Your app sends the visitor to a Logto sign-in page. After sign-in, Logto sends them back to a return address you registered for that app. In the React setup, the app uses the Logto library to handle that return.

Create an application in the Logto Console and match the return address to the web page that receives it. Logto Cloud runs the sign-in service. If you self-host, you operate the service and a supported PostgreSQL database.

Where do you decide who can open a private record?

Register the bookings API, the part of your app that handles booking requests, as an API resource in Logto. Define the permissions it accepts and have the app request an access token for that API. A regular sign-in can produce an opaque token, which the bookings server cannot read as a signed token. For the registered API, request its signed token, called a JWT, with the permission the action needs.

In the server that handles the booking, check the token’s signature, which Logto tenant issued it, whether it has expired, which API it is for and which permissions it carries.

Permission to read bookings still leaves a question about which booking the user may read. Check the person’s ownership or membership against that record before returning it.

Can someone recover access without gaining someone else’s records?

Use a separate Logto test tenant or installation and a disposable copy of the app. Before opening the flow, verify the Logto address, return address and booking data connection. Enable password sign-in and the email verification code under Forgot password for the test setup. Confirm its email connector uses a test inbox that catches messages without delivering them. Leave real social and SMS providers disconnected. Use a paper walkthrough if you cannot verify the setup.

Use two fictional accounts
In separate browser sessions, sign in with each account. Confirm only the first can open its sample booking.
Try the recovery path
For the first account, request a reset through the test sign-in page with password recovery configured. Check the captured verification message and that the recovery finishes in the test setup.
Check the result after signing in
Sign in again as the first account and open its booking. Use the other account to confirm it still cannot open that record.

What is the difference between an active user and a token limit?

An active-user allowance counts people who use sign-in in the measured month. Logto also counts issued access tokens, which are used when an app asks for access to a service. One person can receive more than one token.

The current Cloud Free plan lists up to 50,000 monthly active users and 50,000 access tokens per month. The Pro plan includes an access-token allowance and charges for extra usage. Self-hosting the open-source version adds the cost of running and maintaining it. Some features require a self-hosted license.

Logto says a complete self-service move of configuration and users between Cloud and the open-source edition is unavailable. Its documentation directs you to the Logto team to discuss that move or request a full user-data export.

Keep the application settings, return addresses and links between account IDs and your app records. Test sign-in with a sample account after moving. Check separately whether the destination accepts the password format and what happens to existing sessions.