diff --git a/src/content/docs/compare/cognito.mdx b/src/content/docs/compare/cognito.mdx new file mode 100644 index 0000000..4860909 --- /dev/null +++ b/src/content/docs/compare/cognito.mdx @@ -0,0 +1,227 @@ +--- +title: "Seamless Auth vs Amazon Cognito" +description: "Considering a self-hosted, open source alternative to Amazon Cognito? An honest comparison of Seamless Auth and Cognito user pools: feature plans, passkeys, passwordless codes, federation, machine-to-machine tokens, Lambda triggers, export, hosting, and cost, with dated sources." +sidebar: + order: 6 +--- + +import { Aside } from '@astrojs/starlight/components'; + +Amazon Cognito and Seamless Auth both sign users in to your applications and manage their sessions. +Cognito user pools are an AWS-operated user directory and OAuth 2.0 and OpenID Connect authorization +server, sold in three feature plans (Lite, Essentials, and Plus). They support passwords, passkeys, +email and SMS one-time codes, social, SAML, and OIDC identity providers, machine-to-machine tokens, +Lambda triggers, and a hosted sign-in page called managed login, and they plug into other AWS +services. Seamless Auth is an open source (Apache-2.0), passwordless-only auth server that you +self-host inside your own stack or run on the Seamless Auth managed service. It does much less than +Cognito, and it is not tied to AWS. + +This page is for an engineer or technical lead deciding whether to move off Cognito, or whether to +start on it. Every Cognito detail links to an AWS page, and the [Sources](#sources) section gives +the date each one was checked. Seamless Auth details were checked against the source repositories +at Seamless Auth API v0.19.3. Prices, plan contents, and feature limits change, so confirm them on +[aws.amazon.com/cognito/pricing](https://aws.amazon.com/cognito/pricing/) before you decide. + +--- + +## Choose Cognito If + +- **Your application is built on AWS and leans on its integrations.** Cognito user pool groups can + carry IAM roles for identity pools, identity pools exchange a sign-in for AWS credentials, and API + Gateway accepts Cognito access and ID tokens in a Cognito authorizer. Seamless Auth issues no AWS + credentials and no AWS service reads its sessions natively. +- **You need SAML enterprise SSO.** User pools federate with SAML 2.0 and OpenID Connect identity + providers on every feature plan, as well as social providers. Seamless Auth has no SAML. +- **You need an identity provider for other applications or machine clients.** A user pool with a + domain is an OAuth 2.0 and OpenID Connect authorization server, with resource servers, custom + scopes, and machine-to-machine access tokens through the client credentials grant. Seamless Auth + signs users in to your application only. It is not an OpenID Connect provider for third-party + clients and issues no machine-to-machine tokens. +- **You need password sign-in.** Cognito supports passwords, including Secure Remote Password (SRP), + and can import existing bcrypt, scrypt, Argon2id, or PBKDF2-SHA256 password hashes. Seamless Auth + has no password flow, by design. +- **You want to run custom code inside the sign-in flow.** Cognito invokes Lambda functions at pre + sign-up, pre and post authentication, pre token generation, user migration, custom messages, + custom senders, and custom authentication challenges. Seamless Auth has no equivalent; that logic + goes in your own backend. +- **You need a vendor's compliance coverage.** AWS states that third-party auditors assess Cognito + as part of AWS compliance programs including SOC, PCI, FedRAMP, and HIPAA, with reports in AWS + Artifact. Seamless Auth has no third-party compliance attestations of its own. +- **You want nothing to run yourself and a large, established product.** AWS operates Cognito. + Seamless Auth is 0.x, with a much smaller community. + +## Choose Seamless Auth If + +- **You want passkeys enforced, not just offered.** In Cognito, passkey sign-in is not on the Lite + plan, and the user pool sign-in policy requires the passkey option to be accompanied by at least + one other first factor. Seamless Auth's `phishing_resistant_only` setting accepts only a passkey + to start a session. +- **You want a stricter passkey policy.** Cognito's user verification setting defaults to preferred, + and its docs state that it does not currently support attestation enforcement. Seamless Auth's + `authenticator_policy` defaults user verification to required, can block synced passkeys, and, + with direct attestation, can allow or deny authenticator models by AAGUID. See + [Authenticator Policy](/reference/system-config#authenticator-policy). +- **Users and sessions must stay inside your own boundary, on any cloud.** Self-hosted, the auth API + and its Postgres database run in your infrastructure, which can be your own AWS account or + somewhere else. A Cognito user pool is an AWS-operated service in an AWS Region. +- **You want the auth server's source under a permissive license.** The auth API, server adapters, + frontend SDKs, admin dashboard, and CLI are all Apache-2.0. Cognito is a proprietary AWS service. +- **You prefer not to pay per active user or per token request.** Self-hosting has no per-user fee; + you pay for the infrastructure you run. Cognito bills monthly active users by plan, federated + users separately, and each machine-to-machine token request. +- **You want your user data in a database you can query.** Self-hosted, users, memberships, and + auth events are rows in a Postgres database you run, and the auth event trail exports as a + hash-chained file you can verify. Cognito has no bulk export job: you page through `ListUsers`, at + most 60 users per call, and the user records it returns carry no password. +- **You want organizations and memberships built in.** Seamless Auth ships organizations, + memberships, per-organization roles and scopes, and an active organization on the session. + +--- + +## Feature Comparison + +Cognito column as checked on the dates in [Sources](#sources). "Plan" names refer to Cognito's user +pool feature plans. + +| | Seamless Auth | Amazon Cognito user pools | +| --- | --- | --- | +| License | Apache-2.0 for the server, SDKs, dashboard, and CLI | Proprietary AWS service | +| Hosting | Self-host (Docker, Postgres) or Seamless Auth managed hosting | Operated by AWS, per AWS Region; multi-Region replication is a paid add-on | +| Where user data lives | Your Postgres when self-hosted; Fells Code's infrastructure on the managed path | AWS, in the user pool's Region; encrypted at rest with an AWS owned key or your own KMS key | +| Passkeys | Yes, primary sign-in method (WebAuthn via SimpleWebAuthn); passkey-only mode | Yes, on Essentials and Plus, not Lite; must be offered alongside another first factor; up to 20 per user | +| Passkey policy | User verification required by default; synced passkey and AAGUID allow or deny rules | User verification preferred by default, can be set to required; no attestation enforcement | +| Magic links | Yes | Not listed among Cognito's sign-in methods | +| Email OTP | Yes | Yes, as a first factor on Essentials and Plus | +| SMS OTP | Yes (Twilio or AWS SNS, configured by you) | Yes, as a first factor on Essentials and Plus; messages sent through Amazon SNS and billed separately | +| MFA | TOTP and passkey (WebAuthn) step-up as a second factor | Authenticator app and SMS codes on all plans; email codes on Essentials and Plus | +| Passwords | No, by design | Yes, including SRP; password hash import from CSV | +| Social and OIDC login | Yes, instance-wide; CLI presets for Google, GitHub, Microsoft (Entra ID), GitLab | Yes: Google, Facebook, Login with Amazon, Sign in with Apple, and OIDC providers, on all plans | +| SAML enterprise SSO | No | Yes, as a SAML 2.0 service provider, on all plans | +| Acts as an OAuth/OIDC provider, machine-to-machine tokens | No | Yes: authorization server, resource servers, custom scopes, client credentials | +| Organizations | Yes: memberships, per-organization roles and scopes, active organization on the session | Groups, optionally mapped to IAM roles | +| Extensibility | Logic in your own backend, behind the server adapter | Lambda triggers on sign-up, authentication, token generation, migration, and messages | +| Prebuilt UI | Built-in auth routes (`AuthRoutes` in React; equivalents in Angular, Vue, Svelte), or headless | Managed login on a user pool domain (Essentials and Plus); classic hosted UI on all plans | +| AWS integration | None; your backend verifies sessions with a server adapter | Identity pools for AWS credentials, API Gateway authorizers, Amplify | +| User import | `seamless migrate csv`, `seamless migrate entra-id`, `POST /admin/users/import`; identities only, no credentials | CSV import jobs (up to 500,000 users per file), optionally with password hashes; user migration Lambda trigger | +| User export | No bulk export endpoint; self-hosted, the data is in your own Postgres. Paginated admin user list and a passkey coverage report (CSV) | No bulk export job; `ListUsers`, 60 users per call, with no password field | +| Audit trail | Append-only, hash-chained auth events; NDJSON export with an integrity check | User activity and risk logs with export on Plus | +| Third-party compliance attestations | None for Seamless Auth itself | In scope for AWS programs including SOC, PCI, FedRAMP, and HIPAA | +| Maturity | 0.x, small community | Established AWS service | +| Pricing model | Free to self-host; managed plans in the portal | Per MAU by plan, federated MAUs priced separately, M2M billed per token request, add-ons for multi-Region replication and higher quotas | + + + +--- + +## Architecture Difference + +**Cognito** is an AWS-operated identity provider. Your app signs users in either through managed +login on a user pool domain (a Cognito prefix domain or your own custom domain), which redirects +back with OAuth 2.0 and OpenID Connect tokens, or through the user pools API from your own code. +Your APIs validate Cognito-issued JWTs, or let API Gateway do it. Users, credentials, and groups +live in the user pool, and Lambda triggers customize the flow. Identity pools can exchange those +tokens for temporary AWS credentials. + +**Seamless Auth** is a service you run next to your backend: + +```txt +browser or native app + -> your backend's /auth routes (@seamless-auth/express, fastify, nextjs, or the Python/Go/Rust adapter) + -> seamless-auth-api (your infrastructure, or Seamless Auth managed) + -> Postgres +``` + +Clients never call the auth API directly. Your backend mounts the adapter routes, forwards calls +with a service token, and keeps the session in signed `httpOnly` cookies on your domain (native +apps use bearer tokens in the platform keystore). Your backend verifies sessions locally against the +auth API's JWKS. Authorization stays in your own code. See +[What Is Seamless Auth?](/start/overview#how-the-pieces-connect). + +The practical consequence: Cognito is an identity provider wired into AWS that many apps, APIs, and +AWS services can trust; Seamless Auth is sign-in for your application, the sign-in pages are yours, +and anything AWS-side goes through your backend. + +--- + +## When Not To Use Seamless Auth + +Be direct with yourself about these before planning a move off Cognito. If any is a hard +requirement today, stay on Cognito or choose another product. + +- **Your frontend calls AWS services directly with identity pool credentials.** Seamless Auth does + not issue AWS credentials. Those calls have to move behind your backend. +- **API Gateway authorizers, Amplify Auth, or other AWS services read Cognito tokens.** None of them + read Seamless Auth sessions. Each one needs replacing with verification in your backend. +- **A customer requires SAML SSO into your app.** Seamless Auth has no SAML. Its OAuth and OpenID + Connect providers are configured instance-wide, not per customer organization. +- **Other applications or machine clients use Cognito as their authorization server.** Seamless Auth + is not an OpenID Connect provider and issues no client credentials tokens. +- **Your users sign in with passwords and you cannot change that.** There is no password flow, and + no password hashes are imported. +- **You depend on Lambda triggers to shape tokens or gate sign-in.** There is no hook system; you + move that logic into your backend. +- **You need a vendor's audit reports for the auth service itself.** Seamless Auth has no + third-party attestations. Self-hosted, it is covered by your own controls. +- **You need a 1.0 stability guarantee.** Every Seamless Auth package is still 0.x. + +The full list is in +[When Seamless Auth Is Not The Right Choice](/start/overview#when-seamless-auth-is-not-the-right-choice) +and [What You Give Up Or Must Plan For](/operate/migrate-from-cognito#what-you-give-up-or-must-plan-for). + +--- + +## Migrating From Cognito + +The [Cognito migration guide](/operate/migrate-from-cognito) covers the move end to end: export +users with a paged `aws cognito-idp list-users` loop (and groups with `ListUsersInGroup`), convert +the export to CSV with `jq`, using each user's `sub` as the external id, import identities with +`seamless migrate csv --source cognito`, keep Cognito sign-in working by adding the user pool as an +OpenID Connect provider linked by `sub` while users move, get everyone onto a passkey, retire +Cognito sign-in per organization or all at once, and switch the user pool off. + +Seamless Auth imports no credentials of any kind, so the lack of a password export from Cognito +does not matter, and TOTP secrets, SMS MFA settings, and passkeys registered with Cognito do not +carry over. Each user proves their email once, or signs in through Cognito during cutover, and +enrolls a new passkey. Fells Code, which maintains Seamless Auth, offers hands-on migration help +(see the end of that guide). + +--- + +## Sources + +Amazon Cognito details, each checked on the date shown: + +- [Amazon Cognito pricing](https://aws.amazon.com/cognito/pricing/), checked 2026-10-21: Lite, Essentials, and Plus; free tiers; per-MAU prices; federated MAU price; machine-to-machine billing per token request and example rate; multi-Region replication and quota add-ons; SMS and email billed through SNS and SES; GovCloud exclusion; plan descriptions (Essentials adds managed login and passwordless sign-in with passkeys, email, or SMS) +- [User pool feature plans](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-sign-in-feature-plans.html), checked 2026-10-21: features by plan, including passkeys and passwordless codes on Essentials and Plus, federation, authorization server, M2M, user import, MFA factors, Lambda triggers, managed login, and Plus activity logs and export +- [Authentication flows](https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-authentication-flow-methods.html), checked 2026-10-21: passkeys not on Lite, `WEB_AUTHN` must be accompanied by another option, user verification preferred by default, no attestation enforcement, 20 passkeys per user, passwordless email and SMS codes, SRP +- [Managed login](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-managed-login.html), checked 2026-10-21: authorization server and hosted pages on a user pool domain, classic hosted UI the only option on Lite, no passkeys in the classic hosted UI, Amplify +- [Third-party sign-in](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-identity-federation.html), checked 2026-10-21: social, SAML, and OIDC providers; Cognito as an OIDC and OAuth 2.0 IdP +- [SAML identity providers](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-saml-idp.html), checked 2026-10-21: SAML 2.0 IdPs, Cognito as a service provider +- [Scopes, M2M, and resource servers](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-define-resource-servers.html), checked 2026-10-21: resource servers, custom scopes, client credentials, API Gateway authorizers, M2M billing model +- [Lambda triggers](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-working-with-lambda-triggers.html), checked 2026-10-21: trigger types, five-second response limit +- [Importing users from a CSV file](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-using-import-tool.html), checked 2026-10-21: password hash import and supported algorithms, 500,000 users per file +- [`ListUsers`](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUsers.html) and [`UserType`](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UserType.html), checked 2026-10-21: at most 60 users per call; user record fields, none of them a password +- [Cognito user profiles export guidance: limitations](https://docs.aws.amazon.com/solutions/latest/cognito-user-profiles-export-reference-architecture/guidance-components.html#limitations), checked 2026-10-21: passwords not backed up, users reset passwords in the new pool; MFA tokens not replicated +- [Data protection in Amazon Cognito](https://docs.aws.amazon.com/cognito/latest/developerguide/data-protection.html), checked 2026-10-21: encryption at rest with AWS owned or customer managed keys in the user pool's Region +- [Compliance validation for Amazon Cognito](https://docs.aws.amazon.com/cognito/latest/developerguide/compliance-validation.html), checked 2026-10-21: SOC, PCI, FedRAMP, HIPAA, AWS Artifact + +Seamless Auth details (Seamless Auth API v0.19.3): + +- [What Is Seamless Auth?](/start/overview), including [When Seamless Auth Is Not The Right Choice](/start/overview#when-seamless-auth-is-not-the-right-choice) +- [Migrating Off Amazon Cognito](/operate/migrate-from-cognito), including [What You Give Up Or Must Plan For](/operate/migrate-from-cognito#what-you-give-up-or-must-plan-for) +- [Migrate Users From Another Identity System](/operate/migrate-users) +- [System Config Reference](/reference/system-config), including [Authenticator Policy](/reference/system-config#authenticator-policy), and [Environment Variables](/reference/environment-variables) (`LOGIN_METHODS`, SMS providers) +- [How To Use Organizations And Memberships](/build/organizations-memberships) +- [OAuth Login](/build/oauth-login) +- [Auth Events and Auditing](/understand/authevents) +- Source: [fells-code on GitHub](https://github.com/fells-code) diff --git a/src/content/docs/compare/firebase-auth.mdx b/src/content/docs/compare/firebase-auth.mdx new file mode 100644 index 0000000..6d0c603 --- /dev/null +++ b/src/content/docs/compare/firebase-auth.mdx @@ -0,0 +1,241 @@ +--- +title: "Seamless Auth vs Firebase Authentication" +description: "Considering a self-hosted, passkey-first alternative to Firebase Authentication? An honest comparison of Seamless Auth and Firebase Authentication (with and without Identity Platform): sign-in methods, passkeys, SAML and OIDC, multi-tenancy, blocking functions, export, hosting, and cost, with dated sources." +sidebar: + order: 7 +--- + +import { Aside } from '@astrojs/starlight/components'; + +Firebase Authentication and Seamless Auth both sign users in to your applications. Firebase +Authentication is a Google-operated service with client SDKs for Apple platforms, Android, the +web, C++, Unity, and Flutter, a drop-in UI library (FirebaseUI), and sign-in with passwords, email +links, phone numbers, anonymous accounts, custom tokens, and federated providers such as Google, +Apple, Facebook, Twitter, and GitHub. It integrates tightly with other Firebase services. An +optional upgrade, Firebase Authentication with Identity Platform, adds multi-factor authentication, +blocking functions, SAML and generic OpenID Connect providers, multi-tenancy, audit logging, and an +SLA, under a different pricing scheme. Seamless Auth is an open source (Apache-2.0), +passwordless-only auth server built around passkeys, which you self-host inside your own stack or +run on the Seamless Auth managed service. + +This page is for an engineer or technical lead deciding whether to move off Firebase +Authentication, or whether to start on it. Every Firebase detail links to a Google page +(firebase.google.com or Google Cloud's Identity Platform docs), and the [Sources](#sources) section +gives the date each one was checked. Seamless Auth details were checked against the source +repositories at Seamless Auth API v0.19.3. Prices, plan contents, and limits change, so confirm them +on [firebase.google.com/pricing](https://firebase.google.com/pricing) and the +[Identity Platform pricing page](https://cloud.google.com/identity-platform/pricing) before you +decide. + +--- + +## Choose Firebase Authentication If + +- **Your app is built on Firebase.** Firebase Authentication works with the Security Rules of the + Firebase Realtime Database and Cloud Storage, and with other Firebase services, out of the box. Seamless Auth sessions are not Firebase ID tokens; to use them with Security Rules, + your backend would have to bridge them, for example through Firebase's custom auth system + integration. +- **You need password sign-in or anonymous accounts.** Firebase supports email and password sign-in + and temporary anonymous accounts that can later be upgraded to regular accounts. Seamless Auth has + no password flow, by design, and no anonymous accounts. +- **You need SAML or many isolated tenants.** With the Identity Platform upgrade, Firebase supports + SAML (web only, service-provider initiated) and generic OpenID Connect providers, and + multi-tenancy: separate silos of users, identity providers, and configuration in one project. + Seamless Auth has no SAML, and one instance has a single user directory and a single runtime + configuration. +- **You want to run custom code inside the sign-in flow.** With the Identity Platform upgrade, + blocking functions run before a user is created, before a user signs in, and (in Node.js) before + an email or SMS is sent. Seamless Auth has no equivalent; that logic goes in your own backend. +- **You want mobile and game SDKs and a drop-in UI from one vendor.** Firebase ships client SDKs for + Apple platforms, Android, web, C++, Unity, and Flutter, plus FirebaseUI. Seamless Auth's frontend + SDKs cover React, Angular, Vue, Svelte, and React Native. +- **You need a vendor's compliance reports or an SLA.** Google lists ISO 27001, 27017, and 27018 + and SOC 1, 2, and 3 for Firebase Authentication; with Identity Platform it adds BAA coverage, + PCI DSS scope, TISAX, and a 99.95% uptime SLA. Seamless Auth has no third-party compliance + attestations of its own. +- **You want nothing to run yourself and a large, established product.** Google operates Firebase + Authentication. Seamless Auth is 0.x, with a much smaller community. + +## Choose Seamless Auth If + +- **You want passkeys as the primary sign-in method.** As of 2026-10-21, Firebase Authentication's + documentation lists no passkey or WebAuthn sign-in method. The only passkey mention we found on + Google's Firebase pages is mock passkey support added to the Authentication emulator in Firebase + CLI v15.21.0 (June 2026), a local testing tool. In Seamless Auth, passkeys are the default sign-in + method, and the `phishing_resistant_only` setting accepts only a passkey to start a session. +- **Users and sessions must stay inside your own boundary, or outside the United States.** Google + states that the Firebase Authentication service runs only from US data centers and processes data + exclusively in the United States. Self-hosted, the Seamless Auth API and its Postgres database run + wherever you deploy them. +- **You want the auth server's source under a permissive license.** The auth API, server adapters, + frontend SDKs, admin dashboard, and CLI are all Apache-2.0. Firebase Authentication is a + proprietary Google service. +- **You want MFA, an audit trail, and organizations without a paid upgrade.** In Firebase, + multi-factor authentication (SMS or TOTP), audit logging, and multi-tenancy need the Identity + Platform upgrade. Seamless Auth ships TOTP as a second factor, passkey step-up, organizations and + memberships with per-organization roles and scopes, and an append-only, hash-chained auth event + trail, all in the open source release. +- **You prefer not to pay per active user or per SMS.** Self-hosting has no per-user fee; you pay for + the infrastructure you run and your own SMS provider (Twilio or AWS SNS). Identity Platform + charges per monthly active user above its free tier, more for SAML and OIDC users, and per SMS. +- **You want your user data in a database you can query.** Self-hosted, users, memberships, and auth + events are rows in a Postgres database you run. + +--- + +## Feature Comparison + +Firebase column as checked on the dates in [Sources](#sources). "Identity Platform" means Firebase +Authentication with Identity Platform, the paid upgrade. + +| | Seamless Auth | Firebase Authentication | +| --- | --- | --- | +| License | Apache-2.0 for the server, SDKs, dashboard, and CLI | Proprietary Google service | +| Hosting | Self-host (Docker, Postgres) or Seamless Auth managed hosting | Operated by Google; the Authentication emulator is for local testing and issues unsigned tokens that production rejects | +| Where user data lives | Your Postgres when self-hosted; Fells Code's infrastructure on the managed path | Google, US data centers only | +| Passkeys | Yes, primary sign-in method (WebAuthn via SimpleWebAuthn); passkey-only mode | No passkey sign-in method in the docs as checked; mock passkey support in the Authentication emulator only | +| Magic links | Yes | Yes, email link sign-in (the email/password provider must be enabled); 5 sign-in emails a day on Spark | +| Email OTP | Yes | Not listed among the sign-in methods | +| SMS OTP | Yes (Twilio or AWS SNS, configured by you) | Yes, phone sign-in on the Blaze plan only, billed per SMS | +| MFA | TOTP and passkey (WebAuthn) step-up as a second factor | SMS and TOTP, with Identity Platform only | +| Passwords | No, by design | Yes | +| Anonymous accounts | No | Yes | +| Social and OIDC login | Yes, instance-wide; CLI presets for Google, GitHub, Microsoft (Entra ID), GitLab | Google, Apple, Facebook, Twitter, GitHub, and more; generic OIDC with Identity Platform | +| SAML enterprise SSO | No | With Identity Platform; web only, service-provider initiated | +| Multi-tenancy | One user directory and one configuration per instance | With Identity Platform: tenants with their own users, providers, and configuration | +| Organizations | Yes: memberships, per-organization roles and scopes, active organization on the session | No organizations feature in the docs checked; tenants with Identity Platform | +| Extensibility | Logic in your own backend, behind the server adapter | Blocking functions with Identity Platform (before create, before sign-in, before email and SMS); must respond within 7 seconds | +| Prebuilt UI | Built-in auth routes (`AuthRoutes` in React; equivalents in Angular, Vue, Svelte), or headless | FirebaseUI, open source drop-in UI, or the SDK with your own UI | +| User import | `seamless migrate csv`, `seamless migrate entra-id`, `POST /admin/users/import`; identities only, no credentials | `firebase auth:import`, including password hashes in many algorithms | +| User export | No bulk export endpoint; self-hosted, the data is in your own Postgres. Paginated admin user list and a passkey coverage report (CSV) | `firebase auth:export` to JSON or CSV, including scrypt password hashes and salts; hash parameters in the console | +| Audit trail | Append-only, hash-chained auth events; NDJSON export with an integrity check | Admin activity and user activity audit logs in Cloud Logging, with Identity Platform | +| Third-party compliance attestations | None for Seamless Auth itself | ISO 27001/27017/27018 and SOC 1/2/3; BAA, PCI DSS, and TISAX with Identity Platform | +| SLA | None | 99.95% uptime with Identity Platform | +| Maturity | 0.x, small community | Established Google product | +| Pricing model | Free to self-host; managed plans in the portal | Spark (no cost) and Blaze (pay as you go) plans; Identity Platform priced per MAU, SAML and OIDC users higher, SMS per message | + + + +--- + +## Architecture Difference + +**Firebase Authentication** is a Google-operated backend that your client SDK talks to directly. +The app collects credentials (or an OAuth token from a federated provider), passes them to the +Firebase Authentication SDK, and Firebase returns an ID token. Firebase services enforce Security +Rules against that token, and your own backend can verify it. Users live in Firebase's user +database, and with Identity Platform, blocking functions can change the outcome of sign-up and +sign-in. + +**Seamless Auth** is a service you run next to your backend: + +```txt +browser or native app + -> your backend's /auth routes (@seamless-auth/express, fastify, nextjs, or the Python/Go/Rust adapter) + -> seamless-auth-api (your infrastructure, or Seamless Auth managed) + -> Postgres +``` + +Clients never call the auth API directly. Your backend mounts the adapter routes, forwards calls +with a service token, and keeps the session in signed `httpOnly` cookies on your domain (native +apps use bearer tokens in the platform keystore). Your backend verifies sessions locally against the +auth API's JWKS. Authorization stays in your own code. See +[What Is Seamless Auth?](/start/overview#how-the-pieces-connect). + +The practical consequence: Firebase Authentication is a client-first service designed to sit in +front of Firebase's own data products; Seamless Auth needs a backend of yours in the path, and the +session lives on your domain. + +--- + +## When Not To Use Seamless Auth + +Be direct with yourself about these before planning a move off Firebase Authentication. If any is a +hard requirement today, stay on Firebase or choose another product. + +- **Your data access depends on Firebase Security Rules.** Realtime Database and Cloud Storage rules + see Firebase-authenticated users, not Seamless Auth sessions. Moving means routing that + access through your backend or bridging identities with custom tokens. +- **Your app has no backend.** Seamless Auth's clients go through a server adapter in your backend; + there is no direct client-to-auth-server mode. +- **Your users sign in with passwords, or you rely on anonymous accounts.** Neither exists in + Seamless Auth, and no password hashes are imported. +- **A customer requires SAML SSO into your app, or you need tenants with separate configuration.** + Seamless Auth has no SAML and no multi-tenancy. Its OAuth and OpenID Connect providers are + configured instance-wide. +- **You depend on blocking functions to shape tokens or gate sign-in.** There is no hook system; you + move that logic into your backend. +- **You need a vendor's SOC 2 report, BAA, or SLA for the auth service itself.** Seamless Auth has no + third-party attestations. Self-hosted, it is covered by your own controls. +- **You need a 1.0 stability guarantee.** Every Seamless Auth package is still 0.x. + +The full list is in +[When Seamless Auth Is Not The Right Choice](/start/overview#when-seamless-auth-is-not-the-right-choice). + +--- + +## Migrating From Firebase Authentication + +There is no Firebase migration guide yet. This page does not describe a tested Firebase migration, +and you should plan one as you would any identity migration, with a dry run. + +What the docs do support today is the generic identity import in +[Migrate Users From Another Identity System](/operate/migrate-users): a CSV of email, external id, +phone, roles, and organizations, imported with `seamless migrate csv`. Firebase's +`firebase auth:export` writes JSON, or a CSV with fixed column positions, holding each user's UID, +email, and phone number among other fields. Those are the kind of fields the import +reads, but the export has to be converted into the import's CSV first, and this page does not +provide that conversion. Seamless Auth imports no credentials of any kind, so the password hashes in +a Firebase export are not used (the import ignores every column it does not map), and each user +proves their email once and enrolls a new passkey. The generic guide's optional +step of signing users in through the old provider during cutover needs the old system to act as an +OpenID Connect provider for Seamless Auth; this page does not cover whether or how that applies to +Firebase. + +Fells Code, which maintains Seamless Auth, offers hands-on migration help: +[fellscode.com](https://fellscode.com). + +--- + +## Sources + +Firebase Authentication and Identity Platform details, each checked on the date shown: + +- [Firebase pricing](https://firebase.google.com/pricing), checked 2026-10-21: Spark and Blaze, 50,000 MAU and 50 SAML or OIDC MAU at no cost, phone sign-in on Blaze only and billed per SMS, overage at Identity Platform rates +- [Identity Platform pricing](https://cloud.google.com/identity-platform/pricing), checked 2026-10-21: tier 1 and tier 2 per-MAU prices, per-SMS prices by country, first ten SMS a day not billed +- [Firebase Authentication](https://firebase.google.com/docs/auth), checked 2026-10-21: sign-in methods, SDK platforms, FirebaseUI, custom auth system integration, Security Rules, Identity Platform upgrade features (MFA, blocking functions, SAML and OIDC, audit logging, multi-tenancy, SLA), Spark limit of 3,000 DAU after upgrading, Blaze per-MAU range +- [Differences between Identity Platform and Firebase Authentication](https://cloud.google.com/identity-platform/docs/product-comparison), checked 2026-10-21: features only in Identity Platform, compliance table (ISO 27001, SOC 1/2/3, TISAX, BAA, PCI DSS), 99.95% SLA +- [Identity Platform multi-tenancy](https://cloud.google.com/identity-platform/docs/multi-tenancy), checked 2026-10-21: tenants and what each one has, supported providers, limitations +- [Extend Firebase Authentication with blocking functions](https://firebase.google.com/docs/auth/extend-with-blocking-functions), checked 2026-10-21: events, 7-second limit, Identity Platform required +- [Authenticate using SAML in web apps](https://firebase.google.com/docs/auth/web/saml), checked 2026-10-21: Identity Platform required, service-provider initiated flow only +- [Add multi-factor authentication to your web app](https://firebase.google.com/docs/auth/web/multi-factor) and [Add TOTP multi-factor authentication](https://firebase.google.com/docs/auth/web/totp-mfa), checked 2026-10-21: SMS and TOTP MFA after the Identity Platform upgrade +- [Email link authentication](https://firebase.google.com/docs/auth/web/email-link-auth), checked 2026-10-21: email/password provider must be enabled +- [Authentication limits](https://firebase.google.com/docs/auth/limits), checked 2026-10-21: email link sign-in emails per day on Spark and Blaze, SMS on Blaze only +- [auth:import and auth:export](https://firebase.google.com/docs/cli/auth), checked 2026-10-21: JSON and CSV export, CSV fields by column position, password hash and salt fields, hash parameters in the console, modified scrypt +- [Connect your app to the Authentication emulator](https://firebase.google.com/docs/emulator-suite/connect_auth), checked 2026-10-21: local emulation, unsigned ID tokens rejected by production +- [Firebase CLI release notes](https://firebase.google.com/support/release-notes/cli), checked 2026-10-21: v15.21.0 (June 17, 2026) added mock passkey (WebAuthn) support to the Authentication emulator +- [Privacy and security in Firebase](https://firebase.google.com/support/privacy), checked 2026-10-21: Firebase Authentication runs only from US data centers; ISO 27001/27017/27018 and SOC 1/2/3 for Firebase Authentication + +Seamless Auth details (Seamless Auth API v0.19.3): + +- [What Is Seamless Auth?](/start/overview), including [When Seamless Auth Is Not The Right Choice](/start/overview#when-seamless-auth-is-not-the-right-choice) +- [Migrate Users From Another Identity System](/operate/migrate-users) +- [System Config Reference](/reference/system-config) and [Environment Variables](/reference/environment-variables) (`LOGIN_METHODS`, SMS providers) +- [How To Use Organizations And Memberships](/build/organizations-memberships) +- [OAuth Login](/build/oauth-login) +- [Auth Events and Auditing](/understand/authevents) +- Source: [fells-code on GitHub](https://github.com/fells-code)