14.5k stars · MPL-2.0 · v1.43.0 (2026-08-31)
Identity service with social sign-in — because 'choose a password' is the most expensive field on the internet.
▶Repo detailsthe review · specs · pros & cons · install
What it is
An open-source identity service: hosted sign-in pages, OIDC and OAuth 2.1, social and enterprise connectors, multi-factor, role-based access and multi-tenancy. Your app redirects to it and gets a token back.
Why it matters
Every field between a YouTube viewer and their first Grasppy map is a place people quietly leave, and "choose a password" is the most expensive field on the internet. Social sign-in is the cheapest conversion win available to you right now, and Logto is one of the few options that ships connectors your Russian-speaking half actually uses — Yandex and VK alongside Google, GitHub and Apple — which is the practical form of the second-audience argument Edition 4 made. It also takes off your hands the part of authentication you should least want to own as a non-programmer: password resets, session revocation, brute-force protection, and the security bugs hiding in all three. MPL-2.0 is file-level copyleft, the mildest of the copyleft licences to live next to a commercial product.
- Social connectors covering both halves of a bilingual audience, not just the US providers.
- MPL-2.0 is markedly easier to live with commercially than the AGPL options elsewhere on this page.
- Self-hostable, with a managed cloud tier if you would rather not run another service.
- Replacing authentication in a live product is a migration, not an install. Do this before you have paying users, not after.
- A Node/TypeScript service with its own Postgres database — another container competing for the Hetzner box.
- Last release 29 May, about three months ago. Healthy, but not the weekly cadence of Lago or Scalar.
MPL-2.0 is file-level copyleft, the mildest of the copyleft licences to live next to a commercial product.
The React shell redirects to Logto; FastAPI validates the JWT on every protected route.
