Epic: v0.21 OpenID Provider #387

Goal

Any app that speaks OpenID Connect can sign users in through Seamless Auth, with no Seamless SDK required.

Scope

Discovery, authorization code with PKCE, userinfo, refresh, client credentials, hosted login and consent with no-build branding, client management (API, console, CLI), logout, OAuth 2.1 and RFC 9700 defaults, the OpenID conformance suite and certification, and inbound OAuth improvements.

Children are linked as sub-issues.

Release (2026-11-01)

Each item was checked against its registry after publishing.

• @seamless-auth/types 0.34.0 on npm latest (pre mode exited in seamless-auth-types#142)
• Pins moved to ^0.34.0: chore: depend on @seamless-auth/types 0.34.0 #545, seamless-auth-oidc-provider#33, seamless-auth-server#253, seamless-auth-admin-dashboard#331, seamless-cli#339, seamless-auth-js#231
• Admin dashboard v0.12.0 (tag and ghcr image), shipped as the API console by chore: ship admin dashboard v0.12.0 at /console #546
• Auth API v0.21.0 (tag and ghcr image)
• OpenID Provider 0.1.0 (npm @seamless-auth/oidc-provider and ghcr image)
• @seamless-auth/core and express 0.23.0, fastify 0.14.0, nextjs 0.7.0 on npm via trusted publishing, bundled manifest from API 0.21.0 (seamless-auth-server#254)
• Go, Python and Rust adapters 0.4.0 (Go module proxy, PyPI, crates.io)
• seamless-cli 0.27.0 on npm via trusted publishing, scaffolding API v0.21.0 and dashboard v0.12.0 (seamless-cli#340)
• Docs: OpenID Provider and native app guides (seamless-auth-docs#147), migration guides (seamless-auth-docs#146)
• Hosted runbook for the auth v0.21.0 bump and turning on the OpenID Provider (seamless-iac#315)
• @seamless-auth/client 0.8.2, react 0.19.2, react-native 0.4.2 on npm via trusted publishing (seamless-auth-js#232)
• v0.21 release notes and compatibility matrix (seamless-auth-docs#148)
• Auth image v0.21.0 in the portal-auth, grand-cross and roxtarget stacks (seamless-iac#316, applied)