Open source identity and access

Own your identity layer. All of it.

Seamless is the identity and access platform you run yourself. Passkeys first, phishing-resistant by default, and Apache-2.0 with no enterprise edition. Today it signs people in to your apps. We're building it in the open until it covers everything teams rent Auth0, Okta, Duo and 1Password for.

$ npx seamless-cli init my-app
Why we're doing this

The front door should belong to the people who live there.

Identity is the front door to everything you build, and most teams rent it. The bill grows with every user. Single sign-on and SCIM sit behind enterprise tiers. Leaving means a migration nobody wants to run, so nobody leaves.

We think that's backwards. So we're building Seamless: open source, passwordless from the first line, and small enough to run on one modest server. Every security feature stays in the open project, forever. If it saves you money, time, or a breach, it did its job.

Brandon Corbett, Fells Code

The platform

One platform, four jobs.

We only say Seamless does what another tool does once that feature ships. Anything with a version number is on the roadmap, not in your hands yet.

The job teams rent Auth0 forAvailable now, v0.18.0

Auth

Sign people in to your apps.

Today
  • Passkeys first, plus magic links, email and SMS codes, and TOTP
  • Sessions with refresh rotation and reuse detection
  • Step-up auth, lockout and login policy, per-flow rate limits
  • SDKs for 11 frameworks and a bundled admin console
Next
  • Recovery codes and break-glass admin (v0.20)
  • OpenID Provider and hosted login (v0.21)
  • Roles, permissions, webhooks and hooks (v0.22)
  • Enterprise SSO per organization (v1.1)
The job teams rent Okta forPlanned, v2.0

Identity

Run the directory for your whole workforce.

Today
  • Organizations and bulk user import with a dry run
  • Coexistence with your old identity provider during cutover
Next
  • SCIM 2.0 server (v1.2)
  • SAML identity provider, groups and an app launcher (v2.0)
  • Directory sync with Google Workspace and Entra ID (v2.0)
  • Joiner, mover and leaver lifecycle (v2.0)
The job teams rent Duo forPlanned, v2.1

Access

Put strong auth in front of everything else.

Today
  • Step-up authentication for sensitive actions
  • Authenticator policy backed by FIDO metadata
Next
  • Forward-auth for Caddy, Traefik and nginx (v2.1)
  • Per-application policy: require passkeys for this app (v2.1)
  • RADIUS and LDAP front ends for VPNs and legacy apps (v2.1)
  • Registered-device inventory (v2.1)
The job teams rent 1Password forLater, v3.0

Secrets

Keep your team's passwords and keys safe.

Today
  • Passkey PRF support, the building block for passkey-unlocked vaults
Next
  • Vaults unlocked with a passkey (v3.0)
  • Sharing through Seamless groups (v3.0)
  • Import and export in the open CXF format (v3.0)
Three promises

Every feature answers to these, in this order.

01

Most secure

Phishing-resistant by default, with nothing to tune.

  • Passkeys first, passwords never stored
  • Hash-chained audit log with an integrity check
  • Decoy responses so attackers cannot probe for accounts
  • Every line of the auth path is public
02

Safe

Never lock anyone out, never lock anyone in.

  • Run your old identity provider alongside during cutover
  • Export and retention for audit data
  • Apache-2.0, with no enterprise edition
  • Recovery codes and break-glass admin are next (v0.20)
03

Easy to integrate

Working sign-in in an afternoon, in the stack you already use.

  • One command scaffolds a web app, API and auth server, wired together
  • Adapters for 11 frameworks, from Express to Rust
  • Runs as one container plus Postgres
  • Docs with an llms.txt, so a coding agent can follow them
The license pledge

No enterprise edition. Ever.

Seamless is Apache-2.0. Single sign-on, SCIM, MFA, organizations and every security feature live in the open source project, now and later. If we ever offer managed hosting, it will sell hosting and support, never features. Self-hosters are never second class.

Read the license on GitHub →
The roadmap

Where we're headed, in order.

The full roadmap →
  1. v0.19NowThe right choice todayAuth
  2. v0.20Never locked outAuth
  3. v0.21OpenID ProviderAuth
  4. v0.22Roles, permissions and hooksAuth
  5. v1.0Stable platformAuth
  6. v1.1B2B organizations and enterprise SSOAuth
  7. v1.2SCIM and attack protectionIdentity
  8. v2.0Workforce identityIdentity
  9. v2.1Strong auth everywhereAccess
  10. v3.0Secrets on Seamless identitySecrets
Who it's for

One person or ten thousand.

Solo builders

Add passkeys to a side project without a monthly bill or a sales call.

Startups

Own your users from day one. Nobody charges you per sign-in.

Product teams

Answer the security questionnaire with phishing-resistant MFA and an audit log you can export.

IT and security teams

Workforce identity and access are on the roadmap. Follow along, test early, and tell us what you need.

Running in production

We run it on our own users first.

RoxTarget is our app for Hyrox athletes and coaches. It signs real people in with Seamless on iOS and the web, so we find the rough edges before you do.

Read the case study
25usersAs of 13 October 2026
166sign-ins since launchAs of 13 October 2026
142sign-ins with a passkeyAs of 14 October 2026
0passwords storedBy design
Built in the open

Come build it with us.

Every issue, milestone and pull request is public. Found a bug? Tell us, and you'll hear back from the person who wrote the code. Want to help? Pick up a good first issue, or bring the feature you need.

Run your own identity this afternoon.

One command scaffolds a web app, an API and a Seamless Auth server, already wired together. Free, open source, and yours to keep.

$ npx seamless-cli init my-app
Start the quickstartStar it on GitHub

Want help hosting or migrating? Say hello