14.5k stars · MPL-2.0 · v1.43.0 (2026-08-31) · Track this in Rising ↗
Identity service with social sign-in — because 'choose a password' is the most expensive field on the internet.
Radar check
What we found when we opened it. Every bar is one fact, with its date.
Last code pushed 26 Oct 2026, one day before this check.
Latest release v1.45.0 on 13 Oct 2026.
Public since June 2021, a little over 5 years.
14,797 stars and 1,204 forks.
388 commits and 42 new issues in the last 90 days.
122 contributors. 387 pull requests merged in 90 days.
A security policy says how to report a problem. 13 published security advisories.
How the bars are scored
- Alive. Days since the last code push: a week or less 100, a month 90, three months 70, six months 50, a year 30, eighteen months 15, older 0.
- Releases. Age of the latest GitHub release, on a similar scale; no bar when the project publishes no releases.
- Maturity. Age of the project: eight years 100, five 90, three 70, two 55, one 40, six months 25, younger 10.
- Adoption. Stars on a log scale: 100,000 stars is 100, 10,000 is 80, 1,000 is 60, 100 is 40.
- Activity. Commits in the last 90 days: 300 or more 100, 100 85, 30 65, 10 45, any 25.
- Community. People who have contributed: 100 or more 100, 30 80, 10 60, 5 40, 2 25, one 10.
- Security. A published security policy 80, none 40; published advisories are listed, not scored.
Checked by Repo Radar on 26 Oct 2026 from the repository on GitHub. Covered in Edition 11.
▶Repo detailsthe review · specs · pros & cons · install
What it does
The application redirects a visitor to Logto, and Logto sends back a token proving who they are. It speaks OIDC and OAuth 2.1, the two standard protocols for this, so most libraries already understand it. It provides hosted sign-in and sign-up pages that can be styled. It connects to social and enterprise accounts through a list of connectors, including Google, GitHub, Apple, and Yandex and VK for Russian-speaking visitors. It supports multi-factor sign-in, role-based access control, which means permissions attached to named roles rather than to individuals, and multi-tenancy, which means one installation serving several separate customer organisations. It takes over password resets, session revocation and protection against repeated guessing. What it does not do is store the application's own data: it answers who somebody is, and nothing about what they own.
Why it matters
Who it suits. A product being built now, before it has paying users, where sign-in should not be hand-written. It is one of the few options shipping connectors for Russian-language accounts alongside the usual American ones, which matters for a product with an audience in both places. Skip it if the product already has working sign-in and no complaints about it, because swapping identity systems on a live product moves every user record and is not worth doing without a reason.
Verdict. A good default, and the licence is the quiet reason to prefer it. MPL-2.0 is file-level copyleft, which in practice means obligations attach to the files you change rather than to the whole program, and that is markedly easier to live with commercially than the AGPL options elsewhere on this page. Version 1.44.0 landed on 30 September 2026, so it is actively maintained. Two things to know: it is a Node service with its own PostgreSQL database, so it is another two things to keep running; and the right moment to adopt it is before the first customer, not after. keycloak/keycloak is the heavier, older alternative with far more enterprise features, and zitadel/zitadel sits between the two.
Summary (Key Points)from the README
Key features
- Framework SDKs: Ready-made SDKs for 30+ frameworks, including React, Next.js, Angular, Vue, Flutter, Go, and Python.
- Protocol support: Covers OIDC, OAuth 2.1, and SAML.
- Multi-tenancy and organizations: Organization RBAC, member invites, and just-in-time provisioning.
- Enterprise SSO and identity providers: Connects to any IdP, with Google, Facebook, Azure AD, and Okta named as examples.
- Sign-in flows: Pre-built sign-up, sign-in, social login, Google One Tap, MFA, and SSO flows, plus customizable UIs.
- Integration scope: Supports SPAs, web apps, mobile apps, APIs, M2M, and CLI tools.
- AI and agent support: Stated to work out of the box with Model Context Protocol and agent-based architectures.
Ways to install
| Platform or method | What it needs | Effort |
|---|---|---|
| Logto Cloud | A Logto Cloud account; the README says it is fully managed | Zero setup |
| Launch in GitPod | A GitPod environment; wait for the "App is running at" message, then open the URL | Starts in seconds |
| Local development | Follow the OSS installation guide linked in the README; the README gives no requirements itself | Not stated in the README |
Important
- Local setup details: The README does not list system requirements or dependencies for local development. It only links to the full OSS installation guide.
- Managed versus self-hosted: Logto Cloud is vendor-managed, while the GitPod and local options run the open-source project. The README does not say whether every feature is identical across Cloud and OSS.
- Unlisted connectors: Only a few identity providers are named, and the rest are covered by "and more." Check the connectors page before relying on a specific provider.
- Claims are self-reported: Feature and framework counts come from the project's own README and have not been independently verified here.
- License: The project is licensed under MPL-2.0, so review its terms before commercial use.
Written by an AI model from the project’s README; not part of the review, and it can be wrong.
- Connectors covering both American and Russian account providers, not only the usual list.
- MPL-2.0, which is easier to live with commercially than AGPL.
- Self-hostable, with a paid hosted tier for teams that would rather not run it.
- A Node service plus its own PostgreSQL database, so two more things to keep alive.
- Replacing sign-in on a live product is a user migration, not an installation.
- Releases are roughly monthly rather than weekly, so a reported fault may wait.
MPL-2.0 is file-level copyleft, the mildest of the copyleft licences to live next to a commercial product.
git clone https://github.com/logto-io/logto.git cd logto docker compose up -d
