Logto

License	FOSS problems	Maintenance	SSO	Users	Tested
MPL-2.0Copyleft license. Only the covered files must stay open — surrounding proprietary code in separate files is permitted.	Open-Core	Active	✅	Unlimited	❌

Description

Logto is a self-hosted OIDC/OAuth 2.1 identity platform with a polished admin console, aimed at giving self-hosters the same setup experience commercial providers like Auth0 or Okta offer.

Features

• OIDC, OAuth 2.1, PKCE — standards-compliant, same protocol coverage as Rauthy or Authentik.
• Social logins and passkeys out of the box, alongside standard email/password.
• Polished admin console — a noticeably more built-out UI than Rauthy's minimal footprint approach.

Usage patterns

Same role as Authentik or Rauthy here — central SSO across self-hosted apps, or skip it entirely for a handful of users where per-app accounts are simpler.

License and governance

MPL-2.0, but open-core: the free self-hosted tier is genuinely feature-complete for core authentication (unlimited users/apps, self-service MFA, SSO connectors, audit logs all included), but a commercial self-hosted license gates team/RBAC console access, tenant-wide mandatory MFA policy, custom branding, a built-in email service, IdP-initiated SSO, and unlimited SAML apps (free tier caps at 3). Same category of caveat as Authentik's own open-core model — worth confirming which side of that line any specific feature falls on before relying on it.

Conclusion

Why you would — closer to a commercial-grade admin experience than Rauthy without leaving self-hosted/open-source territory, and the free tier's core auth features aren't crippled.

Why you wouldn't — the open-core gating is real, and less mature/battle-tested in a self-hosted context than Keycloak or Authentik; worth weighing against Authentik specifically, which is already deployed here and would mean a second, redundant identity provider rather than a clear upgrade.

Sources: PkgPulse's Logto/Ory/Keycloak comparison, Logto self-hosted plans