Configure Zitadel SSO
Create a confidential web application in Zitadel so Coolify can use the authorization code flow and request the user's OpenID profile and email address.
Zitadel SSO will be available in Coolify v4.3.0. The latest released version is v4.1.2, so this guide documents an upcoming feature that is not available in the current release.
Replace these values while following the guide:
- Coolify callback:
https://coolify.shadowarcanist.com/auth/zitadel/callback - Zitadel Base URL:
https://id.shadowarcanist.com
Set up Zitadel SSO
Create or select a Zitadel project
Open the Zitadel Console, select the organization that will own the integration, then create or open a project for Coolify.
Use project roles and user grants when only selected organization members should access Coolify.
See Zitadel's OIDC login guide if the Console navigation differs.
Add a web application
In the project, select New Application, enter a name such as Coolify, and choose Web as the application type.
Choose the authorization code flow with a client secret. For the token endpoint authentication method, select POST so the client ID and secret are sent with the token request.
Register the callback URL
Add this redirect URI:
https://coolify.shadowarcanist.com/auth/zitadel/callbackKeep development mode disabled for a production HTTPS domain, then finish creating the application.
Coolify requests the openid, profile, and email scopes.
Save the Zitadel credentials
Copy the generated Client ID and Client Secret and store the secret securely.
Record the Zitadel instance origin as the Base URL, for example https://id.shadowarcanist.com. Do not append /oauth/v2/authorize, /oauth/v2/token, or /oidc/v1/userinfo.
Configure Zitadel in Coolify
Open Settings > OAuth and find Zitadel.
| Coolify field | Zitadel value |
|---|---|
| Client ID | Zitadel web application client ID |
| Client Secret | Zitadel web application client secret |
| Redirect URI | https://coolify.shadowarcanist.com/auth/zitadel/callback |
| Base URL | Zitadel instance origin |
Select Save, then turn on Enabled for Zitadel.
Coolify may allow the provider card to be enabled before Base URL is filled. Zitadel sign-in cannot work without it because Coolify builds the authorization, token, and user information endpoints from this value.
Verify Zitadel sign-in
Open the Coolify login page in a private browser window and select Login with Zitadel. Complete authentication, then confirm that Coolify opens the account matching the Zitadel email address.
Test a user without the required project grant or provider access policy and confirm that Zitadel blocks access.