whichdevtool?
Menu
StacksDirectory Pricing changes Glossary
VPS and cloud servers App hosting and PaaS Managed databases Transactional email APIs Email marketing and newsletters Domain registrars CDN, DNS and edge security Monitoring, uptime and error tracking Auth and identity Frontend and full-stack frameworks Backend frameworks UI component libraries AI model APIs File and object storage Payments and billing Background jobs, queues and workflows ORMs and database toolkits

Open-source OIDC auth (cloud or self-hosted) · by Silverhand (Logto)

Logto

Open-source OIDC and OAuth 2.1 auth with organizations, enterprise SSO and RBAC, free to 50,000 MAU on Logto Cloud and billed by access tokens after that.

Visit logto.io ↗ Alternatives Open source Open source Self-hostable EU region
Logto homepage
§1

Overview

Logto is open-source authentication built on OIDC and OAuth 2.1, aimed at SaaS and AI apps. It covers password, passwordless email and SMS codes, social sign-in, passkeys, MFA, organizations for multi-tenancy, enterprise SSO over SAML and OIDC, RBAC, M2M apps, personal access tokens, impersonation, and the option to act as an identity provider for third-party apps. SDKs cover more than 20 frameworks, and there is a Management API.

You can self-host Logto for free or use Logto Cloud, which runs in EU, Australia, US and Japan regions and is SOC 2 Type II certified. The free cloud plan allows up to 50,000 monthly active users and 50,000 access tokens a month, but lacks MFA, SSO, RBAC and organizations.

Pro is $24 a month with unlimited MAU and bills extra access tokens at $0.08 per 100 beyond 50,000. Most B2B features are add-ons: MFA is $48 a month, each enterprise SSO connector $48, organizations $48 and RBAC $32. A B2B app wanting all of them should budget roughly $200 a month or more before usage.

§2

Pricing and plans

Free tier · no card

Logto Cloud Free: up to 50,000 MAU, 50,000 access tokens a month, 3 applications, 1 M2M app, 3 social connectors, 1 custom domain; no MFA, SSO or RBAC. Self-hosting is free.

At the limit Not stated The vendor does not say what happens at the limit, or we have not found it yet.

Their branding
Plan Price What you get
Self-hosted Free Open source
Free Free 50,000 MAU, 50,000 tokens, 3 apps, 3 social connectors
Pro $24/mo Unlimited MAU and apps, 50,000 tokens then $0.08 per 100, passkeys, branding removal
Enterprise Custom Custom data region, private cloud, SLA, premium and migration support

Pro usage is billed on access tokens issued, not MAU: 50,000 included, then $0.08 per 100. Add-ons on Pro: MFA $48/mo (all factors), enterprise SSO $48/mo per connector, organizations $48/mo, global RBAC $32/mo, SAML apps $96 each, third-party OIDC apps $8 each, extra M2M apps $8, extra API resources $4, up to 10 custom domains $48.

Source: logto.io/pricing · prices as published, excluding tax.

§3

What it does

Organizations
Multi-tenancy with organization roles and permissions, invitations, JIT provisioning and org-level MFA (Pro add-on).
Enterprise SSO
SAML and OIDC connectors to Okta, Entra and other IdPs at $48 per connector per month.
Be an identity provider
Third-party OIDC/OAuth apps with consent screens and Logto as a SAML IdP.
Account API and center
APIs and a prebuilt account center for end users' security settings.
Secret Vault
Stores OAuth tokens from social providers for calling third-party APIs.
Regions
Logto Cloud in EU, US, Australia and Japan; custom regions on Enterprise.
§4

Strengths and limitations

Strengths

  • 50,000 MAU free on the hosted plan
  • Open source and self-hostable
  • EU hosting region available on all cloud plans
  • Low $24/mo base price with published add-on prices

Limitations

  • MFA, SSO, organizations and RBAC are each paid add-ons on Pro
  • Free plan allows only 3 applications and 3 social connectors
  • Pro usage is billed on access tokens, which is harder to forecast than MAU
  • Passkey sign-in is not on the free plan
§5

Who it suits

Good for

  • Side projects needing hosted auth for up to 50,000 users
  • B2B SaaS wanting OIDC, SSO and multi-tenancy with an open-source exit
  • Teams needing EU-hosted auth

Look elsewhere if

  • Free-plan apps that need MFA
  • Teams that want every B2B feature in one flat price
§6

Pricing history

  • Logto Free plan loses RBAC and halves included tokens

    Effective 2025-10-01: Free plan included tokens drop from 100,000 to 50,000 a month and role-based access control is removed from Free (Pro add-on only). Free still allows up to 50,000 MAU. Source ↗

  • Logto stops counting refresh tokens, raises Pro base to $24

    Announced 2025-09-01: refresh tokens no longer count toward token usage, and the Pro plan base price moves from $16 to $24/mo with RBAC as a $32/mo add-on, starting with billing cycles after 1 October 2025. Source ↗

§7

Alternatives to Logto

Tool From Free option Stages
Nhost Postgres + GraphQL backend platform
$25/mo Free tier
Kinde Hosted auth with billing and feature flags
$25/mo Free tier
Clerk Hosted auth and user management
$25/mo Free tier
Supabase Managed Postgres backend platform
$25/mo Free tier
Asgardeo Hosted CIAM (with open-source self-hosted option)
$20/mo Free tier
Better Auth Open-source TypeScript auth library
$20/mo Free tier

All auth and identity →

§8

Questions

Is Logto free?

Logto Cloud is free up to 50,000 MAU with core features, and the open-source version is free to self-host.

How much does Logto Pro cost?

$24 a month plus usage: 50,000 access tokens included, then $0.08 per 100.

Does Logto charge for enterprise SSO?

Yes, on Pro each enterprise SSO connector is $48 a month.

Where is Logto Cloud hosted?

In EU, US, Australia and Japan regions.

Sources read for this page