What it is

Logto is an open-source authentication and authorization infrastructure for SaaS and AI applications. It is written in TypeScript, licensed under MPL-2.0, and positioned as an open alternative to Auth0. The project sits in the identity and access management ecosystem, where it provides a central service for login, consent, tokens, user directories, and access control.

The concrete problem it solves is the complexity of implementing secure sign-in and access control without building protocol handling, user management, and integration code inside each application. Logto exposes OIDC, OAuth 2.1, and SAML flows, plus pre-built sign-in experiences and SDKs, so product teams can delegate authentication to a dedicated service while keeping application logic focused on their own features.

Key capabilities

• It supports OpenID Connect, OAuth 2.1, and SAML as the core standards for authentication, authorization, and enterprise identity federation.
• It provides multi-tenancy, organizations, role-based access control, member invites, and just-in-time provisioning for SaaS products with separate customer workspaces.
• It includes pre-built sign-in flows, customizable user interfaces, social login, Google One Tap, MFA, password, passwordless, and email-related identity features.
• It offers SDKs for 30+ frameworks, including React, Next.js, Angular, Vue, Flutter, Go, and Python, for integrating applications quickly.
• It connects to external identity providers such as Google, Facebook, Azure AD, and Okta, so existing user identities can be reused.
• It supports SPAs, web applications, mobile applications, APIs, machine-to-machine flows, and CLI tools through standard protocols and flexible integration paths.
• It is designed to work with Model Context Protocol and agent-based AI architectures, which extends auth infrastructure to AI applications.

Who uses it and how

• SaaS teams use Logto as a central authentication service for customer-facing web apps and APIs, while using organizations and RBAC to manage access across tenants.
• AI platform teams use it to protect agent-based services and Model Context Protocol workflows with OIDC and OAuth 2.1 patterns.
• Developers use SDKs and connectors to add sign-in, social login, MFA, and SSO without building each flow from scratch in every framework.
• Self-hosters run it locally with Docker Compose or Node.js and PostgreSQL, or try it through GitPod and Logto Cloud before operating it in production.

Getting started

Typical installation methods include the hosted Logto Cloud option, a GitPod demo, Docker Compose, and a Node.js path using npm init @logto with PostgreSQL.

When to use it — and when not to

Logto is a good fit when a team wants an open-source alternative to Auth0 with OIDC, OAuth 2.1, SAML, multi-tenancy, and RBAC, and can operate the service itself. Self-hosting requires running PostgreSQL and configuring email, external identity providers, and application integration details, while the provided metadata lists 0 contributors and 183 open issues, so teams should validate maintenance and support before relying on it.