Why Logto Is Challenging the B2B Auth Status Quo

Cloud & InfraArticle

A deep look at how this open-source, OIDC-compliant identity engine tackles multi-tenancy and agentic AI architectures.

Ji-ho Choi

Building authentication from scratch is a classic developer trap. It starts simple with a basic username and password table, but quickly spirals into a complex web of multi-factor authentication, enterprise single sign-on (SSO), role-based access control (RBAC), and session management. Historically, developers faced a stark choice: deploy heavy, legacy open-source systems like Keycloak, or pay escalating premiums for proprietary SaaS platforms like Auth0.

Logto enters this space as a modern, developer-friendly alternative. Licensed under the Mozilla Public License 2.0 (MPL-2.0) and built primarily on Node.js and TypeScript, Logto positions itself as a protocol-first identity solution designed specifically for SaaS products and AI-native applications. By combining the flexibility of an open-source codebase with the polished developer experience of modern SaaS tools, it attempts to bridge the gap between self-hosted control and cloud-native convenience.

The Protocol-First Architecture #

At its core, Logto is built on OpenID Connect (OIDC) and OAuth 2.1. While many developers are familiar with OAuth 2.0, OAuth 2.1 is an important consolidation of security best practices established over the last decade. It deprecates insecure patterns like the implicit grant flow, mandates Proof Key for Code Exchange (PKCE) for all clients, and enforces strict redirect URI matching.

By adopting OAuth 2.1 out of the box, Logto bypasses the legacy technical debt that plagues older identity providers. The backend architecture is split into clean, logical boundaries. The core service, @logto/core

, handles OIDC endpoints and cryptographic operations, while the rest of the ecosystem is divided into three distinct API surfaces:

The Management API: Used by developers to programmatically manage users, organizations, and system configurations.** The Experience API**: Powers the end-user authentication flows, allowing for highly customized sign-in, sign-up, and consent screens.** The Account API**: Enables end-user self-service, such as managing multi-factor authentication (MFA) settings and personal profile data.

This separation of concerns makes it easier to decouple the identity provider from your frontend application, allowing you to use Logto's pre-built UIs or construct entirely custom authentication experiences using their SDKs.

Multi-Tenancy and the AI Agent Frontier #

For B2B SaaS, multi-tenancy is rarely an afterthought, yet many identity providers treat it as one. Logto addresses this with native "Organizations" support. Instead of duct-taping multi-tenancy using custom user metadata or separate user pools, Logto provides built-in organization templates, organization-level RBAC, member invitation workflows, and just-in-time provisioning. This allows developers to isolate tenant data and delegate administrative privileges to enterprise customers without writing custom middleware.

Beyond traditional SaaS, the rise of autonomous AI agents and developer-focused tooling has introduced new identity requirements. Traditional user-interactive login flows do not work for headless scripts, background workers, or AI agents executing tasks on behalf of a user.

To address this, Logto supports machine-to-machine (M2M) authentication and Personal Access Tokens (PATs). More notably, it includes a dedicated Model Context Protocol (MCP) server. The MCP server connects AI tools and IDEs directly to Logto, allowing autonomous agents to authenticate securely and interact with protected resources. This is a significant step forward for developers building agentic workflows, as it standardizes how AI models prove their identity and obtain scoped permissions.

Developer Integration and Self-Hosting Trade-offs #

One of Logto's strongest selling points is its low barrier to entry. For local development, you can spin up a complete instance using Docker Compose:

curl -fsSL https://raw.githubusercontent.com/logto-io/logto/HEAD/docker-compose.yml | docker compose -p logto -f - up

Alternatively, if you prefer a native Node.js environment, you can initialize the project using npm, provided you have a running PostgreSQL database:

npm init @logto

Logto provides SDKs for more than 30 frameworks, including Next.js, React, Vue, Go, and Python. This broad framework support, combined with a web-based admin console, makes it easy to transition from a local proof-of-concept to a production deployment.

However, choosing between Logto Cloud and self-hosting the open-source version requires careful consideration of operational trade-offs:

If you choose to self-host, you must manage database scaling, high availability, and security practices like Argon2 password hashing configurations and data encryption at rest. For teams that want to avoid operational overhead, Logto Cloud's free tier of 50,000 Monthly Active Users (MAUs) is exceptionally generous, making it highly competitive against Auth0's more restrictive free limits.

The Verdict #

Logto is a highly compelling option for modern development teams. By focusing on OAuth 2.1 compliance, native B2B multi-tenancy, and emerging AI integration patterns like the Model Context Protocol, it addresses the real-world pain points of contemporary software development.

For early-stage startups and independent developers, the 50K MAU free tier on Logto Cloud provides a risk-free path to production. For enterprise teams with strict data sovereignty requirements, the MPL-2.0 licensed self-hosted version offers a clear exit strategy from vendor lock-in. While managing your own identity infrastructure always carries operational risks, Logto's clean TypeScript codebase and modern API design make those risks far easier to manage than they were with the previous generation of open-source auth tools.

Sources & further reading #

logto-io/logto— github.com - Logto: Modern auth infrastructure for developers— logto.io - Introduction | Logto docs— docs.logto.io - Logto: Open-source project to build sign-in, auth, and user identity within minutes - DEV Community— dev.to

Ji-ho Choi· Security & Cloud Editor

Ji-ho covers the increasingly tangled overlap between cloud architecture and security, drawing on a background as a penetration tester to keep his reporting grounded in real-world attack paths. He never lets a vendor claim go unquestioned and insists that every buzzword come with a proof of concept.

Discussion 6 #

i'm loving the sound of logto, especially since it's built on node.js and typescript - the fact that it's tackling multi-tenancy and has oidc compliance out of the box is a total game changer for serverless auth setups 🚀

i'm intrigued by logto's approach to b2b auth, but how does it handle the egress fees when you're dealing with a large number of users and auth requests, that's where the real cost lies

@cloudbill_carl, egress fees are a concern, but have you considered just using the standard library for auth? net/http has all you need for basic auth, and if you need more, you can always add a simple middleware, no need for a full blown auth engine like logto

i've been playing around with logto and i'm impressed by how easily it handles multi-tenancy, definitely a game changer for our b2b auth needs 🚀

i'm intrigued by logto's approach to multi-tenancy, wondering how they handle conflicts and consistency in a distributed setup, especially with agentic ai architectures in the mix 🤔

@distsys_yuki yeah that's the million dollar question, scaling auth is hard