Logto review

Logto is an open-source authentication and identity platform for apps and APIs. It handles sign-in, single sign-on, and access control, so teams can use it instead of building those identity features into each product themselves. It supports web and mobile apps, APIs, and services, and is available as a managed cloud service or for self-hosting.

Logto supports OAuth 2.1, OIDC, and SAML. Its sign-in options include passwords, email or SMS verification codes, and social providers such as Google, Apple, and Discord. For stronger authentication, it offers passkeys, authenticator apps, and backup codes. It also includes role-based access control for global and organization-level resources, enterprise SSO integrations such as Okta and Entra, and machine-to-machine authentication for APIs, microservices, and devices.

The practical pitch is straightforward: centralize identity and access management rather than write and maintain sign-in flows in every app. Whether Logto is cheaper than a hosted alternative depends on which features and add-ons a team needs.

Logto covers more than basic login. The published feature set includes passwordless verification codes by email or SMS, social sign-in with providers such as Google, Apple, and Discord, and MFA through passkeys, authenticator apps, and backup codes. RBAC supports access rules for both global and organization-level resources, while machine-to-machine authentication covers services and APIs that do not have a user signing in.

That breadth makes it relevant to teams building several apps or separating customer and internal access. Enterprise SSO is also part of the feature set, with support for Okta, Entra, SAML, and other identity providers. The product supports standards including OAuth 2.1 and OIDC, rather than relying only on a proprietary sign-in flow.

The free tier gives teams a way to start without a listed monthly charge: it includes up to 50,000 monthly active users, 50,000 tokens, three applications, one machine-to-machine app, and one custom domain. Pro is listed at $24 per month and includes unlimited MAU and applications, which may suit production teams that have outgrown the free application or user caps. Logto also offers self-hosting for teams that prefer to run the platform themselves.

The headline Pro price is not the full cost if you need several of Logto’s listed add-ons. Pro is $24 per month, but it includes only 50,000 tokens; extra tokens cost $0.08 per 100. It includes one machine-to-machine app, with each extra app listed at $8. Other add-ons include $96 per SAML app, $48 per enterprise SSO connector, $48 for MFA across all factors, and $32 for RBAC. Organizations cost $48, and custom domains cost $48 for up to 10 domains.

That means a team needing enterprise SSO, MFA, and RBAC should price those items before treating $24 as its likely bill. The pricing page also lists each tenant as starting at $24 plus add-ons. Enterprise pricing is not published; its listed options include custom resource quotas, a custom data region, Private Cloud, an SLA, and premium and migration support.

The free tier is capped at 50,000 MAU and 50,000 tokens, with three apps, one machine-to-machine app, and one custom domain. The pricing page shows monthly prices but does not publish annual rates or a discount. The published pricing details do not specify separate pricing for self-hosting.

Logto’s Free plan costs $0 per month and includes up to 50,000 monthly active users (MAU), 50,000 tokens, three applications, one machine-to-machine app, and one custom domain. Pro is $24 per month, with unlimited MAU and applications, but its 50,000 included tokens are not unlimited: extra tokens cost $0.08 per 100. Pro also includes one machine-to-machine app, 10 webhooks, and 14-day audit log retention. Enterprise pricing is not published; its listed features include custom quotas, private cloud, an SLA, and migration support.

The move from Free to Pro is $24 per month, but add-ons can change the bill: SAML apps cost $96 each, Enterprise SSO costs $48 per connector, MFA is $48, and RBAC is $32. The pricing page says each tenant starts at $24 plus add-ons. Prices are monthly; annual rates and discounts are not published. Check which add-ons your setup needs before comparing the headline Pro price with another provider.

Logto supports OAuth 2.1, OIDC, and SAML, so check which protocols your apps and identity providers use before planning a move. Protocol support does not establish that user accounts, credentials, roles, or sessions can be transferred automatically. The published materials do not publish a migration procedure or data-export options, so confirm those details with Logto before committing. Enterprise plans list migration support, but its scope and price are not specified.

The same gaps matter if you leave: the available information does not say what export formats Logto provides or how account credentials transfer to another service. Logto is open source and can be self-hosted, but that alone does not guarantee a simple exit from Logto Cloud. The published published material includes no Reddit posts, so we can’t substantiate claims about why users leave. Ask about export, migration assistance, and any add-on costs before moving production authentication.