Post by Florian Forster

A year ago, we moved ZITADEL from Apache 2.0 to AGPL 3.0. At the time, the conversation was almost entirely about cloud providers and "unfair value extraction." And to be honest, that was part of it. But it wasn’t the full picture. The deeper signal we were watching was AI. Looking back at our data over the last year, I’ve noticed a major shift in how developers actually find us. The traditional OSS funnel, where casual search traffic leads to discovery, is fundamentally changing. If a developer is trying to figure out which tool fits their specific use case or how to apply a solution to their architecture, they don't hit our docs first. They ask an LLM. In an era of abundant code, syntax has become a commodity. AI is great at telling you how to write a function or map an architecture. It’s terrible at being liable for it. We realized that for infrastructure software, we aren't really selling code. We’re selling "Risk Transfer." Our enterprise customers aren't paying for the login button; they’re paying for the human accountability behind it: the SLAs, the SOC 2 audits, the active CVE responses, and the security hygiene that a machine can't guarantee. This realization is what defined our "Code or Contribution" model. If you’re a developer contributing to the codebase, you help improve the core software for everyone. But if you’re an enterprise requiring us to carry the operational responsibility—the actual risk transfer—then reciprocity means contributing financially to fund that accountability. Both paths keep the project sustainable and open for everyone. Open source isn't dying, but the business model has to evolve. We’re moving from selling "features" to selling "responsibility." I wrote down some deeper thoughts on this transition and what our analytics are telling us about the "AI funnel." Link in the comments if you’re interested in the full IMO. #OpenSource #AI #Identity #Auth #IAM