Provider

Logto

Logto provider documentation

Feature/OIDC support

✅ PKCE
✅ State
✅ Nonce
❌ Access Token validation
✅ ID Token validation

Logto is an open-source identity solution that provides authentication and authorization services. The provider is configured with secure defaults and supports all major OIDC security features including PKCE, state, and nonce validation. Due to the usage of encrypted access tokens, we are not able to validate access tokens.

Example Configuration

Never store sensitive values like your client secret in your Nuxt config. Our recommendation is to inject at least client id and client secret via. environment variables.

Minimal

nuxt.config.ts

logto: {
  baseUrl: '',
  clientId: '',
  clientSecret: '',
  redirectUri: 'http://localhost:3000/auth/logto/callback',
  logoutRedirectUri: 'http://localhost:3000',
}

Environment variables

Dotenv files are only for (local) development. Use a proper configuration management or injection system in production.

.env

NUXT_OIDC_PROVIDERS_LOGTO_CLIENT_SECRET=CLIENT_SECRET
NUXT_OIDC_PROVIDERS_LOGTO_CLIENT_ID=CLIENT_ID
NUXT_OIDC_PROVIDERS_LOGTO_BASE_URL=https://YOUR_LOGTO_DOMAIN

Provider specific parameters

The Logto provider supports several specific parameters to customize the authentication experience:

Option	Type	Default	Description
firstScreen	`string`	-	Specifies the initial screen shown to users during authentication. This can be used to direct users to specific authentication flows.
identifier	`string`	-	Defines which identifier types are accepted in the sign-in or sign-up form. This allows you to restrict authentication methods.
loginHint	`string`	-	Pre-populates the identifier field with a user's email or username. Useful for improving user experience when the identity is known.
prompt	`'login' \| 'none' \| 'consent' \| 'select_account'`	`consent`	Controls the authentication behavior: 'login' forces authentication, 'none' prevents interaction, 'consent' requires explicit consent, and 'select_account' allows account selection.

For Logto you have to provide at least the baseUrl, clientId and clientSecret properties. The baseUrl is used to dynamically create the authorizationUrl, tokenUrl, logoutUrl and userInfoUrl.

KeyCloak

KeyCloak provider documentation

Microsoft

Microsoft provider documentation