🎉 Introducing our July release: Logto API SDK, Secret vault for federated token storage, manage TOTP and Backup Codes via Account API, and more!
A TypeScript SDK for interacting with Logto's Management API using client credentials authentication.
How it works:
npm install @logto/apicreateManagementApi() to create a typed Management API client with your application's credentials.Highlights:
The Secret vault is a secure storage solution in Logto for managing sensitive user data, including access tokens, API keys, passcodes, and other confidential information. These secrets are typically used to access third-party services on behalf of users, making secure storage critical.
Token storage is now supported for both social and enterprise SSO connectors. When enabled, Logto stores the token set issued by the identity provider after successful authentication. Applications can then retrieve the access token later—without requiring the user to reauthenticate—to call third-party APIs.
Supported connectors:
How it works:
For more details, see the Secret vault documentation.
Users can now add TOTP and backup codes via the Account API.
POST /api/my-account/mfa-verifications/totp-secret/generate: Generate a TOTP secret.POST /api/my-account/mfa-verifications/backup-codes/generate: Generate backup codes.POST /api/my-account/mfa-verifications: Add a TOTP or backup code using the generated secret or codes.GET /api/my-account/mfa-verifications/backup-codes: Retrieve backup codes.scope parameter when generating the authorization URL for social connectors. This allows you to request additional permissions from the social provider when calling the Logto social verification endpoint. If the scope is provided, it will be used in the authorization request; otherwise, the default scope configured in the connector settings will be used.Tenant-aware foreign key constraint for organization_user_relations table
Problem
Developers could mistakenly assign a user_id from another tenant to an organization, causing 500 errors on organization user API endpoints. The original organization_user_relations table only had a foreign key constraint on users (id), allowing any existing user ID to be assigned regardless of tenant isolation.
Root Cause
Logto applies Row Level Security (RLS) on all tables to isolate tenant data access. When joining the users table with organization_user_relations, the actual user data becomes inaccessible to the current tenant due to RLS restrictions, causing user data to return null and triggering 500 server errors.
Solution
A composite foreign key constraint (tenant_id, user_id) referencing users (tenant_id, id) was added to ensure the organization-user relation's tenant ID matches the user's tenant ID. This enforces proper tenant isolation at the database level.