Why is the admin console on port 3002 and not on the main domain?

Exposing the admin console publicly is a security risk — anyone who finds the URL can attempt to access your user database and application configuration. By binding admin to localhost:3002, only someone with SSH access to the VPS can reach it. Use `ssh -L 3002:127.0.0.1:3002 root@ ` to open a tunnel, then access http://localhost:3002/console in your browser.

Can I change the domain after the first deployment?

Not without resetting. The OIDC issuer URL (`ENDPOINT`) is embedded in every JWT Logto issues; if you change the domain, all existing tokens, client configurations and redirect URIs break. Choose your final domain before the first deployment. If you need to change it, delete the logto_db volume, re-deploy with the new domain, and reconfigure all your applications.

Which frameworks and languages does Logto support?

Logto ships official SDKs for React, Next.js, Vue, Angular, React Native, iOS (Swift), Android (Kotlin), Flutter, Python, Django, FastAPI, Go, PHP, Laravel, .NET, Java and Spring Boot. Any framework that can make HTTP redirects (OAuth 2.0) works even without an official SDK — the OIDC discovery document at /.well-known/openid-configuration lists all endpoints.

Does Logto support social login with Google and GitHub?

Yes. From the Logto admin console, go to Connectors → Social connectors and enable the providers you want (Google, GitHub, Apple, Microsoft, Discord, Facebook, LinkedIn and 30+ others). Each connector requires an OAuth App client ID and secret from the provider — a 5-minute setup on the provider side. Users then see social login buttons on the Logto sign-in page automatically.

Harden infrastructure security.

Logto

Self-hosted Auth0 alternative — add user authentication to your app in minutes. OIDC, social login, MFA, user management dashboard, SDKs for 20+ frameworks. One compose, no vendor lock-in.

2 GB RAM 1 vCPU Port 3001 Available

Tech stack

DockerNode.jsPostgreSQL 17

Minimum RAM2 GB

Minimum CPU1 vCPU

Default port3001

Compatible OSChoice of Linux distributions

Logto (MPL-2.0, ~14.3 k GitHub stars, Node.js) is the self-hosted alternative to Auth0 and Clerk for developers who need user authentication as a service but don't want to pay per-MAU or send user data to a third party.

Unlike Authelia (which adds MFA/SSO in front of existing apps via forward auth) or Authentik (a full identity provider for SSO infrastructure), Logto is an **auth SDK platform**: you integrate it into the code of your own application via a 15-line SDK snippet, and it handles the complete user lifecycle — registration, sign-in, social login (Google, GitHub, Apple…), passwordless (email magic link, SMS OTP), MFA (TOTP, WebAuthn), role-based access control, and machine-to-machine tokens.

Deployed on a ServOrbit VPS, Logto gives your apps production-grade authentication with zero subscription cost: each user session is an OIDC-compliant JWT signed by your own instance. The admin console (port 3002, accessible via SSH tunnel) lets you manage applications, users, social connectors and audit logs. Logto supports SDKs for React, Next.js, Vue, Angular, React Native, Flutter, Python, Go, PHP, .NET, Java, and more — if it can make an HTTP request, it can authenticate against Logto.

Key features

OIDC/OAuth 2.0 compliant — issue signed JWTs that any standard OAuth 2.0 library can verify; redirect flows, PKCE, token introspection and refresh tokens work out of the box with no custom code.

Social connectors — enable Google, GitHub, Apple, Microsoft, Discord, Facebook and 30+ social providers in one click from the admin console; users can sign in with their existing account without a password.

Passwordless authentication — send magic links by email or OTP codes by SMS; integrate Twilio, SendGrid, Mailgun or any SMTP provider via the connector system without touching application code.

MFA with TOTP and WebAuthn — require a second factor at sign-in or for sensitive operations; supports authenticator apps (TOTP), hardware keys (WebAuthn/FIDO2) and backup codes.

Role-based access control — define roles and permissions in the admin console and receive them in the JWT `scope` claim; enforce them in your API with a single middleware call, no database query needed.

SDKs for 20+ frameworks — official SDKs for React, Next.js, Vue, Angular, React Native, iOS (Swift), Android (Kotlin), Flutter, Python, Django, FastAPI, Go, PHP, Laravel, .NET, Java, Spring; community SDKs for Remix, SvelteKit, Nuxt.

When to use this solution?

1

SaaS product with multi-tenant user accounts

You're building a SaaS product and need user registration, social login, and per-tenant role isolation — the full Auth0 feature set. Integrate the Logto React SDK in 15 lines, define your roles in the admin console, and ship user accounts on day one. Each tenant's users are isolated; you never touch a JWT verification library or a bcrypt hash.

2

Internal tool with SSO and MFA enforcement

Your team uses a custom Next.js dashboard and a separate FastAPI backend. Add Logto as the auth layer: the Next.js SDK handles the sign-in flow, the FastAPI middleware verifies the JWT, and the admin console enforces MFA for all users. No Okta subscription required.

3

Mobile app with passwordless OTP

Your Flutter or React Native app targets users who don't want to create passwords. Logto's passwordless connectors send a one-time code via SMS or magic link via email. The SDK handles the PKCE flow; your backend just verifies the JWT. No phone number database to maintain.

4

Machine-to-machine API authentication

Your microservices need to authenticate against each other without user interaction. Logto's machine-to-machine (M2M) applications issue client-credential tokens: your service fetches a JWT with one HTTP call, every downstream service verifies it, and the admin console shows you who called what and when.

Deploy Logto on your VPS

Guide optimized for ServOrbit Cloud VPS.

01

Order a ServOrbit VPS (2 GB RAM minimum)

Logto runs Node.js + PostgreSQL 17. A 2 GB VPS handles dozens of simultaneous sign-ins comfortably. Logto stores all user data (accounts, sessions, audit logs) in the PostgreSQL named volume — no external database needed.

02

One-click deploy from the marketplace

Open your ServOrbit dashboard → Marketplace → Security → Logto → Deploy. The two-container stack (Logto + PostgreSQL 17) starts within 30 seconds; the OIDC issuer URL is automatically set to your domain.

03

Complete the admin setup via SSH tunnel

Open a tunnel: ssh -L 3002:127.0.0.1:3002 root@, then open http://localhost:3002/console in your browser. The first-run wizard asks for your admin email and password, then brings you to the dashboard.

04

Register your application in the admin console

In the Logto console, create an Application (choose your framework: SPA, Native, Backend, M2M). You get a Client ID and your OIDC endpoint URL. Paste them into your application's SDK configuration — that's all Logto needs from your code.

05

Integrate the SDK and deploy your app

Install the official SDK for your framework (@logto/react, logto-python, etc.), pass the Client ID and endpoint, and wrap your protected routes with the SDK's auth guard. Users will be redirected to your Logto sign-in page; on return, the SDK gives you a verified user object.

Frequently asked questions

Authelia adds MFA and SSO in front of existing apps via forward auth — it protects apps that have no login at all, without changing their code. Authentik is a full identity provider for centralizing SSO across your self-hosted tools (Grafana, Gitea, Nextcloud). Logto is different: it is an auth SDK platform you integrate into the code of your own application to build user registration, social login, and MFA directly into your product, exactly like Auth0 or Clerk.