logto Documentation

‍🚀 Authentication and authorization infrastructure for SaaS and AI apps, built on OIDC and OAuth 2.1 with multi-tenancy, SSO, and RBAC.

14,315 stars TypeScript TypeScript 1 file · ~1,760 tokens #authentication#authorization#email#identity#jwt#login#logto#mfa
RAW Doc

Docker & Self-Hosted Deployment Verified OCI

Deploy logto on any server, homelab, or cloud container platform.

1-Click Terminal Command
bash (docker run) 
docker run -d --name logto -p 3001:3001 --restart always postgres:17-alpine
Configured Services & Ports
⚙️ postgres
image: postgres:17-alpine
⚙️ redis
image: redis:6-alpine
⚙️ s3mock
image: adobe/s3mock:4.7.0
⚙️ logto
image: build locally
🔌 Ports: 3001:3001, 3002:3002
docker-compose.yml
yaml (docker-compose.yml) 
# Docker Compose configuration for integration tests
services:
  postgres:
    image: postgres:17-alpine
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: p0stgr3s
      POSTGRES_DB: postgres
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -d postgres"]
      interval: 3s
      timeout: 3s
      retries: 20

  redis:
    image: redis:6-alpine
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 3s
      timeout: 3s
      retries: 20

  # An S3-compatible storage for the self-hosted Bring your UI tests, configured as the experience
  # blobs provider through `EXPERIENCE_BLOBS_PROVIDER` below.
  s3mock:
    image: adobe/s3mock:4.7.0
    environment:
      COM_ADOBE_TESTING_S3MOCK_STORE_INITIAL_BUCKETS: experience-blobs

  logto:
    stop_signal: SIGINT
    volumes:
      # Mount the temporary directory for storing mock connector records, which will be used by
      # the integration tests.
      - ./.integration-test-tmp:/tmp/logto
      - ./.integration-test-coverage:/coverage
    extra_hosts:
      # Add host.docker.internal for the container to access the host machine, which is required for
      # mock web server to receive webhooks from Logto.
      - "host.docker.internal:host-gateway"
    build:
      context: .
      dockerfile: Dockerfile.integration
      args:
        # Forwarded so `DEV_FEATURES_ENABLED=1 pnpm test:integration api` exercises the dev-feature
        # APIs, matching the flag the test process reads.
        dev_features_enabled: ${DEV_FEATURES_ENABLED:-}
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      s3mock:
        condition: service_started
    environment:
      DB_URL: postgres://postgres:p0stgr3s@postgres:5432/postgres
      REDIS_URL: redis://redis:6379
      SECRET_VAULT_KEK: DtPWS09unRXGuRScB60qXqCSsrjd22dUlXt/0oZgxSo=
      STATUS_API_KEY: test-status-api-key
      TRUST_PROXY_HEADER: "1"
      # The public half of the fixture ES256 key pair the self-hosted license tests sign with, so
      # the instance trusts the licenses those tests install. See
      # `packages/integration-tests/src/helpers/license.ts`.
      SELF_HOSTED_LICENSE_PUBLIC_KEY: '{"kty":"EC","crv":"P-256","x":"r79NM6kQhcFX7GZwo6gh0qGMYapn3XkwwkcdW-EWXC4","y":"XElMflsuc4fEc3iUJc-LLuVpaAWfqm-vZEb_JzZEOi8"}'
      # Webhook deliveries target the host through `host.docker.internal`, which resolves to the
      # private bridge gateway. Allow the Docker bridge ranges rather than disabling the SSRF
      # protection. CIMD cannot be enabled while an allowlist is set.
      SSRF_ALLOWED_ADDRESSES: 172.16.0.0/12,192.168.0.0/16,10.0.0.0/8
      # Written to the `systems` table by the bootstrap script before Logto starts, since provider
      # configs are only loaded on startup. See `sign-in-experience.custom-ui-assets.test.ts`.
      EXPERIENCE_BLOBS_PROVIDER: '{"provider":"S3Storage","endpoint":"http://s3mock:9090","bucket":"experience-blobs","forcePathStyle":true,"accessKeyId":"s3mock","accessSecretKey":"s3mock"}'
      COVERAGE: ${COVERAGE:-0}
      COVERAGE_REPORT_DIR: /coverage/report
      COVERAGE_TEMP_DIR: /coverage/raw
    healthcheck:
      test: ["CMD-SHELL", "nc -z localhost 3001 || exit 1"]
      interval: 3s
      timeout: 3s
      retries: 30
    ports:
      - "3001:3001"
      - "3002:3002"

1. Project Overview & Quickstart (logto-io/logto)







Logto

Logto is the modern, open-source auth infrastructure for SaaS and AI apps.

It takes the pain out of OIDC and OAuth 2.1 and makes it easy to build secure, production-ready auth with multi-tenancy, enterprise SSO, and RBAC.

Why Logto?

Built for teams scaling SaaS, AI, and agent-based platforms without the usual auth headaches.

With Logto, you get:

  • Multi-tenancy, enterprise SSO, and RBAC: ready to use, no workarounds.
  • Pre-built sign-in flows, customizable UIs, and SDKs for 30+ frameworks.
  • Full support for OIDC, OAuth 2.1, and SAML without the protocol pain.
  • Works out-of-the-box for Model Context Protocol and agent-based AI architectures.

🗺️ See all features →

Get started

Pick your path:

  • Logto Cloud: The fastest way to try Logto. Fully managed, zero setup.

  • Launch Logto in GitPod: Start Logto OSS in seconds.

    Wait for the message App is running at https://3002-...gitpod.io, then click the URL starting with https://3002- to continue.

  • Local development:

    bash
    # Using Docker Compose(requires Docker Desktop)
curl -fsSL https://raw.githubusercontent.com/logto-io/logto/HEAD/docker-compose.yml | \
docker compose -p logto -f - up

# Using Node.js (requires PostgreSQL)
npm init @logto

📚 Full OSS installation guide →

Integrate anywhere

Logto supports all your apps, APIs, and services with industry-standard protocols.

  • SDKs for 30+ frameworks: React, Next.js, Angular, Vue, Flutter, Go, Python, and more.
  • Connect to any IdP: Google, Facebook, Azure AD, Okta, and more.
  • Flexible integration: SPAs, web apps, mobile apps, APIs, M2M, CLI tools.
  • Ready for Model Context Protocol and agent-based architectures.

🚀 Explore quick starts →

🔌 See all connectors →

Showcase

Developer-first SDKs: Install in minutes with clear guides.

User-friendly auth flows: Sign-up, sign-in, social login, Google One Tap, MFA, SSO.

Multi-tenancy & organizations: Organization RBAC, member invites, just-in-time provisioning, and more.

Support Logto

If you find Logto helpful, here's how you can support us:

Licensing

MPL-2.0.

⬆️ Back to top

2. Official Technical Reference & Guides (logto-io/docs)

Logto docs

This is the official documentation repository for Logto. Here, you will find complete guides, API references, and tutorials to help you integrate and use Logto effectively.

Running the project locally

To run the documentation site locally, follow these steps:

  • Clone the repository.

    bash
    git clone https://github.com/logto-io/docs.git
cd docs

  • Install dependencies.

    We recommend using PNPM to install dependencies.

    bash
    pnpm install

  • Start the local development server.

    bash
    pnpm start

  • Open your browser and navigate to http://localhost:3000 to view the documentation.

Contributing

We welcome contributions to improve our documentation. To contribute, follow these steps:

  • Click "Edit this page" on the bottom of the documentation page you want to update.

  • Make your changes on GitHub and commit them.

    When committing the changes, make sure your commit message follows the Conventional Commits format. For example:

    txt
    docs: update the integration guide

  • Create a new branch and push your changes to it. Make sure you also have your commits signed. (Learn more about signing commits)

  • Open a pull request on GitHub.

Resources



Explore Related Technologies & Topics

View All 9,111+ Repositories →

Discover similar high-velocity repositories, agent skills, and OpenAPI specifications across the ecosystem.

#authentication Browse authentication catalog → #authorization Browse authorization catalog → #email Browse email catalog → #identity Browse identity catalog → #jwt Browse jwt catalog → #login Browse login catalog → ⚡ MCP Servers Model Context Protocol → 🧠 Agent Skills Prompt & rule files → 🔌 OpenAPI Specs REST & Swagger schemas →