# Logto

Authentication and authorization service built on OIDC and OAuth 2.1 with SSO and roles.

- Replaces: [Auth0](https://openlogs.fyi/alternatives/auth0)
- Summary: Paid customer sign-in and identity services, such as Auth0.
- Stack: TypeScript (language), PostgreSQL (database)
- Deployment: docker_compose
- License: MPL-2.0 (osi) [source](https://github.com/logto-io/logto/blob/f0748f3f9693419755452d51c8482c5d93dafc89/LICENSE)
- Business model: unknown. The README at the pinned commit does not state a business model, so it stays unknown. ([source](https://github.com/logto-io/logto/blob/f0748f3f9693419755452d51c8482c5d93dafc89/README.md), read 2026-10-22)
- Difficulty: medium. 2 services (1 database or broker: postgres), 0 volume mounts, 6 env values to set, no elevated host access. Heuristic score 4 of 11: medium.
- Requirements: not stated
- Repository: [logto-io/logto](https://github.com/logto-io/logto)

## Install

1. Docker with the Compose plugin ([source](https://github.com/logto-io/logto/blob/f0748f3f9693419755452d51c8482c5d93dafc89/docker-compose.yml))

   ```text
   A host with Docker and the Docker Compose plugin. This entry runs from a compose file.
   ```

2. Save the compose file as docker-compose.yml ([source](https://github.com/logto-io/logto/blob/f0748f3f9693419755452d51c8482c5d93dafc89/docker-compose.yml))

   ```yaml
   # This compose file is for demonstration only, do not use in prod.
   services:
     app:
       depends_on:
         postgres:
           condition: service_healthy
       image: svhd/logto:${TAG-latest}
       entrypoint: ["sh", "-c", "npm run cli db seed -- --swe && npm start"]
       ports:
         - 3001:3001
         - 3002:3002
       environment:
         - TRUST_PROXY_HEADER=1
         - DB_URL=postgres://postgres:p0stgr3s@postgres:5432/logto
         # Optional default grace period, in seconds, for OIDC private key rotation when the API
         # request omits `rotationGracePeriod`.
         - PRIVATE_KEY_ROTATION_GRACE_PERIOD
         # SSRF protection for outbound requests is enabled by default. To reach a trusted webhook,
         # SSO, or OIDC relying-party endpoint on a private network, list its address or CIDR range in
         # `SSRF_ALLOWED_ADDRESSES` (for example `10.0.0.0/8`). Setting `SSRF_PROTECTION_DISABLED=true`
         # turns the protection off entirely and also disables features that require it, such as CIMD.
         # `OIDC_PROVIDER_SSRF_PROTECTION_DISABLED` is supported as a legacy alias.
         - SSRF_ALLOWED_ADDRESSES
         - SSRF_PROTECTION_DISABLED
         - OIDC_PROVIDER_SSRF_PROTECTION_DISABLED
         # Mandatory for GitPod to map host env to the container, thus GitPod can dynamically configure the public URL of Logto;
         # Or, you can leverage it for local testing.
         - ENDPOINT
         - ADMIN_ENDPOINT
     postgres:
       image: postgres:17-alpine
       user: postgres
       environment:
         POSTGRES_USER: postgres
         POSTGRES_PASSWORD: p0stgr3s
       healthcheck:
         test: ["CMD-SHELL", "pg_isready"]
         interval: 5s
         timeout: 5s
         retries: 5
   ```

3. Set the values the compose file needs ([source](https://github.com/logto-io/logto/blob/f0748f3f9693419755452d51c8482c5d93dafc89/docker-compose.yml))

   ```text
   These variables have no default in the compose file: ADMIN_ENDPOINT, ENDPOINT, OIDC_PROVIDER_SSRF_PROTECTION_DISABLED, PRIVATE_KEY_ROTATION_GRACE_PERIOD, SSRF_ALLOWED_ADDRESSES, SSRF_PROTECTION_DISABLED. Compose reads them from the shell or from a .env file next to the compose file.
   ```

4. Start it ([source](https://github.com/logto-io/logto/blob/f0748f3f9693419755452d51c8482c5d93dafc89/docker-compose.yml))

   ```bash
   docker compose up -d
   ```

5. Open the app ([source](https://github.com/logto-io/logto/blob/f0748f3f9693419755452d51c8482c5d93dafc89/docker-compose.yml))

   ```text
   Open http://localhost:3001. The compose file publishes host port 3001 for the app service.
   ```

Compose file check: config_ok on 2026-10-22.

## Gotchas and maintenance

### Gotchas

- Some images use the latest tag or no tag: Images without a pinned version: app: svhd/logto:${TAG-latest}. A later pull can get a different version. ([source](https://github.com/logto-io/logto/blob/f0748f3f9693419755452d51c8482c5d93dafc89/docker-compose.yml), checked 2026-10-22)
- The compose file publishes host ports: Host ports: 3001 (app), 3002 (app). A port without a host address listens on all host network interfaces. ([source](https://github.com/logto-io/logto/blob/f0748f3f9693419755452d51c8482c5d93dafc89/docker-compose.yml), checked 2026-10-22)

### Signals

Computed from a GitHub snapshot taken 2026-10-22.

- Open issues and pull requests: 163
- Stars: 14743, forks: 1194
- Last push: 2026-10-22 (0 days ago)
- Latest release: v1.45.0 on 2026-10-13 (8 days ago)

## Sources

- [Repository: https://github.com/logto-io/logto](https://github.com/logto-io/logto)
- [License: https://github.com/logto-io/logto/blob/f0748f3f9693419755452d51c8482c5d93dafc89/LICENSE](https://github.com/logto-io/logto/blob/f0748f3f9693419755452d51c8482c5d93dafc89/LICENSE)
- [Business model: https://github.com/logto-io/logto/blob/f0748f3f9693419755452d51c8482c5d93dafc89/README.md](https://github.com/logto-io/logto/blob/f0748f3f9693419755452d51c8482c5d93dafc89/README.md)
- [Compose file: https://github.com/logto-io/logto/blob/f0748f3f9693419755452d51c8482c5d93dafc89/docker-compose.yml](https://github.com/logto-io/logto/blob/f0748f3f9693419755452d51c8482c5d93dafc89/docker-compose.yml)

---
Canonical: https://openlogs.fyi/tools/logto  
Last updated: 2026-10-22