Changelog
FeedWhat's new in the preview. A change to the server is live on preview.zitadel.com as soon as it lands; the CLI, the SDKs and a self-hosted server get it with the release that ships it.
Deploy a release from the CLI
zitadel deploy replaces plan and apply. It builds .zitadel/ into one release, shows what changes against the live one, and makes it live on your project's primary origins.
Find why a local sign-in failed with zitadel logs
zitadel logs shows the local server's warnings in yellow and its errors in red, and --level warn shows only those.
Hand the claim link to someone else
zitadel claim --no-wait prints the claim link and exits, so a script or coding agent can pass it to a person, and claim --challenge-id waits for it to be used.
In Next.js, protectedRoutes alone protects a route
Adding a route to protectedRoutes now requires a sign-in on it, where a route missing from the middleware's matcher used to stay public, and pages that never read the session cost no call to Zitadel.
Keep your password policy in your repository
zitadel setup writes a password policy with a 15-character minimum for every new project, and zitadel deploy ships the policies in .zitadel/policies/ with each release.
One checkout for development, staging and production
CLI commands resolve the server, project and credential per environment, from flags, the process environment and your .env files, and zitadel env shows what resolved and from where.
Preview a branch's release on its pull-request URLs
Run zitadel preview in a preview build, and the release your branch builds goes live on its pull-request URLs for as long as you choose. A variable can hold a value of its own for previews.
Rebuild your .zitadel folder from a release
zitadel pull restores the files of the live release, or of any release or deployment, so the next deploy builds the same release.
Signing out ends the session in the shared cookie
Signing out through a server SDK's proxy now also ends a session held in the shared __nextgen_session cookie, which Zitadel kept valid until it expired.
SvelteKit apps move to SvelteKit 3
The hooks zitadel setup writes for SvelteKit read their settings from SvelteKit 3's private env module, and @zitadel/sdk-sveltekit now needs SvelteKit 3.
The CLI tells you what to do next
Running zitadel alone groups the commands by what you are doing, and start, setup and auth-method sso enable ask plainer questions and say what to run next.
The login says why it switched to sign-up
When an email has no account, the login component turns into a sign-up and says so, with a note to fix a typo in the email. An email that has an account turns it into a sign-in.
The password step shows the account with an avatar
The login's password step shows the account as a chip with a generated avatar, and a GitHub sign-in button shows the GitHub logo.
Where the CLI's usage data goes, and an opt-in ping for servers
The CLI sends its anonymous usage events to Vercel Web Analytics on preview.zitadel.com instead of Mixpanel, and a self-hosted server can opt in to a daily service ping.
Zitadel NextGen 0.2.0
Deploy and preview releases from the CLI, keep development, staging and production apart in one checkout, and ship your password policy with each release. This release has breaking changes, so read the upgrade notes.
Imported passwords move to your project's hashing method
A successful password sign-in now replaces an outdated stored hash with one from the project's hashing method, so imported bcrypt or legacy hashes move to argon2id as users sign in.
Live on preview.zitadel.comReleased in v0.2.0
Sign-ins use exactly what their release pins
A sign-in now uses the schema, branding and sign-in connections its release pins, and the variables its deployment froze, so a deploy or a new revision does not change a sign-in under way.
Live on preview.zitadel.comReleased in v0.2.0
A log line per request, and every API error logged once
The server logs one line per request and every error it returns once, keeps stack traces for when you ask, honours the log streams you list, and can continue a caller's trace.
Live on preview.zitadel.comReleased in v0.2.0
Deploy, roll back and revoke from the console
The console lists a project's deployments and the release each made live, and deploys, rolls back and revokes from there.
Live on preview.zitadel.comReleased in v0.2.0
A users table that fits any schema, and clearer schema and branding screens
The console's Users table stays within its width however many properties a schema has, the schema screen badges its sign-in and display-name properties, and branding gets a theme menu.
Live on preview.zitadel.comReleased in v0.2.0
See who can administer a project, and why
A project's admins are listed with how each got access, through the team that owns the project, an admin grant to them, or one to a team they belong to.
Live on preview.zitadel.comReleased in v0.2.0
Deploy a release to preview URLs
Deploy a release to preview URLs that match your project's preview patterns, for up to a year, then list the live previews and end one when you are done.
Live on preview.zitadel.comReleased in v0.2.0
Set a password policy for your project
Publish a password policy with a minimum and maximum length and a history depth, and ship it with a release, which every sign-in and sign-up then applies.
Live on preview.zitadel.comReleased in v0.2.0
Security: tighter project boundaries
Reads, sign-ins and session exchanges stay inside the project a request names or its secret belongs to, and a caller scoped to part of a project no longer learns what exists outside its scope.
Live on preview.zitadel.comReleased in v0.2.0
The server no longer serves a login page
The server's page at /ui/login/, which could not sign anyone in, is gone. Your app presents the login with the login component, which zitadel setup adds.
Live on preview.zitadel.comReleased in v0.2.0
/readyz waits for the database, and /healthz is gone
/readyz answers 503 while the server's database does not answer within a second, so a load balancer stops sending it requests. /healthz is removed.
Live on preview.zitadel.comReleased in v0.2.0
Errors look the same everywhere, with a request ID to quote
An unknown address or a failed sign-in callback shows a page in Zitadel's design with a request ID, and the console's error screens show the failed request's ID too.
Live on preview.zitadel.comReleased in v0.2.0
The console's login preview works on preview.zitadel.com again
The login preview in the console works again off localhost, as on the hosted cloud, for a project that lists its origins.
Live on preview.zitadel.comReleased in v0.2.0
A new console navigation, with your projects as its home
The console has a new sidebar and top bar, with project and team switchers and a ⌘K search, and opens on Projects, where each project shows its mark, its name and its site.
Live on preview.zitadel.comReleased in v0.2.0
Name the people who run your deployment as platform operators
A self-hosted deployment can name platform operators, who administer every project and whose changes are marked as theirs in each project's events.
Live on preview.zitadel.comReleased in v0.2.0
Roll back a deployment, and revoke a release
A rollback re-deploys an earlier release to every primary origin, and a release you revoke can no longer be deployed.
Live on preview.zitadel.comReleased in v0.2.0
Zitadel NextGen 0.1.0, the first release
The first proper release, and the first on npm's latest tag: registration and login live in your app, under your brand, and an empty folder becomes an app with a working login in three commands.
Add login to an existing SvelteKit, SolidStart, Qwik City or TanStack Start app
zitadel setup now patches an existing SvelteKit, SolidStart, Qwik City or TanStack Start app instead of failing on it, and leaves its layout and homepage alone.
Call any API operation from the CLI
The new zitadel api command calls any operation of the Zitadel API with your project's server and secret, including the ones no command covers yet.
The login shows which account you are signing in to
The password step of <zitadel-login> names the account it signs in to, with a way back to use another one, and the step after a social sign-in to an existing account now carries its email.
The login waits for your event handlers, and keeps secrets out of its events
The login widgets now wait for the promises your handlers pass before they navigate, and no longer tell your listeners what a visitor types into a password or code field.
Your English texts reach every language of the login
<zitadel-login> now falls back to your en entries in locales for any text the visitor's language has none for, instead of showing raw keys.
Security: signing in needs a verified password, passkey or SSO
An auth attempt could issue a session after verifying only the user's identifier. It now needs a verified password, passkey or SSO factor, and step-up sign-in needs the session's token.
Live on preview.zitadel.comReleased in v0.1.0
Edit a user's attributes in the console
The console's user screen follows the new design, edits a user's attributes against their schema, and shows which schema revision the user is on.
Live on preview.zitadel.comReleased in v0.1.0
Validation errors name the fields to fix
When the API refuses user attributes that fail the schema, it answers 400 req.invalid and names every failing field, and an over-long password is a password policy violation.
Live on preview.zitadel.comReleased in v0.1.0
Read a signed-in user's own sign-in methods
Three new /users/me reads return the signed-in user's passkeys, linked identity provider accounts and password state, with the session alone.
Live on preview.zitadel.comReleased in v0.1.0
Deploy a release to all your primary origins at once
Every deployment now has a kind, primary or preview, and a status, and one deploy with targets: ["primary"] makes a release live on all of a project's primary origins.
Live on preview.zitadel.comReleased in v0.1.0
Every change of each release is in its release notes on GitHub: v0.3.0, v0.2.0, v0.1.0.