Skip to content
OpenSourceSoftware.ai
Logto logo

Logto

logto-io · Identity & access

GitHub stars

14,826
—Awaiting first sync

Awaiting first sync

No measured star history yet

What is Logto?

Logto handles authentication and authorization for SaaS products, internal tools and APIs. It implements OIDC, OAuth 2.1 and SAML so teams can add sign-in, single sign-on and permissions through SDKs and an admin console rather than writing the protocol work themselves. It can be self-hosted or used as Logto Cloud.

Logto is an open-source identity and access platform built on OIDC, OAuth 2.1 and SAML. It gives your apps ready-made sign-in flows, social and enterprise login, MFA, organizations for multi-tenant products and role-based access control, managed from an admin console. It runs on Node.js with PostgreSQL or in Docker.

Core capabilities

  • Ship sign-up, sign-in, social login, passkeys and MFA without building the screens yourself.
  • Model customers as organizations with their own roles, member invites and just-in-time provisioning.
  • Connect web, mobile, API and machine-to-machine clients with SDKs for 30+ frameworks.

Sign-in flows and user management

Logto provides pre-built sign-up and sign-in pages with social login, passkeys, magic links and multi-factor authentication, plus user management in the console. Developers can add custom claims to access and ID tokens, receive webhooks on events and give end users an account center for their own settings. SDKs cover more than 30 frameworks, including React, Next.js, Vue, Flutter, Go and Python.

  • Authentication
  • MFA
  • Passkeys
  • SDKs

Multi-tenancy, SSO and roles

Organizations let a multi-tenant product give each customer its own members, invitations and roles, with just-in-time provisioning. Enterprise SSO connectors let staff sign in through their company identity provider, and role-based access control maps permissions to API resources for both users and machine-to-machine clients. Logto can also act as a SAML identity provider for up to three SAML applications in the open-source edition.

  • Organizations
  • Enterprise SSO
  • RBAC
  • Multi-tenancy

Self-hosting and licence

Logto is licensed under MPL-2.0. It runs on Node.js with PostgreSQL 14 or newer, or from the official Docker image, with the core service on port 3001 and the admin console on port 3002. The quick Docker Compose file is for trying it out only, since its bundled database is recreated on each run. A paid self-hosted licence adds console collaborators, a mandatory MFA policy, custom sign-in UI assets, branding removal, IdP-initiated SSO and unlimited SAML apps.

  • MPL-2.0
  • Docker
  • PostgreSQL
  • Self-hosted

Where it fits

Use cases

  1. 01

    Add login to a new product

    Create an application in the Logto console, install the SDK for your framework and point it at your Logto endpoint. Turn on email, social or passkey sign-in in the sign-in experience settings.

  2. 02

    Let business customers sign in with their own directory

    Create an organization for each customer, add an enterprise SSO connector such as Azure AD or Okta, and assign organization roles. New members can be invited or provisioned just in time when they first sign in.

  3. 03

    Protect an internal API

    Register the API as a resource, define its permissions and attach them to roles. Services call it with machine-to-machine apps, and users get access tokens that carry only the scopes their roles allow.