Logto — Open Source Authentication & Authorization for SaaS

What it is

Logto is an open-source authentication and authorization platform built on OIDC and OAuth 2.1 standards. It provides a complete identity infrastructure for SaaS applications including customizable sign-in pages, social login (Google, GitHub, Apple), enterprise SSO via SAML and OIDC, multi-factor authentication, role-based access control, and multi-tenancy with per-organization settings. Released under MPL-2.0.

Logto targets SaaS developers who need production-ready authentication without building it from scratch. It serves as an alternative to Auth0, Clerk, and Firebase Auth with full data ownership when self-hosted.

How it saves time or tokens

Logto eliminates the weeks of development typically needed to implement authentication, authorization, and user management. The pre-built sign-in UI handles all edge cases (password reset, email verification, social login flows) out of the box. Multi-tenancy support with organization management saves significant custom development for B2B SaaS products.

How to use

1. Run the Docker container with PostgreSQL connection configured.
2. Access the admin console at localhost:3002 to configure your sign-in experience and application settings.
3. Integrate with your application using the Logto SDK for your framework (React, Next.js, Vue, Express, etc.).

Example

docker run --name logto -p 3001:3001 -p 3002:3002 \
  -e DB_URL=postgres://postgres:password@host.docker.internal:5432/logto \
  ghcr.io/logto-io/logto:latest
# Admin console at http://localhost:3002
# Auth endpoint at http://localhost:3001

Related on TokRepo

• AI Tools for Security -- Authentication and security tools for applications
• AI Tools for API -- API gateway and auth tools

Common pitfalls

• The Docker container requires a PostgreSQL database; the embedded database option is for development only and does not persist data across restarts.
• OIDC redirect URIs must be configured exactly; trailing slashes or protocol mismatches cause silent authentication failures.
• Multi-tenancy (Organizations) requires the cloud plan or self-hosted enterprise setup; the basic self-hosted version has limited multi-tenancy features.