---
title: "Deploy Zitadel"
description: "Zitadel 4.19: identity platform with OIDC, SAML, passkeys and multitenancy."
category: "Authentication"
url: https://railway.com/deploy/zitadel-2
---

# Deploy Zitadel

Zitadel 4.19: identity platform with OIDC, SAML, passkeys and multitenancy.

**[Deploy Zitadel on Railway](https://railway.com/template/zitadel-2)**

Machine-readable deploy manifest (JSON, validated by TemplateCI): https://railway.com/deploy/zitadel-2/manifest.json

- **Creator:** Agaz Self-Host
- **Category:** Authentication

## Template content

### zitadel https://raw.githubusercontent.com/zitadel/zitadel/v4.19.1/console/src/assets/icons/android-chrome-512x512.png

- **Image:** ghcr.io/zitadel/zitadel:v4.19.1
- **Start command:** `/app/zitadel start-from-init --masterkeyFromEnv --tlsMode external`
- **Health check:** /debug/ready
- **Public domain:** Yes

### Postgres https://devicons.railway.app/i/postgresql.svg

- **Image:** ghcr.io/railwayapp-templates/postgres-ssl:18

## Documentation

# Deploy and Host Zitadel on Railway

Zitadel is an open-source identity and access management platform built for multi-tenancy. It provides OpenID Connect, OAuth2 and SAML, passkeys and MFA, organizations with their own users and branding, service accounts, actions and a full API. It is an alternative to Auth0, Keycloak and Okta.

## About Hosting Zitadel

This template runs the official `ghcr.io/zitadel/zitadel:v4.19.1` image with Railway Postgres; Zitadel keeps all state in the database, so the service has no volume. The first instance, an organization and an admin user are created on first boot from Railway variables with a generated password and masterkey. Zitadel 4 normally uses a separate login container that shares a token file with the API; Railway services cannot share volumes, so this template keeps the built-in login UI. The instance domain is fixed at first boot from the Railway domain. It fits the Hobby plan for small user bases.

## Common Use Cases

- Login, MFA and passkeys for your own apps via OIDC
- B2B SaaS with separate organizations per customer
- SAML single sign-on for internal tools

## Dependencies for Zitadel Hosting

- `ghcr.io/zitadel/zitadel:v4.19.1` (official image)
- Railway Postgres

### Deployment Dependencies

- [Zitadel self-hosting docs](https://zitadel.com/docs/self-hosting/deploy/overview)
- [Zitadel v4.19.1 release](https://github.com/zitadel/zitadel/releases/tag/v4.19.1)
- [Railway Postgres](https://docs.railway.com/guides/postgresql)

### Implementation Details

| Service | Source | Networking | Storage |
| --- | --- | --- | --- |
| zitadel | `ghcr.io/zitadel/zitadel:v4.19.1` | public domain on 8080 | none (state in Postgres) |
| Postgres | Railway Postgres | private | Railway volume |

Sign in to the console at `https:///ui/console` as `admin@my-organization.`.

| Variable | Default | Purpose |
| --- | --- | --- |
| `ZITADEL_FIRSTINSTANCE_ORG_NAME` | `My Organization` | First organization |
| `ZITADEL_FIRSTINSTANCE_ORG_HUMAN_USERNAME` | `admin` | Admin username |
| `ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD` | `Zi1!` + generated | Admin password (meets the default policy) |
| `ZITADEL_MASTERKEY` | generated | Encrypts secrets in the database; never change it |
| `ZITADEL_EXTERNALDOMAIN` | Railway domain | Instance domain set on first boot |

Notes:

- After the password, Zitadel offers optional 2FA setup; you can skip it.
- To move to a custom domain, add it as an instance domain in Zitadel before switching `ZITADEL_EXTERNALDOMAIN`.
- First-instance variables only apply on the first start.

This is a community-maintained deployment package and does not imply affiliation with or endorsement by ZITADEL.

## Why Deploy Zitadel on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Zitadel on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.


## Similar templates

- [Keycloak](https://railway.com/deploy/mSwigX) — Keycloak template with keywind theme + apple and discord providers
- [lua-protector](https://railway.com/deploy/lua-protector) — Test deployed my project first
- [bknd](https://railway.com/deploy/p4nTYL) — Feature-rich yet lightweight backend

Open this page in a browser: https://railway.com/deploy/zitadel-2