zitadel.com
ZITADEL exposes tenant-hosted HTTP APIs for resource management (v2), legacy Auth/Management/Admin/System (v1, with System self-hosted only), and SCIM v2 provisioning, all authenticated with Bearer tokens—either OAuth access tokens or service-account PATs for most APIs, and a self-signed JWT bearer token for the self-hosted System API.
- ZITADEL resource APIs (v2)discovered
- ZITADEL Auth API (v1)discovered
- ZITADEL Management API (v1)discovered
- ZITADEL Admin API (v1)discovered
- ZITADEL System API (v1, self-hosted)discovered
- ZITADEL SCIM v2 APIdiscovered
For API access, create a service account in the ZITADEL console and authenticate it using one of ZITADEL's supported methods: private key JWT, client credentials, or a personal access token, following Authenticate service accounts. To call ZITADEL APIs (except Auth/System), request a token that includes the reserved audience scope urn:zitadel:iam:org:project:id:zitadel:aud as described in Access ZITADEL APIs. For user-scoped Auth API calls, use the authenticated user's access token instead.
For self-hosted ZITADEL only, configure a System API user in runtime settings and register its public key as described in Access ZITADEL System API. Generate an RSA keypair, add the public key under SystemAPIUsers, then mint a self-signed JWT with claims iss, sub, aud, iat, and exp matching your configured system user and ZITADEL base URL. The docs also show using ZITADEL Tools key2jwt to create a test token.
conventions · 0/8 published
- integrations.json✗
/.well-known/integrations.json - llms.txt✗
/llms.txt - API catalog✗
/.well-known/api-catalog - OpenAPI document✗
/api/schema/, /openapi.json, /swagger.json, /api/openapi.json, or /v1/openapi.json - MCP server card✗
/.well-known/mcp/server-card.json - OAuth protected resource✗
/.well-known/oauth-protected-resource - Agent card✗
/.well-known/agent-card.json - Agent skills✗
/.well-known/agent-skills/index.json
Publish these signals → /publishing