A Logto alternative where roles, organizations and MFA are included

Pick Logto if you want the whole product open source and ready to self-host (its homepage says so), passkeys and authenticator apps, enterprise single sign-on connectors for Okta, Entra and SAML, a sign-in experience you configure rather than write, a free plan of up to 50,000 users on its pricing page, and a choice of four regions including Europe (Netherlands). Its DPA is accepted by using the service, with no wait. For a developer who wants to own the whole stack, Logto is closer to that than we are, because only our engines are open, not the layer we built.

Pick Nautilus if you would rather not add up a bill: roles, organizations, two-factor and an audit log are included here, where Logto sells each as an add-on. Pick us if you want unused accounts deleted for you after a warning, data on servers in France, and webhooks, scheduled jobs and Telegram sign-in under the same account.

The difference in money is small. See the arithmetic below, which includes where Logto is cheaper.

Checked 2026-10-15. "Ahead" says who is ahead on that row.

Source: https://logto.io/pricing, with https://docs.logto.io/logto-cloud/billing-and-pricing, checked 2026-10-15. Logto prices per tenant and bills in tokens: the Pro plan is from $24 a month with 50,000 tokens included, then $0.08 per 100 extra tokens ($8 per 10,000). Only access tokens count; they are issued at sign-in, for role-based and organization authorization, for machine-to-machine requests, for token exchange and when refresh tokens are used. So the cost depends on how your users sign in and call your API, not on a count of people.

Pro add-ons, each a monthly price: RBAC $32, Organizations $48, multi-factor authentication (all factors) $48, enterprise SSO $48 per connector, advanced security bundle $48, custom domains $48 for up to 10, extra tenant members $8 each. Enterprise is "Contact sales".

The last column is $24 + $32 + $48 + $48.

How to read it

• On the pricing page the Free plan lists "up to 50K" monthly active users and 50K tokens. Its feature table shows Free without RBAC, organizations or MFA (all three are paid add-ons on Pro), with one webhook and 3 days of audit log; so Free is cheaper only if you need none of those.
• Tokens are not users. At 1,000 or 10,000 users who sign in once a month, the tokens fit inside the 50,000 included. At 50,000 users with one sign-in each, you are on the line. Each extra 10,000 tokens costs $8, so the overage is small.
• With the add-ons, Logto is $152 against our $110.83 at 10,000 users. That is about $41 a month. Without them, Logto is $24 and we are not cheaper.

• Logto (checked 2026-10-15, https://docs.logto.io/logto-cloud/tenant-settings and the DPA at https://logto.io/terms/dpa): the tenant settings docs list four regions, Europe (Netherlands), West US (Arizona), Australia East and Japan East. The region is chosen when a tenant is created and cannot be changed afterwards. Its privacy policy says Customer Data is stored in the region you select. The DPA is between Silverhand Inc. and the customer and lists subprocessors in a section we did not read in full.
• Nautilus: servers in France, at OVHcloud, one region, no choice. A DPA based on the Standard Contractual Clauses comes with Pro.
• Verne Software is registered in Serbia; the servers are in France.
• Logto's Europe region is in the Netherlands and ours is in France. On the residency question the two are alike; Logto also lets you pick Australia or Japan.

Logto's own answer to "what if the vendor goes away" is the strongest on this list: the product is open source and you can run all of it. Ours is partial.

• What is open on our side: Ory Kratos and Svix. You can read and run them.
• What is not: the layer we built on top: organizations, roles, rules, audit log, signed-token service, dashboard. And the scheduler is our own code. Every job and run stays readable through the API.
• Users: readable through the API. For all of them with their password hashes, ask support from your account address and you get one file within 7 days, encrypted to your own key, with social links, metadata, organizations and roles as well. It is in the format our own import accepts and that maps onto Ory Kratos (how it works). A person on our side runs it; there is no button and no API call for it.
• If "I can run the entire product myself" is a requirement, choose Logto. If "I can take the identity engine and the webhook engine with me" is enough, we qualify.

Scenario: 10,000 active users; roles, organizations and two-factor. The line that decides is sign-in against sign-in. Prices as of 2026-10-15.

At 50,000 users Logto stays at $152 on its pricing page, plus $8 for every 10,000 tokens beyond 50,000. Our Advanced plan: €199 (≈ $222.78).

Not in the sum: webhooks you send to your own customers and scheduled jobs. Nautilus Pro includes both (1,000,000 webhook messages and 1,000 recurring jobs a month). Elsewhere they are services of their own: for example Svix Professional (DPA and SOC 2, 50,000 messages included) from $490 a month, and a scheduler such as cron-job.org, which is free, donation-funded, and does not state where it is hosted or whether it has a DPA. We leave them out of the sum because the comparison that decides is sign-in against sign-in.

What the arithmetic does and does not show

• Logto has its own webhooks for its own events; a webhook service such as Svix is for the webhooks you send to your customers, which is why it is outside this sum.
• If you drop the add-ons you do not need, Logto's side gets cheaper. If you need two of the three, the gap shrinks. We assumed all three, because that is the set our pricing page is built around.
• The free tiers, taken one by one ($0 for Logto Free, Svix Free and cron-job.org), are cheaper than we are. They stop being the right comparison when you need the paid features together.