The first thing Florian Forster learned to troubleshoot was not a login flow. It was a vehicle. He trained in St. Gallen as a vehicle electrical and electronic engineer, where a system had wires, sensors and physical consequences. Then he moved into information technology and kept following systems inward: from administrator to technical project manager, from enterprise architecture to identity and access management, from making machinery behave to deciding how software recognizes a person.
The connection is less whimsical than it sounds. Modern authentication is also a machine full of dependencies. A user sees an email field, a password prompt, perhaps a fingerprint. The builder sees tenants, permissions, tokens, audit records, recovery paths, regional data rules and the possibility that one bad assumption becomes everybody's problem.
Forster's career accumulated those assumptions. He worked in systems administration and technical project management, including roles at thyssenkrupp Presta and Namics. At Abraxas Informatik, a Swiss public-sector technology company, he led eGovernment and identity work. Alongside the day job, he completed part-time studies in business information systems at OST and joined identity standardization efforts through Verein eCH and the OpenID Foundation. This was a practical education in the difference between a feature that demos well and infrastructure that institutions can trust.
01 / The recurring constraintA company hiding behind the login screen
In 2019, Forster and colleagues working in Swiss public-sector technology saw the gap clearly enough to build around it. The founding group included Fabienne Bühler, Maximilian Panne, Stefan Benz, Silvan Reusser, Elio Bischof, Livio Amstutz and Max Peintner. They wanted identity infrastructure made for developers, with multi-tenancy designed into the foundation and a choice between a hosted service and software customers could operate themselves.
They called it ZITADEL. The product handles authentication, authorization and user management. Its work often appears to an ordinary person as a login page, which means success can be almost invisible. The interesting parts surface when an organization grows: employees and customers need different permissions; separate clients need separate policies; auditors need a reliable history; an international business needs control over where data lives.
“Identity fundamentally shapes your entire software security posture.”Florian Forster on the mistake of treating login as a small feature
This is where Forster resists two temptations at once. Teams can oversimplify identity as a few screens and a token. They can also overcomplicate it until security becomes the enemy of use. His preferred frame is risk: understand what must be protected, then apply controls appropriate to that risk without manufacturing friction for its own sake.
The product reflects that middle path. ZITADEL supports modern identity protocols and multiple deployment models, while its event-sourced architecture records changes as an audit trail. Security is not positioned as a decorative package to add later. The original technical vision explicitly said that security features should not become a paid add-on.
02 / Open code, real economicsThe reciprocity problem
An open-source identity company has to run two systems. One is technical: publish code, review contributions, respond to issues, maintain releases. The other is economic: pay the people who keep doing all of that. ZITADEL initially used the permissive Apache 2.0 license. It helped distribution and gave the project room to attract a community. But usage grew faster than meaningful contributions back.
The team moved the project to AGPL 3.0 with version three. The change preserved access to the code while requiring organizations that modify it and offer it as a network service to make those modifications available. Forster framed the decision as protection for the investment made by both the company and the community.
His view of contribution is not limited to invoices or pull requests. A large organization may use the software without becoming a customer, then commission a penetration test and return the findings. For an identity platform, disciplined scrutiny can be a meaningful deposit into the commons. The useful unit is reciprocity: did participation leave the shared system stronger?
Open source does not eliminate exchange. It widens the acceptable currencies: code, documentation, testing, security research, community help and money. A durable project makes those routes visible and updates the bargain when participation becomes one-sided.
That public feedback loop has become part of distribution. Developers can inspect ZITADEL, run it, question it and recommend it before a procurement team enters the conversation. Forster has described a marketing mix weighted heavily toward developers because their evaluation earns the product a place in the later buying debate. The buyer may sign, but the builder often creates the shortlist.
03 / The geographic translationSwitzerland builds, San Francisco rings
Forster has a small story about time zones. Start the day in Switzerland and the rhythm is measured. Start it in San Francisco and more than 100 notifications may already be waiting. He triages, chooses priorities, keeps essential meetings and still reserves time for GitHub discussions. The contrast contains the operating map of a remote company with engineering roots in Europe and growing commercial gravity in the United States.
In early 2025, after his US visa was approved, Forster announced that he would move to the Bay Area with his family to expand ZITADEL's American footprint. The journey involved his wife, two young children, their cat and a 12-hour flight. It also involved a founder placing himself closer to customers, recruits and the language of a market he wanted the company to serve.
Language matters here in a broader sense. Forster has observed that European companies tend to understate strong work, while American marketing can sound inflated to European ears. US buyers know the convention and apply their own discount. A transatlantic founder has to translate without losing the product inside the performance.
The company itself uses geography deliberately. Core engineering has remained concentrated in Europe, US work supports go-to-market, and Argentina provides customer success and sales-engineering coverage. Remote execution spreads the talent. Founder proximity changes the signal.
“It’s infrastructure plumbing that usually only gets noticed when something breaks.”Forster, after ZITADEL returned to GitHub's daily trending list for Go
04 / Beyond the boxIdentity for users who may not be human
Forster's roadmap extends beyond the login transaction. He groups the work into integrations and workflows, analytics and intelligence, and deeper visibility for audit, forensics and threat response. The common thread is what happens after a system recognizes an identity: what it may do, how its behavior is understood and how an organization reacts when the pattern changes.
Artificial intelligence makes that boundary stranger. Forster asks who ensures that an agent operating in a browser does not simply conduct a bank transaction on a user's behalf. The question turns authentication into an opening scene. An identity system may increasingly need to distinguish a person, a service and an agent acting with delegated authority, then preserve enough evidence to explain the result.
His latest public work keeps returning to developer experience. In 2026 he demonstrated a preview that starts locally from a command line, aiming to move from an empty terminal to a working identity stack in under a minute. The promise is not that the underlying problem became simple. It is that the first encounter can be predictable while the system retains room for real complexity later.
Forster calls himself a “constructive irritant,” a person allergic to the sentence that something remains so because it has always been so. It is an apt job description for infrastructure. Progress often begins with someone willing to reopen a settled-looking layer and patient enough to live with what falls out.
His fantasy alternative career completes the picture. He once considered becoming a helicopter pilot and, after military service, working in close protection. The option that still appeals is citrus farming. He imagines data, careful agricultural practice and the chance to improve a living system. Oranges and OAuth share very little, except perhaps the mind attracted to them: watch the signals, respect the environment, improve the yield.
Back in software, the login box remains small. Forster's wager is that the infrastructure behind it can be open enough to inspect, sturdy enough to trust and calm enough that the user never has to think about the machinery. When the machinery earns that invisibility, he has a two-word response ready: back to work.