Docs/ Backend as a Service/ Authentication (Logto)

Authentication (Logto)

Managed OIDC-compliant authentication with social login, JWT tokens, and a full admin console.

Creating an Auth Server

To create a new auth instance:

  1. Navigate to the Auth Servers section in the sh0 dashboard.
  2. Click Create Auth Server.
  3. Enter a name for your auth instance (e.g., "my-app-auth").
  4. Select the PostgreSQL database server to connect to.
  5. Click Create. sh0 deploys a Logto instance with auto-SSL.
Tip
The auth server name becomes part of the domain (e.g., my-app-auth.sh0.app). Choose a descriptive name.

Connecting to PostgreSQL

Each Logto instance requires a PostgreSQL database server for storing user data, sessions, and configuration. sh0 automatically:

  • Creates a dedicated database within your PostgreSQL server.
  • Configures the connection string for Logto.
  • Runs the initial Logto migrations.

Your user data never leaves your server. It is stored in the same PostgreSQL instance you control.

Admin Console

Each Logto instance includes a full admin console accessible at your auth domain. From the console you can:

  • Manage users (create, edit, delete, reset passwords).
  • Configure sign-in experience (branding, colors, logo).
  • Set up applications and their redirect URIs.
  • Add social login connectors (Google, GitHub, etc.).
  • View audit logs and session activity.
  • Enable MFA (TOTP-based).

Sign-In Methods

Logto supports multiple sign-in methods out of the box:

MethodDescription
Email + PasswordTraditional email/password with email verification
Passwordless (Email)Magic link or verification code via email
Social LoginGoogle, GitHub, Apple, Discord, and more
Phone + SMSSMS verification code (requires SMS connector)

Social Connectors

To add a social login provider, go to the Logto admin console, navigate to Connectors, and add a new social connector. You will need the OAuth client ID and secret from the provider (e.g., Google Cloud Console, GitHub Developer Settings).

SDK Integration

Logto provides official SDKs for popular frameworks:

PlatformPackage
Browser (SPA)@logto/browser
React@logto/react
Next.js@logto/next
Vue@logto/vue
Node.js (Express)@logto/express
Pythonlogto-sdk-python

Basic integration requires two configuration values: the endpoint (your auth domain) and the appId (from the Logto admin console).

JWT Verification

Logto issues standard OIDC tokens (access token, ID token, refresh token). To verify tokens in your API:

  • Fetch the JWKS from https://<your-auth>.sh0.app/oidc/.well-known/openid-configuration.
  • Verify the token signature using the public key.
  • Check the iss, aud, and exp claims.
Tip
If you are using PostgREST, configure it with the same JWT secret or JWKS URL. Logto tokens will work directly with PostgREST's JWT verification.
Previous
PostgREST API
Next
Realtime (Centrifugo)