---
title: "Deploy Logto"
description: "Logto — open-source auth for SaaS. OIDC, OAuth 2.1, SSO, RBAC."
category: "Authentication"
url: https://railway.com/deploy/logto-1
---

# Deploy Logto

Logto — open-source auth for SaaS. OIDC, OAuth 2.1, SSO, RBAC.

**[Deploy Logto on Railway](https://railway.com/template/logto-1)**

- **Creator:** INAPP
- **Category:** Authentication
- **Total deploys:** 2

## Template content

### Logto Admin https://avatars.githubusercontent.com/u/84981374

- **Image:** svhd/logto:latest
- **Start command:** `sh -c "npm run cli db seed -- --swe; npm run alteration deploy latest; npm start"`
- **Public domain:** Yes

### Postgres https://devicons.railway.app/i/postgresql.svg

- **Image:** postgres:17-alpine

### Logto Core https://avatars.githubusercontent.com/u/84981374

- **Image:** svhd/logto:latest
- **Start command:** `sh -c "npm run cli db seed -- --swe; npm run alteration deploy latest; npm start"`
- **Public domain:** Yes

## Documentation

[![Deploy to Railway](https://railway.app/button.svg)](https://railway.com/deploy/logto-1)

# Deploy and Host Logto on Railway

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. It takes the pain out of OIDC and OAuth 2.1 and makes it easy to build secure, production-ready auth with multi-tenancy, enterprise SSO, and RBAC.

## About Hosting Logto on Railway

This template deploys Logto with a PostgreSQL database on Railway. The Logto service runs both the Core API (port 3001) and Admin Console (port 3002) from a single process.

### Features

- **Authentication & Authorization** — OIDC, OAuth 2.1, SAML support
- **Multi-tenancy** — Built-in organization and tenant management
- **Enterprise SSO** — Connect with Azure AD, Okta, Google, and more
- **RBAC** — Role-based access control with fine-grained permissions
- **Admin Console** — Built-in admin UI for user and configuration management
- **30+ SDKs** — React, Next.js, Angular, Vue, Flutter, Go, Python, and more

## Why Deploy Logto on Railway

- **Zero-config deployment** — Postgres and internal networking are set up automatically
- **Persistent storage** — Postgres data persists across deploys via Railway volumes
- **Custom domains** — Add your own domain with automatic TLS certificates
- **Scaling** — Scale vertically or horizontally as your user base grows

## Common Use Cases

- SaaS application authentication
- Multi-tenant platforms
- Enterprise SSO integration
- API authorization with OAuth 2.1
- Mobile app authentication with OIDC

## Dependencies for Logto on Railway

This template requires the following services:

### Deployment Dependencies

- **PostgreSQL** — Required. Automatically deployed as a companion service.

## Configuration

### Environment Variables

| Variable | Default | Description |
|----------|---------|-------------|
| `PORT` | `3001` | Core app port |
| `DB_URL` | (auto) | PostgreSQL connection string (auto-configured via Railway template variables) |
| `ENDPOINT` | (auto) | Public URL for the Logto API. Leave empty to auto-detect from the Railway domain. |
| `ADMIN_ENDPOINT` | (auto) | Public URL for the Admin Console. Auto-detected from `ENDPOINT` if not set. |
| `TRUST_PROXY_HEADER` | `1` | Set to `1` when behind HTTPS proxy (default on Railway) |
| `SECRET_KEY` | (random) | Secret key for JWT token signing and cookie encryption. A random value is generated if not set. |
| `LOGTO_ADMIN_USERNAME` | (empty) | Optional: pre-set admin username for auto-provisioning on first deploy |
| `LOGTO_ADMIN_PASSWORD` | (empty) | Optional: pre-set admin password (requires `LOGTO_ADMIN_USERNAME` to be set) |

### Postgres Service

| Variable | Default | Description |
|----------|---------|-------------|
| `POSTGRES_USER` | `postgres` | Database superuser |
| `POSTGRES_PASSWORD` | `postgres` | Database password |
| `POSTGRES_DB` | `logto` | Initial database name |

## Health Check

The Logto service exposes a health endpoint at `/health`. Railway monitors this endpoint to ensure the service is running.

## Project Structure

```
├── Dockerfile              # Logto service build (uses Logto's native entrypoint)
├── railway.json            # Railway build/deploy config
├── postgres/
│   ├── Dockerfile          # Postgres service build
│   └── railway.json        # Postgres deploy config with volume mounts
└── template-vars.json      # Template variables for Railway marketplace
```

## Security Notes

- Change the default Postgres password after first deployment
- Set a strong `SECRET_KEY` environment variable for JWT token signing
- Configure a custom domain with HTTPS for production use

## Learn More

- [Logto Documentation](https://docs.logto.io)
- [Logto GitHub](https://github.com/logto-io/logto)
- [Railway Documentation](https://docs.railway.app)


## Similar templates

- [Keycloak](https://railway.com/deploy/mSwigX) — Keycloak template with keywind theme + apple and discord providers
- [lua-protector](https://railway.com/deploy/lua-protector) — Test deployed my project first
- [bknd](https://railway.com/deploy/p4nTYL) — Feature-rich yet lightweight backend

Open this page in a browser: https://railway.com/deploy/logto-1