Logto
Connect Logto so Safeguard can check the MFA, sign-in factor and password rules your customers sign in with.
Connect Logto
Logto signs in your own product's users. Safeguard reads its sign-in experience through the Logto Management API: whether MFA is required, which sign-in factors are allowed, the password policy, and who holds access to the Management API.
This is customer-access evidence. Logto is not treated as your workforce identity provider, so the employee access-review checks (accounts linked to people, leavers) do not run for it.
Logto has no read-only scope for its Management API: the only permission it offers is all. Safeguard only makes read calls with the credential, and you can revoke it in Logto at any time.
1. Create a machine-to-machine app in Logto
- In the Logto Console, open Applications › Create application and choose Machine-to-machine. Name it, for example "Safeguard compliance".
- Assign it a role that holds the Logto Management API resource's
allpermission. - Copy the app's App ID and App secret, and your Logto endpoint.
2. Connect it in Safeguard
- Open Compliance › Connectors, search for Logto and click Connect.
- Choose API token:
| Field | What to enter |
|---|---|
| Instance URL | Logto Cloud: https://<tenant-id>.logto.app. Self-hosted: your own Logto address. |
| Client ID | The App ID |
| Client secret | The App secret |
| Tenant ID (optional) | Your tenant ID, needed only when Logto Cloud is behind a custom domain |
- Click Connect with token.
A self-hosted Logto must be reachable at a public https:// address on the standard port.
What Safeguard checks
- MFA is required at sign-in
- Weak sign-in factors are disabled
- The password policy meets your minimums, including lockout after repeated failures
- How many accounts can use the Management API
Troubleshooting
- Not working on Logto Cloud with a custom domain: fill in Tenant ID.
- Not working, naming the Management API: check the app's role holds the Logto Management API
allpermission.
OVHcloud
Connect OVHcloud accounts in Europe, Canada or the US so Safeguard can check sign-in restrictions, audit logs, Public Cloud storage, backups and firewalls.
Infisical
Connect Infisical with a machine identity so Safeguard can check organization members, identity token settings, secret rotation and the audit log, without reading any secret.