Seamless Auth v0.23 is out. Until now Seamless Auth answered "who is this user". v0.23 also answers "what may they do", and lets your systems take part in sign-in without forking the server.
Permissions your backend can check from the token
An admin defines permissions and maps roles to them, in the console, the CLI
or the admin API. Access tokens carry a permissions claim. Inside an
organization they also carry org_roles and org_permissions, so a backend
can authorize per organization from the token alone.
Every adapter can enforce it: requirePermission in Express, and the matching
guards in Fastify, Next.js, Go, Python and Rust. usePermissions() in the
React SDK gates the UI. Matching is exact, with no wildcards or implied
grants.
Your systems in the sign-in path
- Signed webhooks. Standard Webhooks signatures, eight attempts over about
42 hours, a dead letter queue and redelivery.
verifyWebhookin@seamless-auth/corechecks them, and so does any Standard Webhooks library. - Login hooks.
post_logincan deny a sign-in once the factor is proven.pre_tokencan deny or add claims. You choose whether each one fails open or closed. Break-glass and recovery sessions never call a hook. - Custom claims. Static claims per role or OpenID Provider client. If you are coming from Auth0 Actions, the guide maps one to the other.
- SIEM streaming. Every audit event, streamed over OTLP to an OpenTelemetry Collector, Splunk, Elastic or Datadog. The hash chain comes with it, so your SIEM's copy verifies on its own. Syslog arrives in v0.23.1.
Every callout follows one set of rules. Each one refuses link-local and metadata addresses and never follows redirects. In production it also refuses private addresses unless you list them.
Native apps and the CLI
A native app that signs in through the OpenID Provider can exchange that
sign-in once for a first-party session of its own. The CLI uses this:
seamless profile login opens your browser and signs you in with a passkey,
or uses the device grant on a machine with no browser.
Hardening
v0.23 also ships the fixes from the post-v0.21 security review. Passkey
hardware assurance now comes from the registered credential. Application
notices can no longer carry their own links. Third-party clients stop when
their flag is off. Every API response is no-store.
Before you upgrade
A few changes can refuse requests that used to pass. Hook denials are new status codes, passkeys whose backup flag changed are refused, and organization role changes need step-up. The release notes list each one, who it affects, and what to do:
- Release notes: https://docs.seamlessauth.com/reference/release-v0-23/
- Compatibility matrix: https://docs.seamlessauth.com/build/ecosystem/#compatibility-matrix
- Guides: roles and permissions, webhooks, login hooks and custom claims, SIEM streaming (all linked from the release notes)
Auth API 0.23.0, OpenID Provider 0.4.0, server adapters 0.26.0 (Fastify 0.17.0, Next.js 0.10.0), admin dashboard 0.14.0, CLI 0.30.0.
Next: v1.0
v1.0 is about a platform you can depend on for years: a frozen contract, an upgrade and version skew policy, config as code, full data export, rate limits shared across instances, and an independent security review. Follow along on the roadmap: https://seamlessauth.com/roadmap