From npx to first login
Three commands to a working login, none of them a redirect. Everything below runs on your machine, against the same auth server the managed instances run.
Scaffold the stack
The CLI generates a web app, an API, an auth server, and a compose file, already pointed at each other. Nothing is left to wire up by hand.
$ npx seamless-cli init my-app
my-app/
├─ web/ React app
├─ api/ Express API
├─ auth/ Seamless Auth server
└─ docker-compose.ymlBring it up
Postgres, the auth server, the API, and the web app start together. Ports bind to 127.0.0.1 only, because the dev auth server returns OTP codes in the response.
$ docker compose up
db 127.0.0.1:5432
auth 127.0.0.1:5312
api 127.0.0.1:3000
web 127.0.0.1:5173Register and sign in
The email you gave init is stored as OWNER_EMAIL, and the first account created with it gets the admin role. Registering in the app you just scaffolded is the whole step.
# http://localhost:5173
Register with the email you gave init
→ admin role granted at signupThe wiring you did not do
Provider on the client, adapter on the server. Both ship inside the scaffold; this is what init put there.
// web/src/App.tsx
<AuthProvider apiHost={API_URL}>
<ApplicationRoutes />
</AuthProvider>
// api/src/index.ts
app.use('/auth', createSeamlessAuthServer(options));Read the session
The session travels as an HttpOnly cookie and the SDK exposes the identity behind it, so your components never handle a token.
import { useAuth } from '@seamless-auth/react';
const { user, credentials } = useAuth();What comes with it
All of it is in the open source server and SDKs, so self-hosting gives up none of it.
Where the pieces live
Self-hosted, these all run on your infrastructure. On a managed instance the first two are unchanged and we operate the rest.
Authenticated traffic never leaves your stack.
Yours either way: compose on your machine, or provisioned for you.
Hardened and patched by us, not a cloud account per tenant.
Run it yourself, or let us host it
Read the source
Every piece above is published. Nothing in the login path is a black box.