{
  "schema_version": 1,
  "generated_at": "2026-10-22T00:00:00.000Z",
  "canonical_url": "https://openlogs.fyi/tools/logto",
  "slug": "logto",
  "name": "Logto",
  "tagline": "Authentication and authorization service built on OIDC and OAuth 2.1 with SSO and roles.",
  "replaces": {
    "summary": "Paid customer sign-in and identity services, such as Auth0.",
    "products": [
      {
        "slug": "auth0",
        "name": "Auth0",
        "vendor": "Okta",
        "url": "https://openlogs.fyi/alternatives/auth0"
      }
    ]
  },
  "stack": [
    {
      "kind": "language",
      "name": "TypeScript"
    },
    {
      "kind": "database",
      "name": "PostgreSQL"
    }
  ],
  "deployment_methods": [
    "docker_compose"
  ],
  "requirements": {
    "min_ram_mb": null,
    "min_cpu_cores": null,
    "source_url": null
  },
  "license": {
    "spdx": "MPL-2.0",
    "class": "osi",
    "source_url": "https://github.com/logto-io/logto/blob/f0748f3f9693419755452d51c8482c5d93dafc89/LICENSE"
  },
  "business_model": {
    "value": "unknown",
    "notes": "The README at the pinned commit does not state a business model, so it stays unknown.",
    "source_url": "https://github.com/logto-io/logto/blob/f0748f3f9693419755452d51c8482c5d93dafc89/README.md",
    "checked_at": "2026-10-22"
  },
  "difficulty": {
    "value": "medium",
    "reason": "2 services (1 database or broker: postgres), 0 volume mounts, 6 env values to set, no elevated host access. Heuristic score 4 of 11: medium."
  },
  "repository": {
    "owner": "logto-io",
    "name": "logto",
    "url": "https://github.com/logto-io/logto"
  },
  "compose_check": {
    "status": "config_ok",
    "validated_at": "2026-10-22",
    "summary": "config_ok on 2026-10-22"
  },
  "recipe": {
    "version": 1,
    "source_path": "docker-compose.yml",
    "source_repo": "logto-io/logto",
    "source_commit_sha": "f0748f3f9693419755452d51c8482c5d93dafc89",
    "source_kind": "app_repo",
    "source_url": "https://github.com/logto-io/logto/blob/f0748f3f9693419755452d51c8482c5d93dafc89/docker-compose.yml"
  },
  "install_steps": [
    {
      "order": 1,
      "kind": "prerequisite",
      "language": "text",
      "label": "Docker with the Compose plugin",
      "body": "A host with Docker and the Docker Compose plugin. This entry runs from a compose file.",
      "source_url": "https://github.com/logto-io/logto/blob/f0748f3f9693419755452d51c8482c5d93dafc89/docker-compose.yml",
      "validation_status": "unvalidated"
    },
    {
      "order": 2,
      "kind": "compose",
      "language": "yaml",
      "label": "Save the compose file as docker-compose.yml",
      "body": "# This compose file is for demonstration only, do not use in prod.\nservices:\n  app:\n    depends_on:\n      postgres:\n        condition: service_healthy\n    image: svhd/logto:${TAG-latest}\n    entrypoint: [\"sh\", \"-c\", \"npm run cli db seed -- --swe && npm start\"]\n    ports:\n      - 3001:3001\n      - 3002:3002\n    environment:\n      - TRUST_PROXY_HEADER=1\n      - DB_URL=postgres://postgres:p0stgr3s@postgres:5432/logto\n      # Optional default grace period, in seconds, for OIDC private key rotation when the API\n      # request omits `rotationGracePeriod`.\n      - PRIVATE_KEY_ROTATION_GRACE_PERIOD\n      # SSRF protection for outbound requests is enabled by default. To reach a trusted webhook,\n      # SSO, or OIDC relying-party endpoint on a private network, list its address or CIDR range in\n      # `SSRF_ALLOWED_ADDRESSES` (for example `10.0.0.0/8`). Setting `SSRF_PROTECTION_DISABLED=true`\n      # turns the protection off entirely and also disables features that require it, such as CIMD.\n      # `OIDC_PROVIDER_SSRF_PROTECTION_DISABLED` is supported as a legacy alias.\n      - SSRF_ALLOWED_ADDRESSES\n      - SSRF_PROTECTION_DISABLED\n      - OIDC_PROVIDER_SSRF_PROTECTION_DISABLED\n      # Mandatory for GitPod to map host env to the container, thus GitPod can dynamically configure the public URL of Logto;\n      # Or, you can leverage it for local testing.\n      - ENDPOINT\n      - ADMIN_ENDPOINT\n  postgres:\n    image: postgres:17-alpine\n    user: postgres\n    environment:\n      POSTGRES_USER: postgres\n      POSTGRES_PASSWORD: p0stgr3s\n    healthcheck:\n      test: [\"CMD-SHELL\", \"pg_isready\"]\n      interval: 5s\n      timeout: 5s\n      retries: 5\n",
      "source_url": "https://github.com/logto-io/logto/blob/f0748f3f9693419755452d51c8482c5d93dafc89/docker-compose.yml",
      "validation_status": "config_ok"
    },
    {
      "order": 3,
      "kind": "env",
      "language": "text",
      "label": "Set the values the compose file needs",
      "body": "These variables have no default in the compose file: ADMIN_ENDPOINT, ENDPOINT, OIDC_PROVIDER_SSRF_PROTECTION_DISABLED, PRIVATE_KEY_ROTATION_GRACE_PERIOD, SSRF_ALLOWED_ADDRESSES, SSRF_PROTECTION_DISABLED. Compose reads them from the shell or from a .env file next to the compose file.",
      "source_url": "https://github.com/logto-io/logto/blob/f0748f3f9693419755452d51c8482c5d93dafc89/docker-compose.yml",
      "validation_status": "unvalidated"
    },
    {
      "order": 4,
      "kind": "shell",
      "language": "bash",
      "label": "Start it",
      "body": "docker compose up -d",
      "source_url": "https://github.com/logto-io/logto/blob/f0748f3f9693419755452d51c8482c5d93dafc89/docker-compose.yml",
      "validation_status": "unvalidated"
    },
    {
      "order": 5,
      "kind": "verify",
      "language": "text",
      "label": "Open the app",
      "body": "Open http://localhost:3001. The compose file publishes host port 3001 for the app service.",
      "source_url": "https://github.com/logto-io/logto/blob/f0748f3f9693419755452d51c8482c5d93dafc89/docker-compose.yml",
      "validation_status": "unvalidated"
    }
  ],
  "notes": [
    {
      "kind": "gotcha",
      "title": "Some images use the latest tag or no tag",
      "body": "Images without a pinned version: app: svhd/logto:${TAG-latest}. A later pull can get a different version.",
      "source_url": "https://github.com/logto-io/logto/blob/f0748f3f9693419755452d51c8482c5d93dafc89/docker-compose.yml",
      "checked_at": "2026-10-22"
    },
    {
      "kind": "gotcha",
      "title": "The compose file publishes host ports",
      "body": "Host ports: 3001 (app), 3002 (app). A port without a host address listens on all host network interfaces.",
      "source_url": "https://github.com/logto-io/logto/blob/f0748f3f9693419755452d51c8482c5d93dafc89/docker-compose.yml",
      "checked_at": "2026-10-22"
    }
  ],
  "signals": {
    "captured_at": "2026-10-22",
    "stars": 14743,
    "forks": 1194,
    "open_issues": 163,
    "last_push": "2026-10-22",
    "days_since_push": 0,
    "latest_release": "v1.45.0",
    "latest_release_date": "2026-10-13",
    "days_since_release": 8
  },
  "links": {
    "html": "https://openlogs.fyi/tools/logto",
    "markdown": "https://openlogs.fyi/tools/logto.md",
    "json": "https://openlogs.fyi/tools/logto.json"
  },
  "updated_at": "2026-10-22"
}