Open source identity and access

Every part of Identity and Access manageable by one team.

Seamless is the identity and access platform you run yourself. Passkeys first, phishing-resistant by default, and Apache-2.0 with no enterprise edition.

Start the quickstartSee the roadmap
$ npx seamless-cli init my-app

One platform, four jobs

Latest releasev0.21.1, 1 November 2026LicenseApache-2.0, no enterprise editionWorks with11 frameworks, Express to RustIn productionRoxTarget, on iOS, Android and the web
Why we're doing this

The front door should belong to the people who live there.

Identity is the front door to everything you build, and most teams trust someone else with it.

That's backwards. So we've built Seamless: open source, passwordless, and small enough to run on one modest server. The key idea is: software deserves excellent authentication and access, and it shouldn't cost a dime.

Brandon Corbett, Fells Code

The platform

One platform, four jobs.

Here is the current Seamless roadmap.

The job teams use Auth0 forAvailable now, v0.21.1

Auth

Sign people in to your apps.

Today
  • Passkeys first, plus magic links, email and SMS codes, and TOTP
  • Sessions with refresh rotation and reuse detection
  • Recovery codes, self-service recovery and break-glass admins
  • An OpenID Provider with hosted login, so any OIDC app can sign in
  • SDKs for 11 frameworks and a bundled admin console
Next
  • Roles, permissions, webhooks and hooks (v0.23)
  • Config as code and full export (v1.0)
  • Enterprise SSO per organization (v1.1)
The job teams use Okta forPlanned, v2.0

Identity

Run the directory for your whole workforce.

Today
  • Organizations with members and scoped roles
  • User import from Auth0, Cognito, Entra ID or CSV, with a dry run
  • Coexistence with your old identity provider during cutover
Next
  • SCIM 2.0 server (v1.2)
  • SAML identity provider, groups and an app launcher (v2.0)
  • Directory sync with Google Workspace and Entra ID (v2.0)
  • Joiner, mover and leaver lifecycle (v2.0)
The job teams use Duo forPlanned, v2.1

Access

Put strong auth in front of everything else.

Today
  • Step-up authentication for sensitive actions
  • Authenticator policy backed by FIDO metadata
  • Device sign-in for CLIs and devices, approved with a passkey
Next
  • Forward-auth for Caddy, Traefik and nginx (v2.1)
  • Per-application policy: require passkeys for this app (v2.1)
  • RADIUS and LDAP front ends for VPNs and legacy apps (v2.1)
  • Registered-device inventory (v2.1)
The job teams use 1Password forLater, v3.0

Secrets

Keep your team's passwords and keys safe.

Today
  • Passkey PRF support, the building block for passkey-unlocked vaults
Next
  • Vaults unlocked with a passkey (v3.0)
  • Sharing through Seamless groups (v3.0)
  • Import and export in the open CXF format (v3.0)
Three promises

Our guiding light.

01

Most secure

Phishing-resistant by default, with nothing to tune.

  • Passkeys first, passwords never stored
  • Hash-chained audit log with an integrity check
  • Decoy responses so attackers cannot probe for accounts
  • Every line of the auth path is public
02

Safe

Never lock anyone out, never lock anyone in.

  • Run your old identity provider alongside during cutover
  • Recovery codes and self-service recovery for lost passkeys
  • Break-glass admins and sign-in policy you can roll back
  • Export and retention for audit data
  • Apache-2.0, with no enterprise edition
03

Easy to integrate

Working sign-in in an afternoon, in the stack you already use.

  • One command scaffolds a web app, API and auth server, wired together
  • Adapters for 11 frameworks, from Express to Rust
  • Any app that speaks OpenID Connect signs in with no SDK
  • Runs as one container plus Postgres
  • Docs with an llms.txt, so a coding agent can follow them
The license pledge

Open source forever... period.

Seamless is Apache-2.0. Single sign-on, SCIM, MFA, organizations and every security feature live in the open source project, now and later.

Read the license on GitHub →
The roadmap

Where we're headed, in order.

The full roadmap →
  1. v0.19ShippedThe right choice todayAuth
  2. v0.20ShippedNever locked outAuth
  3. v0.21ShippedOpenID ProviderAuth
  4. v0.23NextRoles, permissions and hooksAuth
  5. v1.0Stable platformAuth
  6. v1.1B2B organizations and enterprise SSOAuth
  7. v1.2SCIM and attack protectionIdentity
  8. v2.0Workforce identityIdentity
  9. v2.1Strong auth everywhereAccess
  10. v3.0Secrets on Seamless identitySecrets
Who it's for

One person or ten thousand.

Solo builders

Add passkeys to a side project without a monthly bill or a sales call.

Startups

Own your users from day one. Nobody charges you per sign-in.

Product teams

Answer the security questionnaire with phishing-resistant MFA and an audit log you can export.

IT and security teams

Put internal tools that speak OpenID Connect behind passkey sign-in today. Workforce identity and access are on the roadmap.

Running in production

We run on Seamless.

RoxTarget is our app for Hyrox athletes and coaches. It signs real people in with Seamless on iOS, Android and the web.

Read the case study
48usersAs of 3 November 2026
133sign-ins to dateAs of 3 November 2026
60of those with a passkeyAs of 3 November 2026
0passwords storedBy design
Built in the open

Come build it with us.

Every issue, milestone and pull request is public. Found a bug? Tell us, and you'll hear back from the person who wrote the code. Want to help? Pick up a good first issue, or bring the feature you need.

Browse the reposGood first issuesMilestones

Run your own identity in 5 mins.

One command scaffolds a web app, an API and a Seamless Auth server, already wired together. Free, open source, and yours to keep.

$ npx seamless-cli init my-app
Start the quickstartStar it on GitHub

Want help hosting or migrating? Say hello