Logto IAM Provider
Open-source identity and access management platform for SaaS and AI apps, built on OpenID Connect and OAuth 2.1. Offers a hosted sign-in experience with passwordless, social, passkey and enterprise SSO (SAML and OIDC) options, multi-factor authentication, organizations for multi-tenant B2B apps, RBAC and API protection, and can act as a SAML identity provider. Webhooks, custom token claims and Actions cover extensibility, and SDKs and quick starts span 30+ frameworks. Available as Logto Cloud (Free, Pro and Enterprise plans) or self-hosted under the MPL-2.0 license.
Features
- Argon2BcryptMD5SHA1SHA256PBKDF2
- DockerNode.jsLogto Private Cloud
If you want to compare IAM features of different providers, please check out the (C)IAM Identity Providers benchmark.
Looking for Logto’s OpenID Connect protocol compatibility? View Logto on the OpenID Connect Providers benchmark.
Frequently Asked Questions
Does Logto support Username and Password authentication method?
Logto supports Username and Password authentication method. Username, email or phone number sign-in with a password. Sign-up and sign-in identifiers are configurable. Read more
Does Logto support Social Sign-in authentication method?
Logto supports Social Sign-in authentication method. Social connectors such as Google, Apple, GitHub, Discord, Slack and LinkedIn, plus generic OIDC and OAuth 2.0 connectors. The Free plan is limited to 3 social connectors. Read more
Does Logto support Passkey authentication method?
Logto supports Passkey authentication method. Passkey sign-in. Not available on the Free plan. Read more
Does Logto support Email Passwordless authentication method?
Logto supports Email Passwordless authentication method. Verification code sent by email, through the email connectors. Read more
Does Logto support Phone Passwordless authentication method?
Logto supports Phone Passwordless authentication method. Verification code sent by SMS, through the SMS connectors. Read more
Does Logto support Magic Link authentication method?
Logto supports Magic Link authentication method. Email magic links, available on every plan. Read more
Does Logto support Time-based One-Time Password (TOTP) MFA?
Logto supports Time-based One-Time Password (TOTP) MFA. Authenticator app one-time passwords. MFA is a paid add-on on the Pro plan. Read more
Does Logto support WebAuthn MFA?
Logto supports WebAuthn MFA. Passkeys, security keys and biometrics as a second factor. Read more
Does Logto support Email Code MFA?
Logto supports Email Code MFA. One-time code sent by email. Read more
Does Logto support Phone Code MFA?
Logto supports Phone Code MFA. One-time code sent by SMS. Read more
Does Logto support Recovery Code MFA?
Logto supports Recovery Code MFA. One-time backup codes for emergency access. Read more
Does Logto support Step-Up Authentication MFA?
Logto supports Step-Up Authentication MFA. Security verification asks the user to verify again before sensitive actions. Read more
Does Logto support OpenID Connect (OIDC) integration protocol?
Logto supports OpenID Connect (OIDC) integration protocol. OpenID Connect and OAuth 2.0 provider built on node-oidc-provider. Third-party OIDC applications cost $8 each on the Pro plan. Read more
Does Logto support SAML 2.0 integration protocol?
Logto supports SAML 2.0 integration protocol. SAML applications with Logto acting as the identity provider. Not on the Free plan; $96 per SAML app on Pro. Read more
Does Logto support Machine-to-Machine (M2M) Authentication integration protocol?
Logto supports Machine-to-Machine (M2M) Authentication integration protocol. Machine-to-machine applications use the client credentials grant. The Free plan includes 1 M2M app, and extra apps cost $8 each on Pro. Read more
Does Logto support OpenID Connect (OIDC) Federation identity federation?
Logto supports OpenID Connect (OIDC) Federation identity federation. Enterprise SSO connectors for any OIDC provider, plus a generic OIDC social connector. Enterprise SSO is a paid add-on on Pro. Read more
Does Logto support SAML 2.0 Federation identity federation?
Logto supports SAML 2.0 Federation identity federation. Enterprise SSO connectors for any SAML provider, with SP-initiated and IdP-initiated SSO and email-domain routing. Read more
Does Logto support Azure Active Directory (Entra ID) identity federation?
Logto supports Azure Active Directory (Entra ID) identity federation. Pre-built Microsoft Entra ID enterprise SSO connector, and an Azure AD social connector. Read more
Does Logto support Bulk User Import user management?
Logto partially supports Bulk User Import user management. Users are imported one by one with the Management API create user endpoint, which is rate limited. There is no dedicated bulk or file import. Read more
Does Logto support Password Hash Import (Multiple Formats) user management?
Logto supports Password Hash Import (Multiple Formats) user management. Argon2 is the native format. Bcrypt, MD5, SHA1, SHA256 and PBKDF2 hashes are accepted, and the Legacy format covers any hash algorithm supported by Node.js. Imported hashes are rehashed with Argon2 on first sign-in. Read more
Does Logto support Just-In-Time (JIT) User Provisioning user management?
Logto supports Just-In-Time (JIT) User Provisioning user management. Enterprise SSO users are added to their organizations and roles on first sign-in, with no invitation needed. Read more
Does Logto support Lazy / Trickle Migration from Legacy Database user management?
Logto supports Lazy / Trickle Migration from Legacy Database user management. The Post first-factor verification Action checks credentials against a legacy system on first password sign-in, then stores a Logto password hash. Actions are only on Logto Cloud Enterprise plans. Read more
Does Logto support Self-Service Profile Management Portal user management?
Logto supports Self-Service Profile Management Portal user management. Account center, with Account APIs for building a custom profile page. Included on every plan. Read more
Does Logto support User Account Linking user management?
Logto supports User Account Linking user management. Social identities can be linked to and unlinked from a user. Enterprise SSO identities are linked by email address. Read more
Does Logto support User Blocking / Banning user management?
Logto supports User Blocking / Banning user management. Users can be suspended from the Console or the Management API. Read more
Does Logto support User Metadata user management?
Logto supports User Metadata user management. Custom data field on each user, readable and writable through the Console and Management API. Read more
Does Logto support User Search user management?
Logto supports User Search user management. Search by username, ID, full name, phone number or email in the Console, and advanced search through the Management API. Read more
Does Logto support Role-Based Access Control (RBAC) user management?
Logto supports Role-Based Access Control (RBAC) user management. User roles and M2M roles with permissions. A paid add-on on Pro; the Free plan has no RBAC. Read more
Does Logto support Organizations (Multi-Tenancy B2B) user management?
Logto supports Organizations (Multi-Tenancy B2B) user management. Organizations with members, invitations, organization roles and permissions, JIT provisioning and organization-level MFA. A paid add-on on Pro. Read more
Does Logto support Password Strength Policies user management?
Logto supports Password Strength Policies user management. Minimum length, character types, repetition, user information and custom word rules, plus a Have I Been Pwned check. Read more
Does Logto support Progressive Profiling / Forms user management?
Logto partially supports Progressive Profiling / Forms user management. Optional collection of user profile fields during sign-up, on Pro and above. There is no multi-step progressive profiling after sign-in. Read more
Does Logto support API Authorization (Scopes / Permissions) access control?
Logto supports API Authorization (Scopes / Permissions) access control. API resources with permissions, requested through the resource indicator and scopes. API resources are not on the Free plan; Pro includes 3 and charges $4 per extra one. Read more
Does Logto support Audit Log Retention security feature?
Logto supports Audit Log Retention security feature. Retention is 3 days on Free and 14 days on Pro. Enterprise is custom. Read more
Does Logto support Encryption at Rest security feature?
Logto supports Encryption at Rest security feature. Databases are encrypted at rest. Read more
Does Logto support Encryption in Transit security feature?
Logto supports Encryption in Transit security feature. TLS is required. Read more
Does Logto support Bot Detection security feature?
Logto supports Bot Detection security feature. CAPTCHA with Google reCAPTCHA or Cloudflare Turnstile, part of the Advanced security bundle add-on on Pro. Read more
Does Logto support Brute Force Protection security feature?
Logto supports Brute Force Protection security feature. Identifier lockout after repeated failed attempts, part of the Advanced security bundle add-on on Pro. Read more
Does Logto support Breached Password Detection security feature?
Logto supports Breached Password Detection security feature. The password policy can reject passwords exposed in data breaches, using Have I Been Pwned. Read more
Does Logto support Per-Organization Branding multi-tenancy?
Logto partially supports Per-Organization Branding multi-tenancy. The docs mention dedicated sign-in pages for specific applications or organizations, without further detail. Read more
Does Logto support Per-Organization MFA Policy multi-tenancy?
Logto supports Per-Organization MFA Policy multi-tenancy. Organization-level MFA is included with the Organizations add-on. Read more
Does Logto support Hosted / Universal Login Page branding feature?
Logto supports Hosted / Universal Login Page branding feature. Hosted sign-in experience with sign-up and sign-in flows, social, SSO and MFA. Read more
Does Logto support Embedded / Native Login Components branding feature?
Logto partially supports Embedded / Native Login Components branding feature. Bring-your-UI lets you upload a custom sign-in front end that Logto Cloud hosts, backed by the Experience API. It is not an embeddable component library. Read more
Does Logto support White-Label / Full Brand Removal branding feature?
Logto supports White-Label / Full Brand Removal branding feature. Logto branding can be hidden. Not available on the Free plan. Read more
Does Logto support Localization / i18n branding feature?
Logto supports Localization / i18n branding feature. 15 languages by default, with additional languages and editable translations. Read more
Does Logto support SOC 2 Type II Certification compliance?
Logto supports SOC 2 Type II Certification compliance. Logto states it is SOC 2 Type II certified for Security, Availability and Confidentiality. Read more
Does Logto support HIPAA Business Associate Agreement (BAA) compliance?
Logto supports HIPAA Business Associate Agreement (BAA) compliance. HIPAA/BAA is listed on the Enterprise plan. Read more
Does Logto support GDPR: Data Export (Portability) compliance?
Logto partially supports GDPR: Data Export (Portability) compliance. Logto says it helps customers export their data. User data can be read through the Management API, but no dedicated export tool is documented. Read more
Does Logto support GDPR: Right to be Forgotten (User Deletion) compliance?
Logto supports GDPR: Right to be Forgotten (User Deletion) compliance. Users can be deleted from the Console or the Management API. Read more
Does Logto support Region Deployment compliance?
Logto supports Region Deployment compliance. Logto Cloud tenants can be hosted in Europe, Australia or the US. Custom data regions are an Enterprise option. Read more
Does Logto support Private Cloud Deployment compliance?
Logto supports Private Cloud Deployment compliance. Self-hosted OSS with Docker Compose or Node.js and PostgreSQL, and Logto Private Cloud on the Enterprise plan. Read more
Does Logto support SDK Coverage developer integration?
Logto supports SDK Coverage developer integration. SDKs and quick starts for 30+ frameworks, including React, Next.js, Angular, Vue, Nuxt, SvelteKit, Express, Flutter, iOS, Android, .NET, Go, Python, PHP, Ruby and Java Spring Boot. Read more
Does Logto support Management API developer integration?
Logto supports Management API developer integration. REST Management API with an OpenAPI reference, plus Experience and Account APIs. Read more
Does Logto support Actions / Extensibility Pipeline developer integration?
Logto supports Actions / Extensibility Pipeline developer integration. Actions run trusted JavaScript synchronously at Post first-factor verification and Post sign-in. Only on Logto Cloud Enterprise plans. Read more
Does Logto support TypeScript Support in Extensibility developer integration?
Logto partially supports TypeScript Support in Extensibility developer integration. The Actions editor provides TypeScript type information, but the saved script runs as JavaScript. Read more
Does Logto support Custom Domain developer integration?
Logto supports Custom Domain developer integration. Custom domain for sign-in and sign-up URLs. 1 is included on Free and Pro, and Pro adds up to 10 for $48. Read more
Does Logto support Native Webhook Support developer integration?
Logto supports Native Webhook Support developer integration. Asynchronous webhooks for user, role, permission, organization and user-interaction events. Free allows 1 webhook and Pro allows 10. Read more
Does Logto support Universal Login / Hosted Login Page Customization developer integration?
Logto supports Universal Login / Hosted Login Page Customization developer integration. Brand colors and logo, custom CSS, and bring-your-UI with an uploaded front end. Read more
Does Logto support Custom Email Provider (SMTP) developer integration?
Logto supports Custom Email Provider (SMTP) developer integration. Email connectors for SMTP, SendGrid, Mailgun, Postmark, AWS SES and others, plus an HTTP email connector. Read more
Does Logto support Custom OIDC Claims / Token Enrichment developer integration?
Logto supports Custom OIDC Claims / Token Enrichment developer integration. Custom claims for access tokens (JWT or opaque) through a getCustomJwtClaims script, and for ID tokens. Not available on the Free plan. Read more
Does Logto support Agentic AI / MCP Server Authentication feature?
Logto partially supports Agentic AI / MCP Server Authentication feature. Positioned for Model Context Protocol and agent-based architectures as an OIDC and OAuth 2.1 provider. A Logto MCP server manages Logto Cloud tenants from AI tools. MCP-specific authorization flows were not verified. Read more
Compare with other providers
Note: The current data is based on provider documentation/experience and may not be 100% accurate.