--- title: "Deploy Logto | (Just Updated) Auth0 Alternative, OIDC Identity Server, Admin Login and API Client Ready" description: "Logto auth server: OIDC, OAuth, SSO, generated admin and API client" category: "Authentication" url: https://railway.com/deploy/logto-or-just-updated-auth0-alternative- --- # Deploy Logto | (Just Updated) Auth0 Alternative, OIDC Identity Server, Admin Login and API Client Ready Logto auth server: OIDC, OAuth, SSO, generated admin and API client **[Deploy Logto | (Just Updated) Auth0 Alternative, OIDC Identity Server, Admin Login and API Client Ready on Railway](https://railway.com/template/logto-or-just-updated-auth0-alternative-)** Machine-readable deploy manifest (JSON, validated by TemplateCI): https://railway.com/deploy/logto-or-just-updated-auth0-alternative-/manifest.json - **Creator:** SuperSlowSloth - **Category:** Authentication ## Template content ### logto - **Image:** svhd/logto:1.45.0@sha256:9a9aff9423ab7863f00c881c31408e0bfe4def730bac2182d0097367002f5854 - **Start command:** `/bin/sh -c 'export ADMIN_USERNAME=admin ADMIN_PORT=3002 TRUST_PROXY_HEADER=1; echo Ly8gUmFpbHdheSBib290IHdyYXBwZXIgZm9yIExvZ3RvOiBzZWVkIG9uY2UsIHBpbiB0aGUgTWFuYWdlbWVudCBBUEkgY2xpZW50IHNlY3JldCwKLy8gY3JlYXRlIHRoZSBmaXJzdCBhZG1pbiBmcm9tIHZhcmlhYmxlcywgdGhlbiBoYW5kIG92ZXIgdG8gdGhlIHN0b2NrIHNlcnZlci4KaW1wb3J0IHsgZXhlY1N5bmMsIHNwYXduIH0gZnJvbSAnbm9kZTpjaGlsZF9wcm9jZXNzJzsKaW1wb3J0IHsgcmVhZGRpclN5bmMgfSBmcm9tICdub2RlOmZzJzsKaW1wb3J0IHsgY3JlYXRlUmVxdWlyZSB9IGZyb20gJ25vZGU6bW9kdWxlJzsKCmNvbnN0IHsKICBBRE1JTl9VU0VSTkFNRSwgQURNSU5fUEFTU1dPUkQsIE0yTV9TRUNSRVQsIERCX1VSTCwKICBQT1JUID0gJzgwODAnLCBBRE1JTl9QT1JUID0gJzMwMDInLAp9ID0gcHJvY2Vzcy5lbnY7CmNvbnN0IGxvZyA9IChtKSA9PiBjb25zb2xlLmxvZyhgW3JhaWx3YXldICR7bX1gKTsKY29uc3Qgc2xlZXAgPSAobXMpID0+IG5ldyBQcm9taXNlKChyKSA9PiBzZXRUaW1lb3V0KHIsIG1zKSk7CnByb2Nlc3MuY2hkaXIoJy9ldGMvbG9ndG8nKTsKCmNvbnN0IHBnRGlyID0gcmVhZGRpclN5bmMoJy9ldGMvbG9ndG8vbm9kZV9tb2R1bGVzLy5wbnBtJykuZmluZCgoZCkgPT4gZC5zdGFydHNXaXRoKCdwZ0AnKSk7CmNvbnN0IHsgQ2xpZW50IH0gPSBjcmVhdGVSZXF1aXJlKCcvZXRjL2xvZ3RvLycpKGAvZXRjL2xvZ3RvL25vZGVfbW9kdWxlcy8ucG5wbS8ke3BnRGlyfS9ub2RlX21vZHVsZXMvcGdgKTsKCi8vIDEuIFdhaXQgZm9yIFBvc3RncmVzLCB0aGVuIHNlZWQgKGlkZW1wb3RlbnQgd2l0aCAtLXN3ZSkuCmZvciAobGV0IGkgPSAwOyA7IGkrKykgewogIGNvbnN0IGMgPSBuZXcgQ2xpZW50KHsgY29ubmVjdGlvblN0cmluZzogREJfVVJMIH0pOwogIHRyeSB7IGF3YWl0IGMuY29ubmVjdCgpOyBhd2FpdCBjLnF1ZXJ5KCdzZWxlY3QgMScpOyBhd2FpdCBjLmVuZCgpOyBicmVhazsgfQogIGNhdGNoIChlKSB7IGF3YWl0IGMuZW5kKCkuY2F0Y2goKCkgPT4ge30pOyBpZiAoaSA+IDYwKSB0aHJvdyBlOyBhd2FpdCBzbGVlcCgyMDAwKTsgfQp9CmV4ZWNTeW5jKCducG0gcnVuIGNsaSBkYiBzZWVkIC0tIC0tc3dlJywgeyBzdGRpbzogJ2luaGVyaXQnIH0pOwoKLy8gMi4gUGluIHRoZSBzZWVkZWQgTWFuYWdlbWVudCBBUEkgY2xpZW50IChtLWRlZmF1bHQpIHRvIHRoZSBnZW5lcmF0ZWQgc2VjcmV0Lgpjb25zdCBkYiA9IG5ldyBDbGllbnQoeyBjb25uZWN0aW9uU3RyaW5nOiBEQl9VUkwgfSk7CmF3YWl0IGRiLmNvbm5lY3QoKTsKY29uc3QgdXBkID0gYXdhaXQgZGIucXVlcnkoCiAgInVwZGF0ZSBhcHBsaWNhdGlvbnMgc2V0IHNlY3JldD0kMSB3aGVyZSBpZD0nbS1kZWZhdWx0JyBhbmQgdGVuYW50X2lkPSdhZG1pbiciLCBbTTJNX1NFQ1JFVF0pOwpsb2coYG0tZGVmYXVsdCBzZWNyZXQgcGlubmVkIHJvd3M9JHt1cGQucm93Q291bnR9YCk7CmNvbnN0IHVzZXJzID0gYXdhaXQgZGIucXVlcnkoInNlbGVjdCBjb3VudCgqKTo6aW50IGFzIG4gZnJvbSB1c2VycyB3aGVyZSB0ZW5hbnRfaWQ9J2FkbWluJyIpOwphd2FpdCBkYi5lbmQoKTsKCi8vIDMuIEZpcnN0IGJvb3Qgb25seTogc3RhcnQgdGhlIHNlcnZlciBvbiBsb29wYmFjayBwb3J0cyBhbmQgcmVnaXN0ZXIgdGhlIGFkbWluLgppZiAodXNlcnMucm93c1swXS5uID09PSAwKSB7CiAgbG9nKCdubyBhZG1pbiB5ZXQsIGJvb3RzdHJhcHBpbmcnKTsKICBjb25zdCB0bXAgPSBzcGF3bignbnBtJywgWydzdGFydCddLCB7CiAgICBzdGRpbzogJ2luaGVyaXQnLCBlbnY6IHsgLi4ucHJvY2Vzcy5lbnYsIFBPUlQ6ICczMDAxJywgQURNSU5fUE9SVCB9LAogIH0pOwogIGNvbnN0IGJhc2UgPSBgaHR0cDovL2xvY2FsaG9zdDoke0FETUlOX1BPUlR9YDsKICBmb3IgKGxldCBpID0gMDsgOyBpKyspIHsKICAgIHRyeSB7IGlmICgoYXdhaXQgZmV0Y2goYCR7YmFzZX0vYXBpL3N0YXR1c2ApKS5zdGF0dXMgPT09IDIwNCkgYnJlYWs7IH0gY2F0Y2gge30KICAgIGlmIChpID4gOTApIHRocm93IG5ldyBFcnJvcignbG9ndG8gZGlkIG5vdCBjb21lIHVwIGZvciBib290c3RyYXAnKTsKICAgIGF3YWl0IHNsZWVwKDEwMDApOwogIH0KICBjb25zdCBqYXIgPSBuZXcgTWFwKCk7CiAgY29uc3QgY2FsbCA9IGFzeW5jIChtZXRob2QsIHBhdGgsIGJvZHkpID0+IHsKICAgIGNvbnN0IHJlcyA9IGF3YWl0IGZldGNoKGJhc2UgKyBwYXRoLCB7CiAgICAgIG1ldGhvZCwgcmVkaXJlY3Q6ICdtYW51YWwnLAogICAgICBoZWFkZXJzOiB7CiAgICAgICAgY29va2llOiBbLi4uamFyXS5tYXAoKFtrLCB2XSkgPT4gYCR7a309JHt2fWApLmpvaW4oJzsgJyksCiAgICAgICAgLi4uKGJvZHkgPyB7ICdjb250ZW50LXR5cGUnOiAnYXBwbGljYXRpb24vanNvbicgfSA6IHt9KSwKICAgICAgfSwKICAgICAgYm9keTogYm9keSA/IEpTT04uc3RyaW5naWZ5KGJvZHkpIDogdW5kZWZpbmVkLAogICAgfSk7CiAgICBmb3IgKGNvbnN0IGMgb2YgcmVzLmhlYWRlcnMuZ2V0U2V0Q29va2llKCkpIHsKICAgICAgY29uc3QgW2t2XSA9IGMuc3BsaXQoJzsnKTsgY29uc3QgaSA9IGt2LmluZGV4T2YoJz0nKTsKICAgICAgamFyLnNldChrdi5zbGljZSgwLCBpKSwga3Yuc2xpY2UoaSArIDEpKTsKICAgIH0KICAgIGlmIChyZXMuc3RhdHVzID49IDQwMCkgdGhyb3cgbmV3IEVycm9yKGAke21ldGhvZH0gJHtwYXRofTogJHtyZXMuc3RhdHVzfSAke2F3YWl0IHJlcy50ZXh0KCl9YCk7CiAgICByZXR1cm4gcmVzOwogIH07CiAgYXdhaXQgY2FsbCgnR0VUJywgJy9vaWRjL2F1dGg/JyArIG5ldyBVUkxTZWFyY2hQYXJhbXMoewogICAgY2xpZW50X2lkOiAnYWRtaW4tY29uc29sZScsIHJlZGlyZWN0X3VyaTogYCR7YmFzZX0vY29uc29sZS9jYWxsYmFja2AsIHJlc3BvbnNlX3R5cGU6ICdjb2RlJywKICAgIHNjb3BlOiAnb3BlbmlkIG9mZmxpbmVfYWNjZXNzIHByb2ZpbGUnLCBwcm9tcHQ6ICdjb25zZW50Jywgc3RhdGU6ICdib290c3RyYXAnLAogICAgY29kZV9jaGFsbGVuZ2U6ICdFOU1lbGhvYTJPd3ZGckVNVEpndUNIYW9lSzF0OFVSV2J1R0pTc3R3LWNNJywgY29kZV9jaGFsbGVuZ2VfbWV0aG9kOiAnUzI1NicsCiAgfSkpOwogIGF3YWl0IGNhbGwoJ1BVVCcsICcvYXBpL2V4cGVyaWVuY2UnLCB7IGludGVyYWN0aW9uRXZlbnQ6ICdSZWdpc3RlcicgfSk7CiAgY29uc3QgdiA9IGF3YWl0IGNhbGwoJ1BPU1QnLCAnL2FwaS9leHBlcmllbmNlL3ZlcmlmaWNhdGlvbi9uZXctcGFzc3dvcmQtaWRlbnRpdHknLCB7CiAgICBpZGVudGlmaWVyOiB7IHR5cGU6ICd1c2VybmFtZScsIHZhbHVlOiBBRE1JTl9VU0VSTkFNRSB9LCBwYXNzd29yZDogQURNSU5fUEFTU1dPUkQsCiAgfSk7CiAgY29uc3QgeyB2ZXJpZmljYXRpb25JZCB9ID0gYXdhaXQgdi5qc29uKCk7CiAgYXdhaXQgY2FsbCgnUE9TVCcsICcvYXBpL2V4cGVyaWVuY2UvaWRlbnRpZmljYXRpb24nLCB7IHZlcmlmaWNhdGlvbklkIH0pOwogIGF3YWl0IGNhbGwoJ1BPU1QnLCAnL2FwaS9leHBlcmllbmNlL3N1Ym1pdCcpOwogIGxvZyhgYWRtaW4gJHtBRE1JTl9VU0VSTkFNRX0gY3JlYXRlZGApOwogIHRtcC5raWxsKCdTSUdURVJNJyk7CiAgYXdhaXQgbmV3IFByb21pc2UoKHIpID0+IHRtcC5vbignZXhpdCcsIHIpKTsKfSBlbHNlIHsKICBsb2coJ2FkbWluIGV4aXN0cywgc2tpcHBpbmcgYm9vdHN0cmFwJyk7Cn0KCi8vIDQuIFJlYWwgc2VydmVyLgpjb25zdCBzcnYgPSBzcGF3bignbnBtJywgWydzdGFydCddLCB7IHN0ZGlvOiAnaW5oZXJpdCcsIGVudjogcHJvY2Vzcy5lbnYgfSk7CmZvciAoY29uc3QgcyBvZiBbJ1NJR1RFUk0nLCAnU0lHSU5UJ10pIHByb2Nlc3Mub24ocywgKCkgPT4gc3J2LmtpbGwocykpOwpzcnYub24oJ2V4aXQnLCAoY29kZSkgPT4gcHJvY2Vzcy5leGl0KGNvZGUgPz8gMCkpOwo= | base64 -d > /etc/logto/boot.mjs && exec node /etc/logto/boot.mjs'` - **Health check:** /api/status - **Public domain:** Yes ### postgres - **Image:** postgres:17@sha256:31ba9c94a03ada9988f2bb493a22a75eef3a185884533e5cdbcd498ea835b08f ### console - **Image:** caddy@sha256:d8542f48d34a9cf4e4c11a478865229840e87e4c96ea3f439101f31a5d35f75f - **Start command:** `/bin/sh -c 'printf ":%s {\n\thandle /railway_health {\n\t\trespond \"ok\" 200\n\t}\n\thandle {\n\t\treverse_proxy %s:3002 {\n\t\t\theader_up X-Forwarded-Proto https\n\t\t}\n\t}\n}\n" "$PORT" "$BACKEND_HOST" > /etc/caddy/Caddyfile && echo "[railway] port=$PORT upstream=$BACKEND_HOST:3002" && exec caddy run --config /etc/caddy/Caddyfile --adapter caddyfile'` - **Health check:** /railway_health - **Public domain:** Yes ## Documentation # Deploy and Host Logto on Railway **Built for an LLM agent to deploy and use.** There is no setup wizard and nothing to fill in: the admin password and a Management API client secret are generated at deploy time, the contract below lists every URL and variable name, and one working script gets an access token and creates an application. Logto is an open-source identity and auth server: OpenID Connect and OAuth 2.1 sign-in, single sign-on, social and enterprise connectors, multi-factor authentication, roles and organizations, with a Management API and an admin console. This template runs the official Logto image together with a PostgreSQL database and a small proxy that gives the admin console its own public address. ## About Hosting Logto This template runs three services. `logto` is the official **svhd/logto** image (pinned by digest). A boot wrapper seeds the database, sets the Management API client secret from `M2M_SECRET`, creates the first admin user from `ADMIN_PASSWORD` on first boot only, and then starts the stock server. `postgres` is the official **postgres:17** image (pinned by digest) with a volume at `/var/lib/postgresql`, reachable only on the private network. `console` is a Caddy reverse proxy with its own public domain in front of Logto's admin port, because Logto serves its admin console on a second origin. All Logto state lives in PostgreSQL, so the `logto` service needs no volume of its own. The admin user and the secret are the same after every redeploy. Allow roughly 90 seconds for the first deploy to turn healthy. ### Agent contract - Public URL: `https://` plus the `RAILWAY_PUBLIC_DOMAIN` of the `logto` service, used as `LOGTO_URL`. This origin serves the sign-in experience, the OIDC endpoints and the Management API at `/api/`. - Admin URL: `https://` plus the `RAILWAY_PUBLIC_DOMAIN` of the `console` service, used as `LOGTO_ADMIN_URL`. This origin serves the admin console at `/console` and issues Management API tokens at `/oidc/token`. - Private URL: `http://logto.railway.internal:8080` (core) and `http://logto.railway.internal:3002` (admin) - Credentials: admin console user `admin` with password in `ADMIN_PASSWORD`; Management API client id `m-default` with secret in `M2M_SECRET` (both on the `logto` service) - Auth: request a token with HTTP basic auth `m-default:M2M_SECRET`, `grant_type=client_credentials`, `resource=https://default.logto.app/api` and `scope=all` against `LOGTO_ADMIN_URL/oidc/token`, then send `Authorization: Bearer TOKEN` to `LOGTO_URL/api/` - Health: `GET /api/status` on `LOGTO_URL` returns 204 with no credentials ```bash # run with LOGTO_URL, LOGTO_ADMIN_URL and M2M_SECRET set; needs curl TOKEN=$(curl -fsS -u "m-default:$M2M_SECRET" -d grant_type=client_credentials -d resource=https://default.logto.app/api -d scope=all "$LOGTO_ADMIN_URL/oidc/token" | sed -n 's/.*"access_token":"\([^"]*\)".*/\1/p') curl -s -o /dev/null -w 'health %{http_code}\n' "$LOGTO_URL/api/status" curl -s -o /dev/null -w 'anonymous %{http_code}\n' "$LOGTO_URL/api/applications" curl -fsS -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' -d '{"name":"my-app","type":"Traditional"}' "$LOGTO_URL/api/applications" -o /dev/null -w 'create application %{http_code}\n' curl -fsS -H "Authorization: Bearer $TOKEN" "$LOGTO_URL/api/applications" | grep -o '"name":"my-app"' ``` A fresh deploy prints `health 204`, `anonymous 401`, `create application 201` and `"name":"my-app"`. Create users, roles, connectors and API resources the same way under `/api/`, or open `LOGTO_ADMIN_URL/console` and sign in as `admin`. ## Why Deploy Logto on Railway? Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it. By deploying Logto on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway. - **Agent-ready** - generated admin password and Management API secret, a contract block and one working script; no setup wizard and no open first-user registration. - **Stable login** - the admin password and API secret are the same after every redeploy. - **State survives redeploys** - users, applications and connectors live in PostgreSQL on a volume. - **Private database** - PostgreSQL has no public domain and is reached over the private network. ## Common Use Cases - **Authentication for your own product** - OIDC sign-in, social login, MFA and passwordless for a web or mobile app, as an Auth0 or Clerk alternative you host. - **Agent-driven identity management** - let an AI agent create applications, users, roles and API resources through the Management API. - **Single sign-on for internal tools** - one login and role model in front of dashboards and self-hosted apps. ## Dependencies for Logto Hosting - A PostgreSQL database (included in this template, volume at `/var/lib/postgresql`). - A second public domain for the admin console (included: the `console` proxy service). ### Deployment Dependencies - [logto-io/logto](https://github.com/logto-io/logto) - upstream project - [Logto documentation](https://docs.logto.io/) - configuration reference ## Similar templates - [Keycloak](https://railway.com/deploy/mSwigX) — Keycloak template with keywind theme + apple and discord providers - [lua-protector](https://railway.com/deploy/lua-protector) — Test deployed my project first - [bknd](https://railway.com/deploy/p4nTYL) — Feature-rich yet lightweight backend Open this page in a browser: https://railway.com/deploy/logto-or-just-updated-auth0-alternative-