[Bccorb]

Summary

Several pages still said Seamless Auth has no OpenID Provider. That has been false since v0.21.0 (released 2026-11-01), which ships the separate seamless-auth-oidc-provider service. This brings the docs in line with the compare summaries on seamlessauth.com (fells-code/seamless-website#39), and refreshes the compatibility matrix.

Comparison pages

• auth0.mdx, keycloak.mdx, cognito.mdx, better-auth.mdx: rewrote the "Choose X if" bullets, feature table rows, architecture notes and "When not to use" bullets that denied an OpenID Provider or client credentials tokens.
• Each now says the provider exists, is a separate service, is off by default, is new (provider 0.1.x) and is not OpenID certified. The incumbent stays the recommendation where certification or a long production record is required. No claim is made about the conformance suite passing.
• Keycloak: the provider adds a second, database-free container. Apps that use Keycloak as an OIDC provider can move to it; SAML apps still cannot.
• Cognito: API Gateway's Cognito authorizer does not accept the provider's tokens.
• Seamless Auth "checked" lines updated to API v0.21.1, 2026-11-01. Keycloak footprint figures are still labelled as measured at v0.19.1.
• clerk.mdx, supabase-auth.mdx, firebase-auth.mdx and cost.mdx make no provider claim and are unchanged.

RFC 9700 page (understand/oauth-rfc9700.mdx)

• The intro and the authorization server section no longer call the provider "planned for v0.21". Each of the 12 authorization server rows is scored against provider 0.1.1 (the version that pairs with API 0.21.1) and links the test or code behind it, mostly from the edge repo's docs/oauth-security.md matrix. The section says plainly that this is configuration and unit tests, not OpenID certification.
• Fixed RFC section numbers that were off by one: refresh tokens are 4.14 (was 4.13), client impersonation 4.15 (was 4.14), clickjacking 4.16 (was 4.15), and the failed-authentication redirect rule is 4.11.2 (was 4.16).
• The client table's 4.7 "state single use" row is now Meets since 0.21.0: replay records live in the database (#414 closed). The rest of the client table is still dated v0.19.2 and says so.

Compatibility matrix (build/ecosystem.mdx)

• Updated to the latest releases: oidc-provider 0.2.0, core and express 0.24.0, fastify 0.15.0, nextjs 0.8.0, types 0.35.0, with their declared ranges.
• @seamless-auth/types is now split between ^0.35.0 (core, nextjs, oidc-provider) and ^0.34.0 (API, client, react, react-native, messaging, CLI, dashboard). The "single copy" note is replaced with that fact.
• Version mismatch: oidc-provider 0.2.0 speaks /oidc contract version 3 and refuses to start against API 0.21.1, which speaks version 2. The matrix says to run provider 0.1.1 with API 0.21.1.

OpenID Provider guide (build/openid-provider.mdx)

• The docker run example used :latest, which is now v0.2.0, so it fails against every released API. It is pinned to v0.1.1, with a note on which edge version pairs with which API.

Checks

• npm run lint, typecheck and npm run build pass
• npm run check:matrix: all 18 matrix versions match their latest release