Logto OpenID Connect Provider
Open-source identity and access management platform for SaaS and AI apps, built on OpenID Connect and OAuth 2.1. Offers a hosted sign-in experience with passwordless, social, passkey and enterprise SSO (SAML and OIDC) options, multi-factor authentication, organizations for multi-tenant B2B apps, RBAC and API protection, and can act as a SAML identity provider. Webhooks, custom token claims and Actions cover extensibility, and SDKs and quick starts span 30+ frameworks. Available as Logto Cloud (Free, Pro and Enterprise plans) or self-hosted under the MPL-2.0 license.
Features
If you want to compare OpenID Connect features of different providers, please check out the OpenID Connect Providers benchmark.
Looking for Logto’s (C)IAM features like MFA, SSO, and user management? View Logto on the (C)IAM Identity Providers benchmark.
Frequently Asked Questions
Does Logto support the Authorization Code grant type?
Logto supports Authorization Code grant type. Read more
Does Logto support the Refresh Token grant type?
Logto supports Refresh Token grant type. Needs the offline_access scope. Rotation is enabled by default. Read more
Does Logto support the Client Credentials grant type?
Logto supports Client Credentials grant type. Used by machine-to-machine applications. Read more
Does Logto support the Implicit grant type?
Logto does not support Implicit grant type. Logto only registers the authorization code, refresh token, client credentials, token exchange and device code grants. Read more
Does Logto support the Token Exchange grant type?
Logto supports Token Exchange grant type. RFC 8693 token exchange, used for impersonation and service-to-service delegation. Read more
Does Logto support the Client Initiated BackChannel Authentication grant type?
Logto does not support Client Initiated BackChannel Authentication grant type.
Does Logto support the Device Authorization Grant grant type?
Logto supports Device Authorization Grant grant type. Read more
Does Logto support the JWT Bearer Token grant type?
Logto does not support JWT Bearer Token grant type.
Does Logto support the SAML 2.0 Bearer Assertion grant type?
Logto does not support SAML 2.0 Bearer Assertion grant type.
Does Logto support the Resource Owner Password Credentials grant type?
Logto does not support Resource Owner Password Credentials grant type.
Does Logto support the PKCE extension?
Logto supports PKCE extension. S256 only. Required for every client that does not use client_secret_basic. Read more
Does Logto support the PAR extension?
Logto does not support PAR extension.
Does Logto support the JAR extension?
Logto does not support JAR extension. The discovery document advertises request_uri_parameter_supported as false.
Does Logto support the Authorization Endpoint endpoint?
Logto supports Authorization Endpoint endpoint. Read more
Does Logto support the Token Endpoint endpoint?
Logto supports Token Endpoint endpoint. Read more
Does Logto support the UserInfo Endpoint endpoint?
Logto supports UserInfo Endpoint endpoint. Served at /oidc/me. Read more
Does Logto support the Token Revocation endpoint?
Logto supports Token Revocation endpoint. Read more
Does Logto support the Token Introspection endpoint?
Logto supports Token Introspection endpoint. Read more
Does Logto support the Device Authorization Endpoint endpoint?
Logto supports Device Authorization Endpoint endpoint. Served at /oidc/device/auth. Read more
Does Logto support the OpenID Connect Discovery Endpoint endpoint?
Logto supports OpenID Connect Discovery Endpoint endpoint. Per-tenant document at /oidc/.well-known/openid-configuration. Read more
Does Logto support the OAuth 2.0 Authorization Server Metadata Endpoint endpoint?
Logto does not support OAuth 2.0 Authorization Server Metadata Endpoint endpoint. No RFC 8414 document was found at /.well-known/oauth-authorization-server on a default tenant.
Does Logto support the none token endpoint authentication method?
Logto supports none token endpoint authentication method. Public clients such as SPAs and native apps, using PKCE. Read more
Does Logto support the client_secret_basic token endpoint authentication method?
Logto supports client_secret_basic token endpoint authentication method. Used by traditional web and machine-to-machine applications. Read more
Does Logto support the RP-initiated Logout feature?
Logto supports RP-initiated Logout feature. End-session endpoint, plus OIDC back-channel logout. Read more
Does Logto support the Dynamic Client Registration Protocol feature?
Logto does not support Dynamic Client Registration Protocol feature. The registration feature is not enabled. Client ID Metadata Documents are supported instead. Read more
Does Logto support the Refresh Token Rotation feature?
Logto supports Refresh Token Rotation feature. Configurable per application. Read more
Does Logto support the OAuth 2.0 Demonstrating Proof of Possession (DPoP) feature?
Logto does not support OAuth 2.0 Demonstrating Proof of Possession (DPoP) feature. DPoP is explicitly disabled until Logto officially supports it. Read more
Compare with other providers
Note: The current data is based on provider documentation/experience and may not be 100% accurate.