Logto
Identity & accessAdd sign-in, single sign-on and access control to your apps and APIs.
Logto handles authentication and authorization for SaaS products, internal tools and APIs. It implements OIDC, OAuth 2.1 and SAML so teams can add sign-in, single sign-on and permissions through SDKs and an admin console rather than writing the protocol work themselves. It can be self-hosted or used as Logto Cloud.
- Ship sign-up, sign-in, social login, passkeys and MFA without building the screens yourself.
- Model customers as organizations with their own roles, member invites and just-in-time provisioning.
- Connect web, mobile, API and machine-to-machine clients with SDKs for 30+ frameworks.
What people use it for
Add login to a new product
Create an application in the Logto console, install the SDK for your framework and point it at your Logto endpoint. Turn on email, social or passkey sign-in in the sign-in experience settings.
Let business customers sign in with their own directory
Create an organization for each customer, add an enterprise SSO connector such as Azure AD or Okta, and assign organization roles. New members can be invited or provisioned just in time when they first sign in.
Protect an internal API
Register the API as a resource, define its permissions and attach them to roles. Services call it with machine-to-machine apps, and users get access tokens that carry only the scopes their roles allow.