Logto — Open Source Authentication & Authorization for SaaS

What Logto Does

Logto handles the entire authentication and authorization lifecycle:

• Sign-in Experience: Customizable login pages with email/password, phone OTP, social login (Google, GitHub, Apple, etc.), and passwordless options
• Multi-tenancy: Organizations with member management, invitation flows, and per-org settings
• Single Sign-On (SSO): Enterprise SSO with SAML and OIDC federation for connecting corporate identity providers
• Access Control: Role-based access control (RBAC) with API resource permissions and organization-level roles
• Multi-factor Authentication: TOTP authenticator apps, WebAuthn/passkeys, and backup codes

Architecture

┌──────────────┐     ┌──────────────┐     ┌──────────────┐
│  Your App    │────▶│  Logto Core  │────▶│  PostgreSQL  │
│  (SDK)       │     │  (OIDC/OAuth)│     │  (Users/Orgs)│
└──────────────┘     └──────┬───────┘     └──────────────┘
                            │
                     ┌──────┴───────┐
                     │ Admin Console│
                     │  (React SPA) │
                     └──────────────┘

Integration Example (Next.js)

npm install @logto/next

// app/api/logto/[action]/route.ts
import { handleSignIn, handleSignOut, handleCallback } from '@logto/next/server-actions';
import { logtoConfig } from './config';

export { handleSignIn, handleSignOut, handleCallback };

// logto.config.ts
export const logtoConfig = {
  endpoint: 'http://localhost:3001',
  appId: 'your-app-id',
  appSecret: 'your-app-secret',
  baseUrl: 'http://localhost:3000',
  cookieSecret: 'your-cookie-secret',
  cookieSecure: process.env.NODE_ENV === 'production',
};

// app/page.tsx
import { getLogtoContext } from '@logto/next/server-actions';

export default async function Home() {
  const { isAuthenticated, claims } = await getLogtoContext(logtoConfig);

  return isAuthenticated ? (
    <div>Welcome, {claims?.name}</div>
  ) : (
    <a href="/api/logto/sign-in">Sign In</a>
  );
}

SDKs Available

Logto provides official SDKs for all major platforms:

Self-Hosting

Docker Compose

services:
  logto:
    image: ghcr.io/logto-io/logto:latest
    ports:
      - "3001:3001"  # Core API
      - "3002:3002"  # Admin Console
    environment:
      DB_URL: postgres://logto:logto@postgres:5432/logto
      ENDPOINT: http://localhost:3001
      ADMIN_ENDPOINT: http://localhost:3002
    depends_on:
      - postgres

  postgres:
    image: postgres:16
    environment:
      POSTGRES_USER: logto
      POSTGRES_PASSWORD: logto
      POSTGRES_DB: logto
    volumes:
      - pg-data:/var/lib/postgresql/data

volumes:
  pg-data:

Logto vs Alternatives

FAQ

Q: How many users can Logto handle? A: Self-hosted Logto runs on PostgreSQL and easily handles millions of users. The Cloud version uses a distributed architecture for even larger scale.

Q: Is it hard to migrate from Auth0 to Logto? A: Logto follows OIDC standards and provides user import APIs and compatible SDK interfaces. Most apps can migrate by simply swapping the SDK and configuration.

Q: Does it support machine-to-machine (M2M) authentication? A: Yes. Logto supports the client_credentials grant for service-to-service auth — great for microservices and API gateways.