Harden infrastructure security.
Logto
Self-hosted Auth0 alternative — user authentication in minutes. OIDC, social login, MFA, user management, SDKs for 20+ frameworks. One compose, no vendor lock-in.
Tech stack
Logto (MPL-2.0, ~14.3 k GitHub stars, Node.js) is the self-hosted alternative to Auth0 and Clerk for developers who need user authentication as a service but don't want to pay per-MAU or send user data to a third party.
Unlike Authelia (which adds MFA/SSO in front of existing apps via forward auth) or Authentik (a full identity provider for SSO infrastructure), Logto is an **auth SDK platform**: you integrate it into the code of your own application via a 15-line SDK snippet, and it handles the complete user lifecycle — registration, sign-in, social login (Google, GitHub, Apple…), passwordless (email magic link, SMS OTP), MFA (TOTP, WebAuthn), role-based access control, and machine-to-machine tokens.
Deployed on a ServOrbit VPS, Logto gives your apps production-grade authentication with zero subscription cost: each user session is an OIDC-compliant JWT signed by your own instance. The admin console (port 3002, accessible via SSH tunnel) lets you manage applications, users, social connectors and audit logs. Logto supports SDKs for React, Next.js, Vue, Angular, React Native, Flutter, Python, Go, PHP, .NET, Java, and more — if it can make an HTTP request, it can authenticate against Logto.
Key features
scope claim; enforce them in your API with a single middleware call, no database query needed.When to use this solution?
SaaS product with multi-tenant user accounts
You're building a SaaS product and need user registration, social login, and per-tenant role isolation — the full Auth0 feature set. Integrate the Logto React SDK in 15 lines, define your roles in the admin console, and ship user accounts on day one. Each tenant's users are isolated; you never touch a JWT verification library or a bcrypt hash.
Internal tool with SSO and MFA enforcement
Your team uses a custom Next.js dashboard and a separate FastAPI backend. Add Logto as the auth layer: the Next.js SDK handles the sign-in flow, the FastAPI middleware verifies the JWT, and the admin console enforces MFA for all users. No Okta subscription required.
Mobile app with passwordless OTP
Your Flutter or React Native app targets users who don't want to create passwords. Logto's passwordless connectors send a one-time code via SMS or magic link via email. The SDK handles the PKCE flow; your backend just verifies the JWT. No phone number database to maintain.
Machine-to-machine API authentication
Your microservices need to authenticate against each other without user interaction. Logto's machine-to-machine (M2M) applications issue client-credential tokens: your service fetches a JWT with one HTTP call, every downstream service verifies it, and the admin console shows you who called what and when.
Deploy Logto on your VPS
Guide optimized for ServOrbit Cloud VPS.
Order a ServOrbit VPS (2 GB RAM minimum)
Logto runs Node.js + PostgreSQL 17. A 2 GB VPS handles dozens of simultaneous sign-ins comfortably. Logto stores all user data (accounts, sessions, audit logs) in the PostgreSQL named volume — no external database needed.
One-click deploy from the marketplace
Open your ServOrbit dashboard → Marketplace → Security → Logto → Deploy. The two-container stack (Logto + PostgreSQL 17) starts within 30 seconds; the OIDC issuer URL is automatically set to your domain.
Complete the admin setup via SSH tunnel
Open a tunnel: ssh -L 3002:127.0.0.1:3002 root@<your-vps-ip>, then open http://localhost:3002/console in your browser. The first-run wizard asks for your admin email and password, then brings you to the dashboard.
Register your application in the admin console
In the Logto console, create an Application (choose your framework: SPA, Native, Backend, M2M). You get a Client ID and your OIDC endpoint URL. Paste them into your application's SDK configuration — that's all Logto needs from your code.
Integrate the SDK and deploy your app
Install the official SDK for your framework (@logto/react, logto-python, etc.), pass the Client ID and endpoint, and wrap your protected routes with the SDK's auth guard. Users will be redirected to your Logto sign-in page; on return, the SDK gives you a verified user object.
Frequently asked questions
Embed the deploy button
Maintaining a project that uses Logto? This button lets your readers deploy it on a VPS in one click, without reading Docker documentation.
[](https://servorbit.com/vps-cloud?template=logto&utm_source=deploy-badge&utm_medium=referral&utm_campaign=logto)<a href="https://servorbit.com/vps-cloud?template=logto&utm_source=deploy-badge&utm_medium=referral&utm_campaign=logto"><img src="https://servorbit.com/brand/deploy/button.svg" alt="Deploy Logto on ServOrbit" height="40"></a>The button points to a VPS order with the template preselected. The image is served from servorbit.com — nothing to host on your side.
Complementary solutions
Bastion Host
A secure entry point to your infrastructure. A configured, hardened SSH jump host with centralised audit logs.
Cybersecurity & BastionCrowdSec
Collaborative protection against attacks. Behavioural detection and threat-intelligence sharing with the community.
Cybersecurity & BastionFail2Ban Enhanced
Automatic blocking of intrusion attempts, with a production-optimised configuration and real-time alerts.
Need help?
Browse our help center and FAQ, or reach our team — callback, WhatsApp or email. Support in French, English and Arabic.