Skip to content

docs: reflect the v0.21 OpenID Provider across compare, RFC 9700 and matrix pages #150

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Bccorb merged 2 commits into from
Nov 2, 2026
Merged

docs: reflect the v0.21 OpenID Provider across compare, RFC 9700 and matrix pages #150

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2eadb54
docs(compare): reflect the v0.21 OpenID Provider on comparison pages
Bccorb Nov 2, 2026
3f53eb6
docs: score the OpenID Provider against RFC 9700 and refresh the comp…
Bccorb Nov 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 18 additions & 9 deletions src/content/docs/build/ecosystem.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -174,18 +174,18 @@ packages, which require Node.js 18 or later.
| Package | Latest release | Declares on other Seamless packages | Other peer ranges |
| --------------------------------- | -------------- | ------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------- |
| `seamless-auth-api` | 0.21.1 | `@seamless-auth/types` ^0.34.0, `@seamless-auth/messaging`, `-aws`, `-twilio` ^0.3.1 | None |
| `@seamless-auth/oidc-provider` | 0.1.1 | `@seamless-auth/express` and `core` ^0.23.0, `@seamless-auth/types` ^0.34.0 | None |
| `@seamless-auth/core` | 0.23.0 | `@seamless-auth/types` ^0.34.0 | None |
| `@seamless-auth/express` | 0.23.0 | `@seamless-auth/core` ^0.23.0 | `express` >=5.0.0 |
| `@seamless-auth/fastify` | 0.14.0 | `@seamless-auth/core` ^0.23.0 | `fastify` >=5.0.0 |
| `@seamless-auth/nextjs` | 0.7.0 | `@seamless-auth/core` ^0.23.0, `@seamless-auth/types` ^0.34.0 | None |
| `@seamless-auth/oidc-provider` | 0.2.0 | `@seamless-auth/express` and `core` ^0.23.0, `@seamless-auth/types` ^0.35.0 | None |
| `@seamless-auth/core` | 0.24.0 | `@seamless-auth/types` ^0.35.0 | None |
| `@seamless-auth/express` | 0.24.0 | `@seamless-auth/core` ^0.24.0 | `express` >=5.0.0 |
| `@seamless-auth/fastify` | 0.15.0 | `@seamless-auth/core` ^0.24.0 | `fastify` >=5.0.0 |
| `@seamless-auth/nextjs` | 0.8.0 | `@seamless-auth/core` ^0.24.0, `@seamless-auth/types` ^0.35.0 | None |
| `@seamless-auth/client` | 0.8.2 | `@seamless-auth/types` ^0.34.0 | None |
| `@seamless-auth/react` | 0.19.2 | `@seamless-auth/client` ^0.8.2, `@seamless-auth/types` ^0.34.0 | `react` and `react-dom` 18 or 19, optional `react-router-dom` 6.4+ or 7.15.1+ |
| `@seamless-auth/angular` | 0.4.1 | `@seamless-auth/client` ^0.8.1 | `@angular/core`, `common`, `router` 20, 21, or 22, and `rxjs` 7 |
| `@seamless-auth/vue` | 0.3.1 | `@seamless-auth/client` ^0.8.1 | `vue` 3.5+, optional `vue-router` 4.4+ or 5 |
| `@seamless-auth/svelte` | 0.3.1 | `@seamless-auth/client` ^0.8.1 | `svelte` 5, optional `@sveltejs/kit` 2.26+ or 3 |
| `@seamless-auth/react-native` | 0.4.2 | `@seamless-auth/client` ^0.8.2, `@seamless-auth/types` ^0.34.0 | `react` 18 or 19 |
| `@seamless-auth/types` | 0.34.0 | None | None |
| `@seamless-auth/types` | 0.35.0 | None | None |
| `@seamless-auth/messaging` | 0.3.1 | `@seamless-auth/types` ^0.34.0 | None |
| `@seamless-auth/messaging-aws` | 0.3.1 | `@seamless-auth/messaging` ^0.3.1 | None |
| `@seamless-auth/messaging-twilio` | 0.3.1 | `@seamless-auth/messaging` ^0.3.1 | None |
Expand All @@ -199,9 +199,18 @@ How to read it:
bumped and released.
- `@seamless-auth/express`, `fastify`, and `nextjs` declare `@seamless-auth/core` as
`workspace:^`, which pnpm rewrites at publish to a caret on the core version in the same release
(`^0.23.0` today).
- Every package that depends on `@seamless-auth/types` declares ^0.34.0, so an install of any mix
of them resolves a single copy of it.
(`^0.24.0` today).
- `@seamless-auth/types` is split across two minors. `core`, `nextjs` and `oidc-provider` declare
^0.35.0. The auth API, `client`, `react`, `react-native`, the messaging packages, the CLI and the
dashboard still declare ^0.34.0. An app that installs packages from both groups gets two copies
of it.
- `@seamless-auth/oidc-provider` 0.2.0 still declares `@seamless-auth/express` and `core` ^0.23.0.
If you embed it in an Express app that uses `@seamless-auth/express` 0.24.0, the app gets two
copies of each.
- `@seamless-auth/oidc-provider` 0.2.0 speaks OpenID Provider contract version 3
(`@seamless-auth/types` 0.35.0), and it refuses to start against an auth API on another version.
Auth API 0.21.1 speaks version 2, so run the provider at 0.1.1 with API 0.21.1. Move to 0.2.0
together with the first auth API release after 0.21.1.
- The messaging packages are used by `seamless-auth-api` to deliver email and SMS. Your application
does not install them.
- The auth API exposes an HTTP contract, not a package range. No package declares a range on
Expand Down
7 changes: 6 additions & 1 deletion src/content/docs/build/openid-provider.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,9 +108,14 @@ ceremonies on the hosted pages are checked against that list.
### 3. Run the edge

```bash
docker run -p 5314:5314 --env-file edge.env ghcr.io/fells-code/seamless-auth-oidc-provider:latest
docker run -p 5314:5314 --env-file edge.env ghcr.io/fells-code/seamless-auth-oidc-provider:v0.1.1
```

Pin the edge to the version that matches your API. With auth API 0.21.x, use edge `v0.1.1`. Edge
`v0.2.0`, which is also the `latest` tag, speaks a newer `/oidc/*` contract and refuses to start
against auth API 0.21.1. The [Compatibility Matrix](/build/ecosystem#compatibility-matrix) lists
the pairs.

| Variable | Required | What |
| ----------------------------- | -------- | ------------------------------------------------------------------------------------------------------------ |
| `SEAMLESS_API_URL` | yes | The private API, as the edge reaches it. |
Expand Down
34 changes: 21 additions & 13 deletions src/content/docs/compare/auth0.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ on the Seamless Auth managed service. It does much less than Auth0, on purpose.
This page is for an engineer or technical lead deciding whether to move off Auth0, or whether to
start on it. Every Auth0 detail links to Auth0's or Okta's own docs or pricing page, and the
[Sources](#sources) section gives the date each one was checked. Seamless Auth details were checked
against the source repositories. Prices, plan contents, and feature limits change, so confirm them
against the source repositories at Seamless Auth API v0.21.1 on 2026-11-01. Prices, plan contents, and feature limits change, so confirm them
on [auth0.com/pricing](https://auth0.com/pricing) before you decide.

---
Expand All @@ -29,11 +29,12 @@ on [auth0.com/pricing](https://auth0.com/pricing) before you decide.
OpenID Connect, AD/LDAP, ADFS, Microsoft Entra ID, Google Workspace, and other enterprise
connections, which can be enabled per Organization, and inbound SCIM on selected enterprise
connections. Seamless Auth has no SAML and no SCIM.
- **You need an identity provider for other applications.** Auth0 is an OAuth 2.0 and OpenID Connect
authorization server: it issues tokens for your APIs, supports the client credentials flow for
machine-to-machine access, and is a certified FAPI OpenID Provider. Seamless Auth signs users in to
your application only. It is not an OpenID Connect provider for third-party clients and issues no
machine-to-machine tokens.
- **You need a certified or long-proven identity provider for other applications.** Auth0 is an
OAuth 2.0 and OpenID Connect authorization server: it issues tokens for your APIs, supports the
client credentials flow for machine-to-machine access, and is a certified FAPI OpenID Provider.
Since v0.21, Seamless Auth also ships an OpenID Provider: a separate service, off by default, with
the authorization code flow and `S256` PKCE, client credentials, the device grant for first-party
apps, and JWT access tokens for your APIs. It is new (provider 0.1.0) and not OpenID certified.
- **You need password sign-in.** Auth0 supports passwords in database connections. Seamless Auth has
no password flow, by design.
- **You want to run custom code inside the login flow.** Auth0 Actions are Node.js functions on
Expand Down Expand Up @@ -96,7 +97,7 @@ page.
| Social and OIDC login | Yes, instance-wide; CLI presets for Google, GitHub, Microsoft (Entra ID), GitLab | Yes, social and enterprise connections |
| SAML enterprise SSO | No | Yes, as an enterprise connection. 1 on Free, 3 on B2B Essentials, 5 on B2B Professional, extra connections a paid add-on; the B2C feature table lists none on Essentials or Professional |
| SCIM provisioning | No | Inbound SCIM on SAML, OIDC, Okta Workforce, and Entra ID connections; needs a plan with enterprise connections |
| Acts as an OAuth/OIDC provider, machine-to-machine tokens | No | Yes |
| Acts as an OAuth/OIDC provider, machine-to-machine tokens | Yes, since v0.21, through the separate OpenID Provider service (off by default): authorization code with PKCE, client credentials, device grant (first-party), RFC 9068 access tokens; not OpenID certified | Yes; certified FAPI OpenID Provider |
| Organizations | Yes: memberships, per-organization roles and scopes, active organization on the session | Yes: members, roles, invitations, per-organization connections and branding; 5 on Free, 10 on B2C paid plans, unlimited (subject to system limits) on B2B paid plans |
| Extensibility | Logic in your own backend, behind the server adapter | Actions (Node.js) on login, registration, password, and machine-to-machine triggers; 5 on Free up to 30 on Enterprise |
| Prebuilt UI | Built-in auth routes (`AuthRoutes` in React; equivalents in Angular, Vue, Svelte), or headless | Universal Login on Auth0's authorization server, Classic Login, and embedded login |
Expand Down Expand Up @@ -158,8 +159,13 @@ apps use bearer tokens in the platform keystore). Your backend verifies sessions
auth API's JWKS. Authorization stays in your own code. See
[What Is Seamless Auth?](/start/overview#how-the-pieces-connect).

Since v0.21 you can also run the optional [OpenID Provider](/build/openid-provider), a separate
service in front of the auth API. Apps that speak OpenID Connect redirect to its hosted login pages
and receive tokens from it, the way they would from Auth0, with no Seamless SDK.

The practical consequence: Auth0 is a central identity provider that many apps and APIs can trust;
Seamless Auth is sign-in for your application, and the sign-in pages are yours.
Seamless Auth is sign-in for your application by default, with sign-in pages that are yours, and
becomes a provider for other apps only when you turn on its OpenID Provider.

---

Expand All @@ -172,10 +178,10 @@ today, stay on Auth0 or choose another product.
Connect providers are configured instance-wide, not per customer organization.
- **You provision users from a customer's directory with SCIM.** Seamless Auth has no SCIM. Bulk
changes go through the CSV import.
- **Other applications or services use Auth0 as their identity provider.** Seamless Auth is not an
OpenID Connect provider and does not issue tokens to third-party apps or machine-to-machine
clients. Anything that logs in through Auth0 today, other than your own application, needs another
home.
- **Other applications or services need a certified identity provider.** Seamless Auth's OpenID
Provider (v0.21, off by default) can sign other OpenID Connect apps in and issue client credentials
tokens, but it is new and not OpenID certified, and it has nothing like Actions to shape their
tokens. Test each app that logs in through Auth0 today against it before you move that app.
- **Your users sign in with passwords and you cannot change that.** There is no password flow, and
no password hashes are imported.
- **You depend on Actions to shape tokens or gate login.** There is no hook system; you move that
Expand Down Expand Up @@ -227,13 +233,15 @@ Auth0 and Okta details, each checked on the date shown:
- [Universal Login](https://auth0.com/docs/authenticate/login/auth0-universal-login), checked 2026-10-20: login on Auth0's authorization server
- [Okta customer identity product page](https://www.okta.com/products/customer-identity/), checked 2026-10-20: redirects to auth0.com

Seamless Auth details:
Seamless Auth details (Seamless Auth API v0.21.1, checked 2026-11-01):

- [What Is Seamless Auth?](/start/overview), including [When Seamless Auth Is Not The Right Choice](/start/overview#when-seamless-auth-is-not-the-right-choice)
- [Migrating Off Auth0](/operate/migrate-from-auth0), including [What You Give Up Or Must Plan For](/operate/migrate-from-auth0#what-you-give-up-or-must-plan-for)
- [Migrate Users From Another Identity System](/operate/migrate-users)
- [Environment Variables](/reference/environment-variables) (`LOGIN_METHODS`, SMS providers)
- [How To Use Organizations And Memberships](/build/organizations-memberships)
- [OAuth Login](/build/oauth-login)
- [OpenID Provider](/build/openid-provider)
- [v0.21 Release Notes](/reference/release-v0-21)
- [Auth Events and Auditing](/understand/authevents)
- Source: [fells-code on GitHub](https://github.com/fells-code)
15 changes: 10 additions & 5 deletions src/content/docs/compare/better-auth.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,8 @@ languages.

This page is for an engineer choosing between the two. Better Auth details were checked against its
official docs, pricing page, and GitHub repository as of October 2026, and each one links to its
source at the bottom. Seamless Auth details were checked against the source repositories.
source at the bottom. Seamless Auth details were checked against the source repositories at
Seamless Auth API v0.21.1 on 2026-11-01.

---

Expand All @@ -30,8 +31,10 @@ source at the bottom. Seamless Auth details were checked against the source repo
- **You need SAML or SCIM.** Better Auth has an SSO plugin (`@better-auth/sso`) supporting SAML 2.0
and OIDC with per-organization providers, and a SCIM 2.0 plugin (`@better-auth/scim`). Seamless
Auth has neither.
- **You want your app to be an OAuth or OIDC provider for other apps.** Better Auth has an
`oauth-provider` plugin. Seamless Auth is not an authorization server for third-party clients.
- **You want your app itself to be an OAuth or OIDC provider for other apps.** Better Auth has an
`oauth-provider` plugin that runs inside your server. Seamless Auth has shipped an OpenID Provider
since v0.21, but as a separate service that is off by default, and it is new (provider 0.1.0) and
not OpenID certified.
- **You want a large ecosystem and a 1.x release line.** Better Auth is on its 1.7 release line, has
about 30,000 GitHub stars, and lists dozens of first-party and community plugins (payments,
API keys, multi-session, anonymous users, Sign-In With Ethereum, and more). Seamless Auth is 0.x
Expand Down Expand Up @@ -82,7 +85,7 @@ Better Auth column as of October 2026.
| Social and OIDC login | Yes, instance-wide; CLI presets for Google, GitHub, Microsoft (Entra ID), GitLab | Yes, built-in social providers and a `generic-oauth` plugin |
| SAML enterprise SSO | No | Yes, `@better-auth/sso` plugin |
| SCIM directory sync | No | Yes, `@better-auth/scim` plugin |
| Acts as an OAuth/OIDC provider | No | Yes, `oauth-provider` plugin |
| Acts as an OAuth/OIDC provider | Yes, since v0.21, as a separate OpenID Provider service (off by default); not OpenID certified | Yes, `oauth-provider` plugin |
| Organizations | Yes: memberships with per-organization roles and scopes, and an active organization on the session | Yes, `organization` plugin: roles, invitations, teams, custom access control |
| Prebuilt UI | Built-in auth routes (`AuthRoutes` in React; equivalents in Angular, Vue, Svelte), or headless | No official components in the core docs; community projects such as Better Auth UI exist |
| Admin dashboard | Yes, open source app you run | `admin` plugin APIs; dashboard via Better Auth Infrastructure (paid service, free Starter tier) |
Expand Down Expand Up @@ -166,11 +169,13 @@ Better Auth details checked October 2026:
- [Better Auth pricing](https://better-auth.com/pricing)
- [Better Auth UI](https://better-auth-ui.com/): community UI components

Seamless Auth details:
Seamless Auth details (Seamless Auth API v0.21.1, checked 2026-11-01):

- [What Is Seamless Auth?](/start/overview), including [When Seamless Auth Is Not The Right Choice](/start/overview#when-seamless-auth-is-not-the-right-choice)
- [What You Give Up Or Must Plan For](/operate/migrate-from-auth0#what-you-give-up-or-must-plan-for)
- [Server SDKs](/build/server-sdks) and [Next.js](/build/nextjs)
- [Environment Variables](/reference/environment-variables) (`LOGIN_METHODS`, SMS providers)
- [How To Use Organizations And Memberships](/build/organizations-memberships)
- [OpenID Provider](/build/openid-provider)
- [v0.21 Release Notes](/reference/release-v0-21)
- Source: [fells-code on GitHub](https://github.com/fells-code)
Loading
Loading