Logto adopts token-based authentication following the OAuth 2.0 and OpenID Connect standards. Each authentication or authorization request results in Logto issuing tokens that represent the user’s authentication or authorization status — such as access tokens, ID tokens, and refresh tokens.

For billing purposes, only access tokens are counted (ID tokens and refresh tokens are excluded).

An access token is issued and counted in the following scenarios:

User sign-in: After a user successfully signs in, an opaque access token is issued. This token can be used to call the UserInfo endpoint or Logto Account API for account management.

Backend API authorization (RBAC): When Role-Based Access Control (RBAC) is enabled to protect your backend APIs, a JWT access token is issued for each resource-specific authorization request following the user’s initial authentication.

Organization authorization: If the organization feature is enabled, Logto provides organization-level access control by issuing organization access tokens. A separate organization access token is generated for each organization-specific authorization request.

Machine-to-Machine (M2M) authorization: An access token is issued for each client_credentials authorization request (e.g., when accessing the Logto Management API).

Token exchanges: A new access token is issued during personal access token exchanges or user impersonation token exchanges.

Refresh token usage: If offline_access is enabled, a new access token is issued each time a valid refresh token is exchanged after the previous token expires.

Token vs. MAU and why token-based billing is better

MAU-based billing charges per unique user per month, regardless of activity. Token-based billing instead charges by actual usage: every time an access token is issued.

Token-based billing represents true pay-as-you-go pricing. Unlike MAU-based models that charge for the entire month regardless of usage, you only pay for actual authentication and authorization activities. This approach is budget-friendly for low-frequency users who only access your product occasionally, as they generate fewer tokens, resulting in lower costs compared to flat MAU pricing. This makes Logto more cost-effective than competitors, especially for applications with varied engagement patterns.

For example, one sign-in may consume 1 access token. Using features like M2M or Organizations can generate additional tokens. To keep track, Logto provides real-time token usage monitoring in Console > Dashboard, which helps you better understand the relationship between MAU and tokens for your specific project.

Zuora OAuth endpoints

Zuora authorization endpoint

Zuora token endpoint

Zuora OAuth documentation and resources