bb96f20805ad532f7d6dd5875/README.md",
      "validation_status": "unvalidated"
    },
    {
      "order": 2,
      "kind": "compose",
      "language": "yaml",
      "label": "Save the compose file as docker-compose.yml",
      "body": "name: zitadel\n\nservices:\n  proxy:\n    image: ${TRAEFIK_IMAGE}\n    restart: unless-stopped\n    command:\n      - --providers.docker=true\n      - --providers.docker.exposedbydefault=false\n      - --providers.docker.network=zitadel\n      - --entrypoints.web.address=:80\n      - --entrypoints.websecure.address=:443\n      - --api.dashboard=${TRAEFIK_DASHBOARD_ENABLED}\n      - --api.insecure=false\n      - --ping=true\n      - --ping.entrypoint=web\n      - --log.level=${TRAEFIK_LOG_LEVEL}\n      - --accesslog=${TRAEFIK_ACCESSLOG_ENABLED}\n    ports:\n      - ${PROXY_HTTP_PUBLISHED_PORT}:80\n    networks:\n      - zitadel\n    volumes:\n      - /var/run/docker.sock:/var/run/docker.sock:ro\n    depends_on:\n      zitadel-api:\n        condition: service_healthy\n      zitadel-login:\n        condition: service_healthy\n\n  zitadel-api:\n    image: ghcr.io/zitadel/zitadel:${ZITADEL_VERSION}\n    restart: unless-stopped\n    user: \"0\"\n    command: start-from-init --masterkey \"${ZITADEL_MASTERKEY}\"\n    environment:\n      ZITADEL_PORT: 8080\n      ZITADEL_EXTERNALDOMAIN: ${ZITADEL_DOMAIN}\n      ZITADEL_EXTERNALPORT: ${ZITADEL_EXTERNALPORT}\n      ZITADEL_EXTERNALSECURE: ${ZITADEL_EXTERNALSECURE}\n      ZITADEL_TLS_ENABLED: false\n\n      ZITADEL_DATABASE_POSTGRES_DSN: ${ZITADEL_DATABASE_POSTGRES_DSN}\n\n      ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORDCHANGEREQUIRED: false\n      ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH: /zitadel/bootstrap/login-client.pat\n      ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_MACHINE_USERNAME: login-client\n      ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_MACHINE_NAME: Automatically Initialized IAM_LOGIN_CLIENT\n      ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_PAT_EXPIRATIONDATE: ${LOGIN_CLIENT_PAT_EXPIRATION}\n\n      ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED: true\n      ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_BASEURI: ${ZITADEL_PUBLIC_SCHEME}://${ZITADEL_DOMAIN}:${ZITADEL_EXTERNALPORT}/ui/v2/login/\n      ZITADEL_OIDC_DEFAULTLOGINURLV2: ${ZITADEL_PUBLIC_SCHEME}://${ZITADEL_DOMAIN}:${ZITADEL_EXTERNALPORT}/ui/v2/login/login?authRequest=\n      ZITADEL_OIDC_DEFAULTLOGOUTURLV2: ${ZITADEL_PUBLIC_SCHEME}://${ZITADEL_DOMAIN}:${ZITADEL_EXTERNALPORT}/ui/v2/login/logout?post_logout_redirect=\n      ZITADEL_SAML_DEFAULTLOGINURLV2: ${ZITADEL_PUBLIC_SCHEME}://${ZITADEL_DOMAIN}:${ZITADEL_EXTERNALPORT}/ui/v2/login/login?samlRequest=\n\n      ZITADEL_LOGSTORE_ACCESS_STDOUT_ENABLED: ${ZITADEL_ACCESS_LOG_STDOUT_ENABLED}\n\n      ZITADEL_INSTRUMENTATION_TRACE_EXPORTER_TYPE: ${ZITADEL_INSTRUMENTATION_TRACE_EXPORTER_TYPE}\n      ZITADEL_INSTRUMENTATION_TRACE_EXPORTER_ENDPOINT: ${ZITADEL_INSTRUMENTATION_TRACE_EXPORTER_ENDPOINT}\n      ZITADEL_INSTRUMENTATION_TRACE_EXPORTER_INSECURE: ${ZITADEL_INSTRUMENTATION_TRACE_EXPORTER_INSECURE}\n      ZITADEL_INSTRUMENTATION_SERVICENAME: ${ZITADEL_INSTRUMENTATION_SERVICENAME}\n\n      ZITADEL_CACHES_CONNECTORS_REDIS_ENABLED: ${ZITADEL_CACHES_CONNECTORS_REDIS_ENABLED}\n      ZITADEL_CACHES_CONNECTORS_REDIS_URL: ${ZITADEL_CACHES_CONNECTORS_REDIS_URL}\n      ZITADEL_CACHES_INSTANCE_CONNECTOR: ${ZITADEL_CACHES_INSTANCE_CONNECTOR}\n      ZITADEL_CACHES_MILESTONES_CONNECTOR: ${ZITADEL_CACHES_MILESTONES_CONNECTOR}\n      ZITADEL_CACHES_ORGANIZATION_CONNECTOR: ${ZITADEL_CACHES_ORGANIZATION_CONNECTOR}\n\n    healthcheck:\n      test:\n        - CMD\n        - /app/zitadel\n        - ready\n      interval: 10s\n      timeout: 30s\n      retries: 12\n      start_period: 20s\n    volumes:\n      - zitadel-bootstrap:/zitadel/bootstrap:rw\n    networks:\n      - zitadel\n    depends_on:\n      postgres:\n        condition: service_healthy\n    labels:\n      - traefik.enable=true\n      - traefik.docker.network=zitadel\n\n      - traefik.http.services.zitadel-api.loadbalancer.server.port=8080\n      - traefik.http.services.zitadel-api.loadbalancer.server.scheme=h2c\n\n      - traefik.http.middlewares.zitadel-strip-api.stripprefix.prefixes=/api\n      - traefik.http.middlewares.zitadel-strip-api.stripprefix.forceSlash=false\n\n      # Note: no dedicated gRPC router needed. All gRPC and Connect-RPC traffic\n      # is handled by the catch-all router below since the backend already uses h2c.\n\n      - traefik.http.routers.zitadel-api-alias-web.rule=Host(`${ZITADEL_DOMAIN}`) && PathPrefix(`/api`)\n      - traefik.http.routers.zitadel-api-alias-web.entrypoints=web\n      - traefik.http.routers.zitadel-api-alias-web.middlewares=zitadel-strip-api\n      - traefik.http.routers.zitadel-api-alias-web.service=zitadel-api\n      - traefik.http.routers.zitadel-api-alias-web.priority=200\n\n      - traefik.http.routers.zitadel-api-alias-websecure.rule=Host(`${ZITADEL_DOMAIN}`) && PathPrefix(`/api`)\n      - traefik.http.routers.zitadel-api-alias-websecure.entrypoints=websecure\n      - traefik.http.routers.zitadel-api-alias-websecure.tls=true\n      - traefik.http.routers.zitadel-api-alias-websecure.middlewares=zitadel-strip-api\n      - traefik.http.routers.zitadel-api-alias-websecure.service=zitadel-api\n      - traefik.http.routers.zitadel-api-alias-websecure.priority=200\n\n      - traefik.http.routers.zitadel-canonical-web.rule=Host(`${ZITADEL_DOMAIN}`) && !PathPrefix(`/ui/v2/login`) && !PathPrefix(`/api`) && !Path(`/`)\n      - traefik.http.routers.zitadel-canonical-web.entrypoints=web\n      - traefik.http.routers.zitadel-canonical-web.service=zitadel-api\n      - traefik.http.routers.zitadel-canonical-web.priority=100\n\n      - traefik.http.routers.zitadel-canonical-websecure.rule=Host(`${ZITADEL_DOMAIN}`) && !PathPrefix(`/ui/v2/login`) && !PathPrefix(`/api`) && !Path(`/`)\n      - traefik.http.routers.zitadel-canonical-websecure.entrypoints=websecure\n      - traefik.http.routers.zitadel-canonical-websecure.tls=true\n      - traefik.http.routers.zitadel-canonical-websecure.service=zitadel-api\n      - traefik.http.routers.zitadel-canonical-websecure.priority=100\n\n  zitadel-login:\n    image: ghcr.io/zitadel/zitadel-login:${ZITADEL_VERSION}\n    restart: unless-stopped\n    user: \"0\"\n    environment:\n      ZITADEL_API_URL: http://zitadel-api:8080\n      NEXT_PUBLIC_BASE_PATH: /ui/v2/login\n      ZITADEL_SERVICE_USER_TOKEN_FILE: /zitadel/bootstrap/login-client.pat\n      # Signs the Login UI session cookie. At least 32 characters, e.g. `openssl rand -base64 32`.\n      ZITADEL_SESSION_COOKIE_SECRET: ${LOGIN_SESSION_COOKIE_SECRET}\n      CUSTOM_REQUEST_HEADERS: Host:${ZITADEL_DOMAIN},X-Forwarded-Proto:${ZITADEL_PUBLIC_SCHEME}\n\n      # Future-ready placeholders for upcoming Login OTEL support.\n      OTEL_SERVICE_NAME: ${LOGIN_OTEL_SERVICE_NAME}\n      OTEL_EXPORTER_OTLP_ENDPOINT: ${LOGIN_OTEL_EXPORTER_OTLP_ENDPOINT}\n      OTEL_EXPORTER_OTLP_PROTOCOL: ${LOGIN_OTEL_EXPORTER_OTLP_PROTOCOL}\n    healthcheck:\n      test:\n        - CMD\n        - /bin/sh\n        - -c\n        - node /app/healthcheck.mjs http://localhost:3000/ui/v2/login/healthy\n      interval: 10s\n      timeout: 30s\n      retries: 12\n      start_period: 20s\n    volumes:\n      - zitadel-bootstrap:/zitadel/bootstrap:ro\n    networks:\n      - zitadel\n    depends_on:\n      zitadel-api:\n        condition: service_healthy\n    labels:\n      - traefik.enable=true\n      - traefik.docker.network=zitadel\n      - traefik.http.services.zitadel-login.loadbalancer.server.port=3000\n\n      - traefik.http.middlewares.zitadel-root-rewrite.replacepath.path=/ui/v2/login/\n\n      - traefik.http.routers.zitadel-root-web.rule=Host(`${ZITADEL_DOMAIN}`) && Path(`/`)\n      - traefik.http.routers.zitadel-root-web.entrypoints=web\n      - traefik.http.routers.zitadel-root-web.middlewares=zitadel-root-rewrite\n      - traefik.http.routers.zitadel-root-web.service=zitadel-login\n      - traefik.http.routers.zitadel-root-web.priority=400\n\n      - traefik.http.routers.zitadel-root-websecure.rule=Host(`${ZITADEL_DOMAIN}`) && Path(`/`)\n      - traefik.http.routers.zitadel-root-websecure.entrypoints=websecure\n      - traefik.http.routers.zitadel-root-websecure.tls=true\n      - traefik.http.routers.zitadel-root-websecure.middlewares=zitadel-root-rewrite\n      - traefik.http.routers.zitadel-root-websecure.service=zitadel-login\n      - traefik.http.routers.zitadel-root-websecure.priority=400\n\n      - traefik.http.routers.zitadel-login-web.rule=Host(`${ZITADEL_DOMAIN}`) && PathPrefix(`/ui/v2/login`)\n      - traefik.http.routers.zitadel-login-web.entrypoints=web\n      - traefik.http.routers.zitadel-login-web.service=zitadel-login\n      - traefik.http.routers.zitadel-login-web.priority=250\n\n      - traefik.http.routers.zitadel-login-websecure.rule=Host(`${ZITADEL_DOMAIN}`) && PathPrefix(`/ui/v2/login`)\n      - traefik.http.routers.zitadel-login-websecure.entrypoints=websecure\n      - traefik.http.routers.zitadel-login-websecure.tls=true\n      - traefik.http.routers.zitadel-login-websecure.service=zitadel-login\n      - traefik.http.routers.zitadel-login-websecure.priority=250\n\n  postgres:\n    image: ${POSTGRES_IMAGE}\n    restart: unless-stopped\n    environment:\n      POSTGRES_PASSWORD: ${POSTGRES_ADMIN_PASSWORD}\n      POSTGRES_USER: ${POSTGRES_ADMIN_USER}\n      POSTGRES_DB: ${POSTGRES_DB}\n    healthcheck:\n      test:\n        - CMD-SHELL\n        - pg_isready -d ${POSTGRES_DB} -U ${POSTGRES_ADMIN_USER}\n      interval: 10s\n      timeout: 30s\n      retries: 10\n      start_period: 20s\n    volumes:\n      - postgres-data:/var/lib/postgresql/data:rw\n    networks:\n      - zitadel\n\n  redis:\n    image: ${REDIS_IMAGE}\n    restart: unless-stopped\n    profiles:\n      - cache\n    command:\n      - --save\n      - \"\"\n      - --appendonly\n      - \"no\"\n    networks:\n      - zitadel\n\n  otel-collector:\n    image: ${OTEL_COLLECTOR_IMAGE}\n    restart: unless-stopped\n    profiles:\n      - observability\n    command:\n      - --config=/etc/otelcol/config.yaml\n    volumes:\n      - ./otel-collector-config.yaml:/etc/otelcol/config.yaml:ro\n    networks:\n      - zitadel\n\nnetworks:\n  zitadel:\n    name: zitadel\n\nvolumes:\n  postgres-data:\n  zitadel-bootstrap:\n",
      "source_url": "https://github.com/zitadel/zitadel/blob/ce12560d2491f12bb96f20805ad532f7d6dd5875/deploy/compose/docker-compose.yml",
      "validation_status": "config_ok"
    },
    {
      "order": 3,
      "kind": "env",
      "language": "dotenv",
      "label": "Save as .env next to the compose file",
      "body": "# ⚠️  INSECURE DEFAULTS — for local development only.\n# Before exposing this stack to a network, change ZITADEL_MASTERKEY,\n# LOGIN_SESSION_COOKIE_SECRET, POSTGRES_ADMIN_PASSWORD, and POSTGRES_ZITADEL_PASSWORD.\n# See: https://zitadel.com/docs/self-hosting/deploy/compose#homelab\n\n# -----------------------------\n# Domain and external URL\n# -----------------------------\nZITADEL_DOMAIN=localhost\n# Used by the base (non-TLS) compose; TLS overlays also publish 80/443 and may still expose\n# this port unless their ports are adjusted.\nPROXY_HTTP_PUBLISHED_PORT=8080\nZITADEL_EXTERNALPORT=8080\nZITADEL_EXTERNALSECURE=false\n# Overridden by TLS overlays (they hardcode X-Forwarded-Proto: https).\nZITADEL_PUBLIC_SCHEME=http\n\n# -----------------------------\n# Security/bootstrap\n# -----------------------------\n# Must be exactly 32 chars for new deployments.\nZITADEL_MASTERKEY=MasterkeyNeedsToHave32Characters\nLOGIN_CLIENT_PAT_EXPIRATION=2099-01-01T00:00:00Z\n# Signs the Login UI session cookie. Must be at least 32 chars.\n# Generate with: openssl rand -base64 32\nLOGIN_SESSION_COOKIE_SECRET=SessionCookieSecretNeedsAtLeast32Chars\n\n# -----------------------------\n# Pinned image tags\n# To upgrade ZITADEL, bump ZITADEL_VERSION and run:\n#   docker compose --env-file .env -f docker-compose.yml pull\n#   docker compose --env-file .env -f docker-compose.yml up -d --wait\n# -----------------------------\nZITADEL_VERSION=v4.16.0\nTRAEFIK_IMAGE=traefik:v3.7.7\nPOSTGRES_IMAGE=postgres:17.10-alpine\nREDIS_IMAGE=redis:7.4.9-alpine\nOTEL_COLLECTOR_IMAGE=otel/opentelemetry-collector-contrib:0.156.0\n\n# -----------------------------\n# Proxy settings\n# -----------------------------\nTRAEFIK_DASHBOARD_ENABLED=false\nTRAEFIK_LOG_LEVEL=INFO\nTRAEFIK_ACCESSLOG_ENABLED=true\n# Trusted proxy IPs for X-Forwarded-* headers (external-tls mode).\n# Comma-separated CIDR ranges of your upstream load balancer / reverse proxy.\nTRAEFIK_TRUSTED_IPS=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16\n\n# Let's Encrypt mode\nLETSENCRYPT_EMAIL=ops@example.com\n\n# -----------------------------\n# Postgres settings\n# -----------------------------\nPOSTGRES_DB=zitadel\nPOSTGRES_ADMIN_USER=postgres\nPOSTGRES_ADMIN_PASSWORD=postgres\n# DSN used by ZITADEL to connect to PostgreSQL.\n# The start-from-init command uses this DSN to create the database schema and for\n# normal operation. When a DSN is configured, ZITADEL does not create or switch\n# to a separate unprivileged database user; the user in this DSN is used directly\n# and must already exist. For production, configure this DSN to use a non-superuser\n# role with only the permissions ZITADEL needs.\n# See https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING\nZITADEL_DATABASE_POSTGRES_DSN=postgresql://postgres:postgres@postgres:5432/zitadel?sslmode=disable\n\n# -----------------------------\n# Access logs\n# -----------------------------\nZITADEL_ACCESS_LOG_STDOUT_ENABLED=true\n\n# -----------------------------\n# Optional Redis cache settings\n# Default is disabled.\n# Enable with --profile cache and switch connectors to redis.\n# -----------------------------\nZITADEL_CACHES_CONNECTORS_REDIS_ENABLED=false\n# DSN used by ZITADEL to connect to Redis.\n# See https://redis.io/docs/latest/develop/tools/cli/#host-port-password-and-database\nZITADEL_CACHES_CONNECTORS_REDIS_URL=redis://redis:6379/0\nZITADEL_CACHES_INSTANCE_CONNECTOR=\nZITADEL_CACHES_MILESTONES_CONNECTOR=\nZITADEL_CACHES_ORGANIZATION_CONNECTOR=\n\n# -----------------------------\n# Optional API tracing (OTEL)\n# Default is disabled. Enable with --profile observability.\n# The collector receives traces from ZITADEL on port 4317 (gRPC) and 4318 (HTTP)\n# and logs them to stdout by default.\n# To forward traces to your own backend (Grafana Tempo, Jaeger, OpenObserve, etc.),\n# uncomment the otlp exporter in otel-collector-config.yaml and set:\n# OTEL_BACKEND_ENDPOINT=http://your-backend:4317\n# -----------------------------\nZITADEL_INSTRUMENTATION_SERVICENAME=zitadel-api\nZITADEL_INSTRUMENTATION_TRACE_EXPORTER_TYPE=none\nZITADEL_INSTRUMENTATION_TRACE_EXPORTER_ENDPOINT=otel-collector:4317\nZITADEL_INSTRUMENTATION_TRACE_EXPORTER_INSECURE=true\n\n# -----------------------------\n# Future Login OTEL placeholders\n# Current login image may ignore these.\n# -----------------------------\nLOGIN_OTEL_SERVICE_NAME=zitadel-login\nLOGIN_OTEL_EXPORTER_OTLP_ENDPOINT=\nLOGIN_OTEL_EXPORTER_OTLP_PROTOCOL=grpc\n",
      "source_url": "https://github.com/zitadel/zitadel/blob/ce12560d2491f12bb96f20805ad532f7d6dd5875/deploy/compose/.env.example",
      "validation_status": "unvalidated"
    },
    {
      "order": 4,
      "kind": "note",
      "language": "text",
      "label": "What the compose file check ran with",
      "body": "The compose file check ran together with .env.example from the same commit, saved as .env. The folder held only these files. The README tells the reader to download docker-compose.yml and .env.example, copy the example to .env and run docker compose up.",
      "source_url": "https://github.com/zitadel/zitadel/blob/ce12560d2491f12bb96f20805ad532f7d6dd5875/README.md",
      "validation_status": "unvalidated"
    },
    {
      "order": 5,
      "kind": "shell",
      "language": "bash",
      "label": "Start it",
      "body": "docker compose up -d",
      "source_url": "https://github.com/zitadel/zitadel/blob/ce12560d2491f12bb96f20805ad532f7d6dd5875/README.md",
      "validation_status": "unvalidated"
    },
    {
      "order": 6,
      "kind": "verify",
      "language": "text",
      "label": "Open the app",
      "body": "Open http://localhost:8080. The compose file publishes host port 8080 for the proxy service.",
      "source_url": "https://github.com/zitadel/zitadel/blob/ce12560d2491f12bb96f20805ad532f7d6dd5875/deploy/compose/docker-compose.yml",
      "validation_status": "unvalidated"
    }
  ],
  "notes": [
    {
      "kind": "gotcha",
      "title": "The compose file mounts host folders",
      "body": "Host paths mounted into containers: ./otel-collector-config.yaml at /etc/otelcol/config.yaml (otel-collector).",
      "source_url": "https://github.com/zitadel/zitadel/blob/ce12560d2491f12bb96f20805ad532f7d6dd5875/deploy/compose/docker-compose.yml",
      "checked_at": "2026-10-22"
    },
    {
      "kind": "gotcha",
      "title": "Some services get elevated host access",
      "body": "proxy mounts the Docker socket, which gives it control of Docker on the host.",
      "source_url": "https://github.com/zitadel/zitadel/blob/ce12560d2491f12bb96f20805ad532f7d6dd5875/deploy/compose/docker-compose.yml",
      "checked_at": "2026-10-22"
    },
    {
      "kind": "gotcha",
      "title": "The example env file has public placeholder secrets",
      "body": "The example env file sets ZITADEL_MASTERKEY to MasterkeyNeedsToHave32Characters and LOGIN_SESSION_COOKIE_SECRET to SessionCookieSecretNeedsAtLeast32Chars. Both values are public. Replace both with your own random values before the first start.",
      "source_url": "https://github.com/zitadel/zitadel/blob/ce12560d2491f12bb96f20805ad532f7d6dd5875/deploy/compose/.env.example",
      "checked_at": "2026-10-23"
    }
  ],
  "signals": {
    "captured_at": "2026-10-22",
    "stars": 15385,
    "forks": 1396,
    "open_issues": 1310,
    "last_push": "2026-10-22",
    "days_since_push": 0,
    "latest_release": "v4.20.0",
    "latest_release_date": "2026-10-22",
    "days_since_release": 0
  },
  "links": {
    "html": "https://openlogs.fyi/tools/zitadel",
    "markdown": "https://openlogs.fyi/tools/zitadel.md",
    "json": "https://openlogs.fyi/tools/zitadel.json"
  },
  "updated_at": "2026-10-22"
}