Console SSO
Console SSO lets your team sign in to Logto Cloud Console with your company's identity provider (IdP), such as Microsoft Entra ID, Okta or Google Workspace. Members whose email domain you verify are sent to your IdP when they sign in to Logto Cloud.
Console SSO only covers sign-in to Logto Cloud itself. To let your own users sign in to your applications with their company's IdP, use Enterprise SSO in your tenant instead.
How Console SSO works
- It belongs to your account, not a tenant. A Console SSO connector is owned by the Logto Cloud account that created it, and only that account can manage it. Tenant plans, downgrades and tenant deletion don't affect it.
- It doesn't grant tenant access. Signing in with SSO proves who someone is. They still need an invitation or membership to open a tenant. See tenant member management.
- It's billed to your account. Connectors are charged per connector through your own subscription, separately from any tenant plan. See Pricing and billing.
Set up Console SSO
Create a connector
- In Logto Cloud Console, open the user menu in the top-right corner and select Single sign-on. The Console SSO page opens in a new tab.
- Click Add connector and choose your identity provider.
- For your first connector, choose a billing account and complete the payment in Stripe Checkout. Later connectors are added to the same subscription without another checkout.
- The connector opens on its configuration page.
Configure the connection
On the Connection tab, enter the settings from your IdP. The fields are the same as for Enterprise SSO connectors in a tenant:
- OIDC: register the Redirect URI shown on the page in your IdP, then enter the issuer, client ID and client secret.
- SAML: give your IdP the service provider metadata shown on the page, then enter your IdP's metadata.
On the SSO Experience tab, you can change the display name shown on the sign-in page.
Verify your email domains
Console SSO only applies to email domains you prove you own.
-
On the SSO Experience tab, enter a domain, such as
example.com, and click Add domain. -
Add the TXT record shown to your DNS provider:
Type Name Value TXT _logto-cloud-sso.example.comThe token shown on the page -
Keep the domain open on the page. Logto checks the record every 10 seconds. Once the record is found, the domain is bound to the connector and marked Bound. You can then remove the TXT record.
A domain can be bound to only one Console SSO connector. Removing a bound domain stops SSO for email addresses on that domain. Adding it back needs a new verification.
Billing doesn't wait for this step. A connector is billed from the moment it's created, whether or not its connection settings or domains are finished.
Sign in with SSO
On the Logto Cloud sign-in page, members enter their work email. If its domain is bound to a connector, they're sent to your IdP to sign in.
Pricing and billing
Each connector costs USD 128 per month, plus applicable tax. Your account has one Console SSO subscription, and its quantity is the number of connectors.
| When you… | What happens |
|---|---|
| Add your first connector | You pay for the first month in Stripe Checkout. The payment date becomes your monthly billing date. |
| Add another connector | It's added right away. A prorated charge for the rest of the current month is added to your next invoice. |
| Delete a connector (others remain) | A prorated credit for the unused time is applied to your next invoice. It's not refunded to your card. |
| Delete your last connector | The subscription is canceled right away. If the current month is paid, the unused time is refunded to your payment method. |
| Add a connector after canceling | A new subscription starts through Stripe Checkout, with a new billing date. |
Editing a connector's settings or domains never changes what you pay.
Example invoice
The figures below assume 30-day months and exclude tax. Real prorations are calculated to the second.
| Date | Action | Connectors | Effect |
|---|---|---|---|
| Nov 1 | Add the first connector | 1 | Paid at checkout: $128.00. The billing date is the 1st. |
| Nov 16 | Add a second connector (15 days left) | 2 | +64.00 on the next invoice |
| Nov 25 | Delete one connector (6 days left) | 1 | −25.60 on the next invoice |
| Dec 1 | Monthly invoice | 1 | 64.00 − 166.40** |
| Dec 16 | Delete the last connector (15 days left) | 0 | Subscription canceled; $64.00 refunded |
Subscription and billing history
Open Subscription in the Console top bar. It shows your account's subscriptions, whichever tenant is selected.
- Subscription lists your current subscriptions with their price, next charge and billing date. Use Manage payment to update your payment method or pay an outstanding invoice.
- Billing history lists your invoices, including those of canceled subscriptions. Select an invoice to view it and download the invoice or receipt.
Overdue payments
If a payment fails, Stripe retries it and the subscription is marked Past due. Your connectors keep working, but please update your payment method through Manage payment.
After three consecutive monthly invoices stay unpaid with all retries exhausted, Logto pauses the subscription and deletes all of its connectors. Other people's connectors and your tenants are not affected. Your invoices remain in billing history.
Paying the overdue invoices afterwards doesn't restore deleted connectors. To use Console SSO again, contact us to settle the paused subscription, then add a connector to start a new one.
Delete connectors or your account
To delete a connector, open it from the Console SSO page and delete it from its menu. Deleting your last connector cancels the subscription as described above. If the subscription is overdue, pay the outstanding invoice first.
Before you can delete your Logto Cloud account:
- Delete all of your Console SSO connectors.
- Make sure your subscriptions are canceled.
- Pay any outstanding invoices.
Troubleshooting
I paid, but my connector didn't appear
The connector is created as soon as Logto receives confirmation from Stripe, which usually takes a few seconds. Refresh the Console SSO page. If the connector is still missing after a few minutes, contact us and don't pay again. If the connector can't be created, Logto cancels the subscription and refunds the payment automatically.
Adding a connector asks me to resolve my current subscription
Your existing Console SSO subscription can't fund new connectors, usually because it was paused after overdue payments. Contact us to settle it before adding a connector.
Creating a connector failed partway
Try again from the same page: Logto continues the same connector instead of creating a new one. To discard an unfinished connector, choose Start over. A failed creation never cancels your subscription or charges you.
My domain stays unverified
Check that the TXT record name is exactly _logto-cloud-sso. followed by your domain and that the value matches the token on the page. DNS changes can take time to propagate. If the page says the domain is already bound to another connector, remove it from the other connector first.