> ## Documentation Index
> Fetch the complete documentation index at: https://conductorone-docs-mcp-bridge-private-server.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up a Logto connector

> C1 provides identity governance for Logto. Integrate your Logto tenant with C1 for unified visibility and governance over user access.

C1 provides identity governance for Logto. Integrate your Logto tenant with C1
for unified visibility and governance over user access across your
organizations.

## Capabilities

| Resource      | Sync                                                          | Provision |
| ------------- | ------------------------------------------------------------- | --------- |
| Users         | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |           |
| Organizations | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |           |

The connector syncs your Logto users and organizations, the membership of each
organization, and the organization role assigned to each member.

## Gather Logto credentials

<Warning>
  To configure the Logto connector, you need administrator access to your Logto
  tenant so you can create a machine-to-machine application and grant it the
  Management API permission.
</Warning>

<Steps>
  <Step>
    Sign in to the Logto Console for your tenant and open **Applications**.
    Create a new **Machine-to-machine** application (or reuse an existing one).
  </Step>

  <Step>
    Grant the application access to the **Logto Management API**. This is what
    lets the connector read users, organizations, and role assignments.
  </Step>

  <Step>
    From the application page, copy the **App ID** and **App Secret**. The
    secret is shown when the application is created; rotate it from the same
    page if you need a new one.
  </Step>

  <Step>
    Note your tenant's base URL (for Logto Cloud this is
    `https://<tenant-id>.logto.app`). The token endpoint is `<base URL>/oidc/token`
    and the Management API resource indicator is `<base URL>/api`. For a
    self-hosted deployment the resource indicator is the logical
    `https://default.logto.app/api`.
  </Step>
</Steps>

## Configure the Logto connector

<Tabs>
  <Tab title="Cloud-hosted">
    Follow these instructions to use a built-in, no-code connector hosted by C1.

    <Steps>
      <Step>
        In C1, navigate to **Integrations** > **Connectors** and click **Add connector**.
      </Step>

      <Step>
        Search for **Logto** and click **Add**.
      </Step>

      <Step>
        Choose how to set up the new Logto connector.
      </Step>

      <Step>
        Set the owner for this connector.
      </Step>

      <Step>
        Click **Next**.
      </Step>

      <Step>
        Find the **Settings** area of the page and click **Edit**.
      </Step>

      <Step>
        Enter the Logto credentials:

        * **Base URL**: Your tenant URL, for example `https://acme.logto.app`.
        * **Token URL**: Your tenant token endpoint, for example `https://acme.logto.app/oidc/token`.
        * **Management API resource**: The Management API resource indicator, for example `https://acme.logto.app/api`.
        * **Client ID**: The machine-to-machine application's App ID.
        * **Client secret**: The machine-to-machine application's App Secret.
      </Step>

      <Step>
        Click **Save**.
      </Step>

      <Step>
        The connector's label changes to **Syncing**, followed by **Connected**. You can view the logs to ensure that information is syncing.
      </Step>
    </Steps>

    **Done.** Your Logto connector is now pulling access data into C1.
  </Tab>

  <Tab title="Self-hosted">
    Follow these instructions to run the Logto connector in your own
    environment.

    <Steps>
      <Step>
        Create secrets for the Logto machine-to-machine credentials.
      </Step>

      <Step>
        Configure the connector with your tenant's base URL, token URL,
        Management API resource indicator, Client ID, and Client secret.
      </Step>

      <Step>
        Deploy the connector using your standard self-hosted connector process.
      </Step>
    </Steps>

    **Done.** Your Logto connector is now pulling access data into C1.
  </Tab>
</Tabs>

<Note>
  On Logto Cloud, the Organizations feature is available on the free Development
  tenant for testing. Production tenants may require a paid plan to use
  Organizations; if your tenant has no organizations, the connector will sync
  users only.
</Note>