Zitadel (Beta)
Beta Feature
Zitadel integration is currently in Beta. It is fully functional for OIDC customer/affiliate authentication and user migration, with continuous enhancements being added.
Zitadel is an OIDC identity provider supported by CMP for customer and affiliate login. Configuration is stored in Admin → Settings → Social Login → Zitadel.
Two credential types
| Credential | Used for | Where it comes from |
|---|---|---|
| Client ID + Client Secret | End-user OIDC login (Web application) | Zitadel project → Web app → Code (confidential) |
| Personal Access Token (PAT) | Admin API — user creation, migration | Zitadel machine user (service account) |
Do not mix credentials
The Web application's Client Secret is not the machine-user PAT. Using the Client Secret as --pat= causes invalid_client / authentication failures on migration.
Setup flow (high level)
- Create Zitadel instance and Web application — redirect URIs, JWT tokens, refresh token
- Save Client ID, Client Secret, and Base URL in CMP Social Login
- Create machine user and PAT — required for migrating existing CMP users
- User migration — existing accounts are migrated by the StackConsole team
- Set Keycloak Status to Inactive in Social Login if Zitadel is the sole active SSO provider
Configuration summary
Replace {APP_URL} with your CMP frontend base URL (no trailing slash unless your deployment uses one).
| Setting | Required value |
|---|---|
| Application type | Web |
| Authentication method | Code (confidential / Basic) |
| Redirect URI 1 | {APP_URL}/socialite/zitadel/callback |
| Redirect URI 2 | {APP_URL}/socialite/zitadel/handle-callback |
| Redirect URI 3 | {APP_URL}/affiliate/socialite/zitadel/callback |
| Redirect URI 4 | {APP_URL}/affiliate/socialite/zitadel/handle-callback |
| Development Mode | Enable only when {APP_URL} uses http:// |
| Post Logout Redirect URIs | Leave empty |
| Auth token type | JWT |
| Refresh token | Enabled |
| User info in ID token | Recommended: Enabled |
Client ID vs Application UUID
The Web application's Client ID shown in Zitadel is not the Application UUID in the browser URL. Copy the Client ID from the application details screen.
Pages in this section
- Setup — instance, Web app, CMP Social Login
- Machine user & PAT — permissions for user migration
- User migration — migrate existing CMP users