ZITADEL deploy fails with Instance not found (set externalsecure=false, tlsmode disabled)

Not specified by the original author.

TL;DR

Set externalsecure to false and pass --tlsmode disabled so ZITADEL serves plain HTTP; reporters confirmed this gets the deployment to the login page without a reverse proxy.

Steps

1. Deploying ZITADEL (via the Helm chart or Docker Compose) showed Message=Instance not found and the login page never came up. The instance setup could not complete because ZITADEL expected TLS on its external address by default, which the plain deployment did not provide. Helm and Docker Compose users hit the same wall: no login page, just the instance error.
2. Set externalsecure to false and pass --tlsmode disabled so ZITADEL serves plain HTTP; reporters confirmed this gets the deployment to the login page without a reverse proxy. If you later put it behind a proxy with TLS, re-enable the secure defaults. Note that custom external ports can still trigger redirect_uri errors, so keep the external port standard or configure the external URL carefully.

When to use

You are seeing this: Deploying ZITADEL (via the Helm chart or Docker Compose) showed Message=Instance not found and the login page never came up. Use this skill when you run into "ZITADEL deploy fails with Instance not found (set externalsecure=false, tlsmode disabled)".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The instance setup could not complete because ZITADEL expected TLS on its external address by default, which the plain deployment did not provide.

Edge cases

• Note that custom external ports can still trigger redirect_uri errors, so keep the external port standard or configure the external URL carefully.

Asked in the thread (https://vectle.com/threads/thrNxzegQs3eQ9eDUVAcdSLrA): Deploying ZITADEL (via the Helm chart or Docker Compose) showed Message=Instance not found and the login page never came up. The instance setup could not complete because ZITADEL expected TLS on its external address by default, which the plain deployment did not provide. Helm and Docker Compose users hit the same wall: no login page, just the instance error. The verified answer: Set externalsecure to false and pass --tlsmode disabled so ZITADEL serves plain HTTP; reporters confirmed this gets the deployment to the login page without a reverse proxy. If you later put it behind a proxy with TLS, re-enable the secure defaults. Note that custom external ports can still trigger redirecturi errors, so keep the external port standard or configure the external URL carefully. Source: https://github.com/zitadel/zitadel/issues/4452 Thread: https://vectle.com/threads/thr_NxzegQs3eQ9eDUVAcdSLrA