canonical: https://jentic.com/apis/logto.io/logto

# Logto API references

Jentic publishes the only available OpenAPI specification for Logto API references, keeping it validated and agent-ready. Logto is an open-source identity and authentication platform, and this Cloud reference exposes operations to manage applications inside a tenant - list applications, create one, and read, patch, or delete a specific application by id. Each tenant has its own subdomain (`[tenant_id].logto.app`) so the base URL is templated.

## For AI agents

Manage Logto applications (list, create, retrieve, update, delete) inside a tenant for OIDC-based authentication setups.

## Scope

Does not handle end-user sign-in flows, MFA enrolment, role assignment, or social-connector configuration - use for provisioning and managing OIDC application records in a Logto tenant only.

## Capabilities

- List all applications configured in a Logto tenant via GET `/api/applications`
- Create a new application of a chosen type with POST `/api/applications`
- Retrieve a single application's configuration via GET `/api/applications/{id}`
- Patch an application to update redirect URIs, name, or grant types
- Delete an application from the tenant via DELETE `/api/applications/{id}`

## Use cases

### Provision a New Application

When a team launches a new product, register it with Logto by calling POST `/api/applications` with the application type (SPA, native, web, machine-to-machine) and redirect URIs. The response returns the client id and secret needed to wire up the OIDC flow.

Example prompt: POST `/api/applications` with name='Internal Dashboard', type='SPA', and redirectUris=['https://dash.example.com/callback'].

### Audit Tenant Applications

List every application configured in a tenant via GET `/api/applications` to audit which clients have access and which redirect URIs are registered. The output supports compliance reviews and removes the need to log into the Logto admin UI.

Example prompt: Call GET `/api/applications` and dump each application's id, name, type, and redirectUris to a CSV.

### Update Application Configuration

Rotate redirect URIs or rename an application by issuing PATCH `/api/applications/{id}` with only the fields that change. Logto applies a partial update so unmentioned fields stay intact and downstream OIDC flows keep working.

Example prompt: PATCH `/api/applications/abc123` with redirectUris=['https://new.example.com/callback'] to rotate the URI.

### AI Agent Application Management via Jentic

An agent that handles platform-team tickets can provision, list, and clean up Logto applications without managing the bearer token. Jentic exposes the application endpoints as MCP tools so the agent picks the right operation by intent.

Example prompt: Through Jentic, search 'create an oidc application', load Logto POST `/api/applications`, and execute with the new app's name and redirect URIs.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | `/api/applications` | List applications in the tenant |
| POST | `/api/applications` | Create a new application |
| GET | `/api/applications/{id}` | Retrieve a single application |
| PATCH | `/api/applications/{id}` | Update an application |
| DELETE | `/api/applications/{id}` | Delete an application |

## Key resources

- **Applications** — List, create, retrieve, update, and delete OIDC applications in a Logto tenant

## Why Jentic

- **Setup:** Wiring the Logto management API by hand means setting up its JWT bearer auth, resolving your per-tenant host at [tenant_id].logto.app, and shaping application provisioning request bodies yourself. Through Jentic you install once, import Logto from the API Directory, store the management token once, and your agent calls it.
- **Permission scoping:** Logto puts the application id in the URL path (`/api/applications/{id}`), so a rule can pin your agent to one application: it can read and update that application record and nothing else. You choose the operations it may call, so destructive ones like deleting an application are not included unless you add them.
- **Credential handling:** Your Logto management bearer token and tenant id are stored once, encrypted, by your own Jentic One instance and injected at execution time. They never enter the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'create an OIDC application' or 'list applications', and Jentic returns the matching Logto operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Auth0 Management API** — Mature commercial CIAM with extensive enterprise SSO support
- **Okta API** — Enterprise identity platform for both workforce and customer identity
- **Keycloak API** — Self-hosted open-source identity and access management
- **FusionAuth API** — Self-hostable or cloud auth platform with developer-friendly APIs

## FAQ

### Why is there no official OpenAPI spec for Logto API references?

Logto's full API surface is documented but the spec we have here covers the application management operations available to tenants. Jentic generates and maintains a structured spec for the subset that is most useful to agents, validated against live Logto Cloud, so AI agents and developers can call Logto API references via structured tooling. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the Logto API use?

Logto uses bearer token authentication. Pass the management API token as `Authorization: Bearer <token>`. Through Jentic the token is held in the encrypted vault and injected at execution, so it never reaches the agent's prompt.

### How do I create a new application in Logto?

Call POST `/api/applications` with the application name, type (SPA, Native, Traditional, MachineToMachine), and redirect URIs. The response returns the client id and (for confidential clients) the client secret needed for OIDC flows.

### What is the base URL pattern for Logto Cloud?

Each Logto Cloud tenant is served at `https://[tenant_id].logto.app/`. Replace `[tenant_id]` with your actual tenant id before calling any endpoint. Jentic handles this substitution when you configure the tenant id in the credential record.

### How do I list and audit applications through Jentic?

Run `pip install jentic`, search Jentic for 'list logto applications', load the GET `/api/applications` operation, and execute it. Jentic returns the JSON list of applications with their ids, types, and redirect URIs.

### What are the rate limits for the Logto management API?

The spec does not embed numeric rate limits. Logto management endpoints are intended for low-frequency administrative use, not user-facing flows; back off on HTTP 429 responses if you batch many provisioning calls.

### Can I limit what my agent is allowed to do with the Logto API references?

Yes. Jentic One is self-hosted by you, so your own rules decide which Logto operations and credentials the agent may use. Because Logto puts the application id in the URL path (`/api/applications/{id}`), you can pin the agent to a single application so it only reads or patches that record and nothing else. You also choose which operations it may call, so destructive ones like DELETE `/api/applications/{id}` stay out of reach unless you explicitly add them.