Logto API references
Agent-ready OpenAPI document · curated by JenticIdentity AuthAuthenticationbearer5 EndpointsREST
Know of an official OpenAPI document? Contribute it →
For Agents
Manage Logto applications (list, create, retrieve, update, delete) inside a tenant for OIDC-based authentication setups.
Use for: List all applications in my Logto tenant, Create a new SPA application in Logto, Get the redirect URIs for application abc123, Update the application name to 'Internal Dashboard'
Not supported: Does not handle end-user sign-in flows, MFA enrolment, role assignment, or social-connector configuration - use for provisioning and managing OIDC application records in a Logto tenant only.
Jentic publishes the only available OpenAPI specification for Logto API references, keeping it validated and agent-ready. Logto is an open-source identity and authentication platform, and this Cloud reference exposes operations to manage applications inside a tenant - list applications, create one, and read, patch, or delete a specific application by id. Each tenant has its own subdomain (`[tenant_id].logto.app`) so the base URL is templated.
Install Jentic One Beta
Connect the Logto API references to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Logto API references, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Flogto.io%2Flogto" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Flogto.io%2Flogto" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Logto API references API.
List all applications configured in a Logto tenant via GET /api/applications
Create a new application of a chosen type with POST /api/applications
Retrieve a single application's configuration via GET /api/applications/{id}
Patch an application to update redirect URIs, name, or grant types
Delete an application from the tenant via DELETE /api/applications/{id}
Use Cases
Patterns agents use Logto API references API for, with concrete tasks.
★ Provision a New Application
When a team launches a new product, register it with Logto by calling POST /api/applications with the application type (SPA, native, web, machine-to-machine) and redirect URIs. The response returns the client id and secret needed to wire up the OIDC flow.
POST /api/applications with name='Internal Dashboard', type='SPA', and redirectUris=['https://dash.example.com/callback'].
Audit Tenant Applications
List every application configured in a tenant via GET /api/applications to audit which clients have access and which redirect URIs are registered. The output supports compliance reviews and removes the need to log into the Logto admin UI.
Call GET /api/applications and dump each application's id, name, type, and redirectUris to a CSV.
Update Application Configuration
Rotate redirect URIs or rename an application by issuing PATCH /api/applications/{id} with only the fields that change. Logto applies a partial update so unmentioned fields stay intact and downstream OIDC flows keep working.
PATCH /api/applications/abc123 with redirectUris=['https://new.example.com/callback'] to rotate the URI.
AI Agent Application Management via Jentic
An agent that handles platform-team tickets can provision, list, and clean up Logto applications without managing the bearer token. Jentic exposes the application endpoints as MCP tools so the agent picks the right operation by intent.
Through Jentic, search 'create an oidc application', load Logto POST /api/applications, and execute with the new app's name and redirect URIs.
Key Endpoints
5 endpoints — jentic publishes the only available openapi specification for logto api references, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
GET
/api/applications
List applications in the tenant
POST
/api/applications
Create a new application
GET
/api/applications/{id}
Retrieve a single application
PATCH
/api/applications/{id}
Update an application
DELETE
/api/applications/{id}
Delete an application
GET
/api/applications
List applications in the tenant
POST
/api/applications
Create a new application
GET
/api/applications/{id}
Retrieve a single application
PATCH
/api/applications/{id}
Update an application
DELETE
/api/applications/{id}
Delete an application
Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring the Logto management API by hand means setting up its JWT bearer auth, resolving your per-tenant host at [tenant_id].logto.app, and shaping application provisioning request bodies yourself. Through Jentic you install once, import Logto from the API Directory, store the management token once, and your agent calls it.
Permission scoping
Logto puts the application id in the URL path (/api/applications/{id}), so a rule can pin your agent to one application: it can read and update that application record and nothing else. You choose the operations it may call, so destructive ones like deleting an application are not included unless you add them.
Credential isolation
Your Logto management bearer token and tenant id are stored once, encrypted, by your own Jentic One instance and injected at execution time. They never enter the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'create an OIDC application' or 'list applications', and Jentic returns the matching Logto operation with its input schema so the agent calls the right endpoint without browsing the reference docs.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Logto API references API through Jentic.
Why is there no official OpenAPI spec for Logto API references?
Logto's full API surface is documented but the spec we have here covers the application management operations available to tenants. Jentic generates and maintains a structured spec for the subset that is most useful to agents, validated against live Logto Cloud, so AI agents and developers can call Logto API references via structured tooling. Get started with Jentic One, the self-hosted execution layer.
What authentication does the Logto API use?
Logto uses bearer token authentication. Pass the management API token as `Authorization: Bearer <token>`. Through Jentic the token is held in the encrypted vault and injected at execution, so it never reaches the agent's prompt.
How do I create a new application in Logto?
Call POST /api/applications with the application name, type (SPA, Native, Traditional, MachineToMachine), and redirect URIs. The response returns the client id and (for confidential clients) the client secret needed for OIDC flows.
What is the base URL pattern for Logto Cloud?
Each Logto Cloud tenant is served at `https://[tenant_id].logto.app/`. Replace `[tenant_id]` with your actual tenant id before calling any endpoint. Jentic handles this substitution when you configure the tenant id in the credential record.
How do I list and audit applications through Jentic?
Run `pip install jentic`, search Jentic for 'list logto applications', load the GET /api/applications operation, and execute it. Jentic returns the JSON list of applications with their ids, types, and redirect URIs.
What are the rate limits for the Logto management API?
The spec does not embed numeric rate limits. Logto management endpoints are intended for low-frequency administrative use, not user-facing flows; back off on HTTP 429 responses if you batch many provisioning calls.
Can I limit what my agent is allowed to do with the Logto API references?
Yes. Jentic One is self-hosted by you, so your own rules decide which Logto operations and credentials the agent may use. Because Logto puts the application id in the URL path (/api/applications/{id}), you can pin the agent to a single application so it only reads or patches that record and nothing else. You also choose which operations it may call, so destructive ones like DELETE /api/applications/{id} stay out of reach unless you explicitly add them.
GET STARTED