Logto review

Logto is an identity platform available as Logto Cloud or as software for self-hosting. It sits between your applications and users, handling authentication and issuing identity information and tokens that apps and APIs can use. Rather than building sign-in flows and account management into each product, a team can centralize those functions in Logto.

Its protocol surface includes OAuth 2.1, OpenID Connect (OIDC), and SAML. The product covers password and passwordless sign-in, social providers, multi-factor authentication, enterprise single sign-on, role-based access control, organizations, and machine-to-machine authentication. The homepage also presents Logto as an identity provider for third-party applications, with a consent flow.

That makes it relevant to web and mobile apps, APIs, and services that need user or service authentication. It is not just a client library: the hosted option is a managed identity service, while self-hosting puts deployment and operations in your stack. Teams should choose between those models based on their infrastructure and control requirements.

Integration centers on the OAuth 2.1, OIDC, and SAML protocols, plus Logto’s Management API. The homepage says Logto works with 20+ frameworks and names Next.js, React.js, Vue.js, Android, Swift, Go, .NET Core, Nuxt, SvelteKit, Python, and Vanilla JS, alongside a no-code option. It also refers to web and native SDKs. Confirm the specific SDK and supported versions in the vendor’s docs before choosing a framework.

The Management API is the surface for managing Logto programmatically; the homepage does not identify a CLI. It also names webhooks as a Pro-plan feature, with 10 included. For application sign-in, use the documented integration for your framework and the relevant standard protocol. For administrative automation, review the Management API documentation and webhook behavior.

The homepage points developers to framework integrations and describes a clean Management API. Check the vendor’s docs for examples, SDK maintenance, API behavior, and upgrade guidance that fit your language and deployment model.

The Free plan costs $0 per month and includes up to 50,000 monthly active users (MAU), 50,000 tokens, three applications, one machine-to-machine app, and one custom domain. Those caps matter when a product adds environments, client apps, or service identities. A free trial is not listed.

Pro starts at $24 per month and includes unlimited MAU and applications, 50,000 tokens, one machine-to-machine app, 10 webhooks, and 14-day audit log retention. Extra tokens cost $0.08 per 100. The listed add-ons include an extra machine-to-machine app for $8 each, a SAML app for $96, MFA for $48, RBAC for $32, and organizations for $48. Enterprise SSO costs $48 per connector. Custom domains cost $48 for up to 10 domains.

These add-ons can make the real bill higher than the Pro starting price, particularly for B2B products using SSO, MFA, or organizations. Enterprise pricing is custom and includes options such as a custom data region, Private Cloud, an SLA, and premium and migration support. Prices are monthly; the pricing page does not list annual rates or a discount.

Logto describes itself as open-source and self-hosting-ready, and provides Logto Cloud as a hosted alternative. Self-hosting can give a team more control over where the identity service runs, but also means taking responsibility for deployment, updates, backups, and availability. Check the repository’s current licence and deployment documentation before making that choice; the homepage does not name a licence.

Logto uses established protocols, including OAuth 2.1, OIDC, and SAML, which can reduce dependence on proprietary sign-in flows. That does not automatically make a migration simple: user records, password credentials, linked social identities, application configuration, and authorization rules all need a migration plan. Confirm which data can be exported and in what format before storing production accounts in the service.

For a hosted deployment, also establish how tenant data and configuration move between Logto Cloud and a self-hosted instance. Avoid treating protocol compatibility as a substitute for testing account and permission migration.

The Free plan’s 50,000 MAU allowance is not the only production limit: it also caps tokens at 50,000, applications at three, machine-to-machine apps at one, and custom domains at one. Pro removes the MAU and application caps, but includes 50,000 tokens before extra-token charges apply. Ask Logto for the rate limits and capacity guidance relevant to your traffic; the pricing information does not list request limits.

The homepage says Logto Cloud runs in the EU, Australia, US, and Japan, and describes the service as SOC 2 Type II certified with high availability, TLS, and database encryption. Enterprise offers an SLA and custom data region. Confirm which region, controls, and SLA terms apply to your plan and deployment.

Reddit discussion about Logto is mostly positive about an open-source, standards-based identity option. One commenter asked how it compares with Keycloak, while another described OIDC as a way to avoid apps handling users’ passwords directly. These are opinions, not production reliability reports; plan your own checks for recovery, incident response, and migration.