From 240de2e50067c0df9b103bd25f8aca1f5a5373be Mon Sep 17 00:00:00 2001 From: Brandon Corbett Date: Tue, 20 Oct 2026 21:13:29 -0400 Subject: [PATCH 1/2] docs: compare Seamless Auth with Cognito and Firebase Auth Add comparison pages for Amazon Cognito and Firebase Authentication, following the Auth0 and Keycloak pages. Vendor facts come from AWS and Google pages checked on 2026-10-20 and are listed in each page's Sources. Seamless Auth claims were checked against the source repositories at API v0.19.1. Closes #109 --- src/content/docs/compare/cognito.mdx | 227 +++++++++++++++++++ src/content/docs/compare/firebase-auth.mdx | 241 +++++++++++++++++++++ 2 files changed, 468 insertions(+) create mode 100644 src/content/docs/compare/cognito.mdx create mode 100644 src/content/docs/compare/firebase-auth.mdx diff --git a/src/content/docs/compare/cognito.mdx b/src/content/docs/compare/cognito.mdx new file mode 100644 index 0000000..ae0b2d9 --- /dev/null +++ b/src/content/docs/compare/cognito.mdx @@ -0,0 +1,227 @@ +--- +title: "Seamless Auth vs Amazon Cognito" +description: "Considering a self-hosted, open source alternative to Amazon Cognito? An honest comparison of Seamless Auth and Cognito user pools: feature plans, passkeys, passwordless codes, federation, machine-to-machine tokens, Lambda triggers, export, hosting, and cost, with dated sources." +sidebar: + order: 6 +--- + +import { Aside } from '@astrojs/starlight/components'; + +Amazon Cognito and Seamless Auth both sign users in to your applications and manage their sessions. +Cognito user pools are an AWS-operated user directory and OAuth 2.0 and OpenID Connect authorization +server, sold in three feature plans (Lite, Essentials, and Plus). They support passwords, passkeys, +email and SMS one-time codes, social, SAML, and OIDC identity providers, machine-to-machine tokens, +Lambda triggers, and a hosted sign-in page called managed login, and they plug into other AWS +services. Seamless Auth is an open source (Apache-2.0), passwordless-only auth server that you +self-host inside your own stack or run on the Seamless Auth managed service. It does much less than +Cognito, and it is not tied to AWS. + +This page is for an engineer or technical lead deciding whether to move off Cognito, or whether to +start on it. Every Cognito detail links to an AWS page, and the [Sources](#sources) section gives +the date each one was checked. Seamless Auth details were checked against the source repositories +at Seamless Auth API v0.19.1. Prices, plan contents, and feature limits change, so confirm them on +[aws.amazon.com/cognito/pricing](https://aws.amazon.com/cognito/pricing/) before you decide. + +--- + +## Choose Cognito If + +- **Your application is built on AWS and leans on its integrations.** Cognito user pool groups can + carry IAM roles for identity pools, identity pools exchange a sign-in for AWS credentials, and API + Gateway accepts Cognito access and ID tokens in a Cognito authorizer. Seamless Auth issues no AWS + credentials and no AWS service reads its sessions natively. +- **You need SAML enterprise SSO.** User pools federate with SAML 2.0 and OpenID Connect identity + providers on every feature plan, as well as social providers. Seamless Auth has no SAML. +- **You need an identity provider for other applications or machine clients.** A user pool with a + domain is an OAuth 2.0 and OpenID Connect authorization server, with resource servers, custom + scopes, and machine-to-machine access tokens through the client credentials grant. Seamless Auth + signs users in to your application only. It is not an OpenID Connect provider for third-party + clients and issues no machine-to-machine tokens. +- **You need password sign-in.** Cognito supports passwords, including Secure Remote Password (SRP), + and can import existing bcrypt, scrypt, Argon2id, or PBKDF2-SHA256 password hashes. Seamless Auth + has no password flow, by design. +- **You want to run custom code inside the sign-in flow.** Cognito invokes Lambda functions at pre + sign-up, pre and post authentication, pre token generation, user migration, custom messages, + custom senders, and custom authentication challenges. Seamless Auth has no equivalent; that logic + goes in your own backend. +- **You need a vendor's compliance coverage.** AWS states that third-party auditors assess Cognito + as part of AWS compliance programs including SOC, PCI, FedRAMP, and HIPAA, with reports in AWS + Artifact. Seamless Auth has no third-party compliance attestations of its own. +- **You want nothing to run yourself and a large, established product.** AWS operates Cognito. + Seamless Auth is 0.x, with a much smaller community. + +## Choose Seamless Auth If + +- **You want passkeys enforced, not just offered.** In Cognito, passkey sign-in is not on the Lite + plan, and the user pool sign-in policy requires the passkey option to be accompanied by at least + one other first factor. Seamless Auth's `phishing_resistant_only` setting accepts only a passkey + to start a session. +- **You want a stricter passkey policy.** Cognito's user verification setting defaults to preferred, + and its docs state that it does not currently support attestation enforcement. Seamless Auth's + `authenticator_policy` defaults user verification to required, can block synced passkeys, and, + with direct attestation, can allow or deny authenticator models by AAGUID. See + [Authenticator Policy](/reference/system-config#authenticator-policy). +- **Users and sessions must stay inside your own boundary, on any cloud.** Self-hosted, the auth API + and its Postgres database run in your infrastructure, which can be your own AWS account or + somewhere else. A Cognito user pool is an AWS-operated service in an AWS Region. +- **You want the auth server's source under a permissive license.** The auth API, server adapters, + frontend SDKs, admin dashboard, and CLI are all Apache-2.0. Cognito is a proprietary AWS service. +- **You prefer not to pay per active user or per token request.** Self-hosting has no per-user fee; + you pay for the infrastructure you run. Cognito bills monthly active users by plan, federated + users separately, and each machine-to-machine token request. +- **You want your user data in a database you can query.** Self-hosted, users, memberships, and + auth events are rows in a Postgres database you run, and the auth event trail exports as a + hash-chained file you can verify. Cognito has no bulk export job: you page through `ListUsers`, at + most 60 users per call, and the user records it returns carry no password. +- **You want organizations and memberships built in.** Seamless Auth ships organizations, + memberships, per-organization roles and scopes, and an active organization on the session. + +--- + +## Feature Comparison + +Cognito column as checked on the dates in [Sources](#sources). "Plan" names refer to Cognito's user +pool feature plans. + +| | Seamless Auth | Amazon Cognito user pools | +| --- | --- | --- | +| License | Apache-2.0 for the server, SDKs, dashboard, and CLI | Proprietary AWS service | +| Hosting | Self-host (Docker, Postgres) or Seamless Auth managed hosting | Operated by AWS, per AWS Region; multi-Region replication is a paid add-on | +| Where user data lives | Your Postgres when self-hosted; Fells Code's infrastructure on the managed path | AWS, in the user pool's Region; encrypted at rest with an AWS owned key or your own KMS key | +| Passkeys | Yes, primary sign-in method (WebAuthn via SimpleWebAuthn); passkey-only mode | Yes, on Essentials and Plus, not Lite; must be offered alongside another first factor; up to 20 per user | +| Passkey policy | User verification required by default; synced passkey and AAGUID allow or deny rules | User verification preferred by default, can be set to required; no attestation enforcement | +| Magic links | Yes | Not listed among Cognito's sign-in methods | +| Email OTP | Yes | Yes, as a first factor on Essentials and Plus | +| SMS OTP | Yes (Twilio or AWS SNS, configured by you) | Yes, as a first factor on Essentials and Plus; messages sent through Amazon SNS and billed separately | +| MFA | TOTP and passkey (WebAuthn) step-up as a second factor | Authenticator app and SMS codes on all plans; email codes on Essentials and Plus | +| Passwords | No, by design | Yes, including SRP; password hash import from CSV | +| Social and OIDC login | Yes, instance-wide; CLI presets for Google, GitHub, Microsoft (Entra ID), GitLab | Yes: Google, Facebook, Login with Amazon, Sign in with Apple, and OIDC providers, on all plans | +| SAML enterprise SSO | No | Yes, as a SAML 2.0 service provider, on all plans | +| Acts as an OAuth/OIDC provider, machine-to-machine tokens | No | Yes: authorization server, resource servers, custom scopes, client credentials | +| Organizations | Yes: memberships, per-organization roles and scopes, active organization on the session | Groups, optionally mapped to IAM roles | +| Extensibility | Logic in your own backend, behind the server adapter | Lambda triggers on sign-up, authentication, token generation, migration, and messages | +| Prebuilt UI | Built-in auth routes (`AuthRoutes` in React; equivalents in Angular, Vue, Svelte), or headless | Managed login on a user pool domain (Essentials and Plus); classic hosted UI on all plans | +| AWS integration | None; your backend verifies sessions with a server adapter | Identity pools for AWS credentials, API Gateway authorizers, Amplify | +| User import | `seamless migrate csv`, `POST /admin/users/import`; identities only, no credentials | CSV import jobs (up to 500,000 users per file), optionally with password hashes; user migration Lambda trigger | +| User export | No bulk export endpoint; self-hosted, the data is in your own Postgres. Paginated admin user list and a passkey coverage report (CSV) | No bulk export job; `ListUsers`, 60 users per call, with no password field | +| Audit trail | Append-only, hash-chained auth events; NDJSON export with an integrity check | User activity and risk logs with export on Plus | +| Third-party compliance attestations | None for Seamless Auth itself | In scope for AWS programs including SOC, PCI, FedRAMP, and HIPAA | +| Maturity | 0.x, small community | Established AWS service | +| Pricing model | Free to self-host; managed plans in the portal | Per MAU by plan, federated MAUs priced separately, M2M billed per token request, add-ons for multi-Region replication and higher quotas | + + + +--- + +## Architecture Difference + +**Cognito** is an AWS-operated identity provider. Your app signs users in either through managed +login on a user pool domain (a Cognito prefix domain or your own custom domain), which redirects +back with OAuth 2.0 and OpenID Connect tokens, or through the user pools API from your own code. +Your APIs validate Cognito-issued JWTs, or let API Gateway do it. Users, credentials, and groups +live in the user pool, and Lambda triggers customize the flow. Identity pools can exchange those +tokens for temporary AWS credentials. + +**Seamless Auth** is a service you run next to your backend: + +```txt +browser or native app + -> your backend's /auth routes (@seamless-auth/express, fastify, nextjs, or the Python/Go/Rust adapter) + -> seamless-auth-api (your infrastructure, or Seamless Auth managed) + -> Postgres +``` + +Clients never call the auth API directly. Your backend mounts the adapter routes, forwards calls +with a service token, and keeps the session in signed `httpOnly` cookies on your domain (native +apps use bearer tokens in the platform keystore). Your backend verifies sessions locally against the +auth API's JWKS. Authorization stays in your own code. See +[What Is Seamless Auth?](/start/overview#how-the-pieces-connect). + +The practical consequence: Cognito is an identity provider wired into AWS that many apps, APIs, and +AWS services can trust; Seamless Auth is sign-in for your application, the sign-in pages are yours, +and anything AWS-side goes through your backend. + +--- + +## When Not To Use Seamless Auth + +Be direct with yourself about these before planning a move off Cognito. If any is a hard +requirement today, stay on Cognito or choose another product. + +- **Your frontend calls AWS services directly with identity pool credentials.** Seamless Auth does + not issue AWS credentials. Those calls have to move behind your backend. +- **API Gateway authorizers, Amplify Auth, or other AWS services read Cognito tokens.** None of them + read Seamless Auth sessions. Each one needs replacing with verification in your backend. +- **A customer requires SAML SSO into your app.** Seamless Auth has no SAML. Its OAuth and OpenID + Connect providers are configured instance-wide, not per customer organization. +- **Other applications or machine clients use Cognito as their authorization server.** Seamless Auth + is not an OpenID Connect provider and issues no client credentials tokens. +- **Your users sign in with passwords and you cannot change that.** There is no password flow, and + no password hashes are imported. +- **You depend on Lambda triggers to shape tokens or gate sign-in.** There is no hook system; you + move that logic into your backend. +- **You need a vendor's audit reports for the auth service itself.** Seamless Auth has no + third-party attestations. Self-hosted, it is covered by your own controls. +- **You need a 1.0 stability guarantee.** Every Seamless Auth package is still 0.x. + +The full list is in +[When Seamless Auth Is Not The Right Choice](/start/overview#when-seamless-auth-is-not-the-right-choice) +and [What You Give Up Or Must Plan For](/operate/migrate-from-cognito#what-you-give-up-or-must-plan-for). + +--- + +## Migrating From Cognito + +The [Cognito migration guide](/operate/migrate-from-cognito) covers the move end to end: export +users with a paged `aws cognito-idp list-users` loop (and groups with `ListUsersInGroup`), convert +the export to CSV with `jq`, using each user's `sub` as the external id, import identities with +`seamless migrate csv --source cognito`, keep Cognito sign-in working by adding the user pool as an +OpenID Connect provider linked by `sub` while users move, get everyone onto a passkey, retire +Cognito sign-in per organization or all at once, and switch the user pool off. + +Seamless Auth imports no credentials of any kind, so the lack of a password export from Cognito +does not matter, and TOTP secrets, SMS MFA settings, and passkeys registered with Cognito do not +carry over. Each user proves their email once, or signs in through Cognito during cutover, and +enrolls a new passkey. Fells Code, which maintains Seamless Auth, offers hands-on migration help +(see the end of that guide). + +--- + +## Sources + +Amazon Cognito details, each checked on the date shown: + +- [Amazon Cognito pricing](https://aws.amazon.com/cognito/pricing/), checked 2026-10-20: Lite, Essentials, and Plus; free tiers; per-MAU prices; federated MAU price; machine-to-machine billing per token request and example rate; multi-Region replication and quota add-ons; SMS and email billed through SNS and SES; GovCloud exclusion; plan descriptions (Essentials adds managed login and passwordless sign-in with passkeys, email, or SMS) +- [User pool feature plans](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-sign-in-feature-plans.html), checked 2026-10-20: features by plan, including passkeys and passwordless codes on Essentials and Plus, federation, authorization server, M2M, user import, MFA factors, Lambda triggers, managed login, and Plus activity logs and export +- [Authentication flows](https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-authentication-flow-methods.html), checked 2026-10-20: passkeys not on Lite, `WEB_AUTHN` must be accompanied by another option, user verification preferred by default, no attestation enforcement, 20 passkeys per user, passwordless email and SMS codes, SRP +- [Managed login](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-managed-login.html), checked 2026-10-20: authorization server and hosted pages on a user pool domain, classic hosted UI the only option on Lite, no passkeys in the classic hosted UI, Amplify +- [Third-party sign-in](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-identity-federation.html), checked 2026-10-20: social, SAML, and OIDC providers; Cognito as an OIDC and OAuth 2.0 IdP +- [SAML identity providers](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-saml-idp.html), checked 2026-10-20: SAML 2.0 IdPs, Cognito as a service provider +- [Scopes, M2M, and resource servers](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-define-resource-servers.html), checked 2026-10-20: resource servers, custom scopes, client credentials, API Gateway authorizers, M2M billing model +- [Lambda triggers](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-working-with-lambda-triggers.html), checked 2026-10-20: trigger types, five-second response limit +- [Importing users from a CSV file](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-using-import-tool.html), checked 2026-10-20: password hash import and supported algorithms, 500,000 users per file +- [`ListUsers`](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUsers.html) and [`UserType`](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UserType.html), checked 2026-10-20: at most 60 users per call; user record fields, none of them a password +- [Cognito user profiles export guidance: limitations](https://docs.aws.amazon.com/solutions/latest/cognito-user-profiles-export-reference-architecture/guidance-components.html#limitations), checked 2026-10-20: passwords not backed up, users reset passwords in the new pool; MFA tokens not replicated +- [Data protection in Amazon Cognito](https://docs.aws.amazon.com/cognito/latest/developerguide/data-protection.html), checked 2026-10-20: encryption at rest with AWS owned or customer managed keys in the user pool's Region +- [Compliance validation for Amazon Cognito](https://docs.aws.amazon.com/cognito/latest/developerguide/compliance-validation.html), checked 2026-10-20: SOC, PCI, FedRAMP, HIPAA, AWS Artifact + +Seamless Auth details (Seamless Auth API v0.19.1): + +- [What Is Seamless Auth?](/start/overview), including [When Seamless Auth Is Not The Right Choice](/start/overview#when-seamless-auth-is-not-the-right-choice) +- [Migrating Off Amazon Cognito](/operate/migrate-from-cognito), including [What You Give Up Or Must Plan For](/operate/migrate-from-cognito#what-you-give-up-or-must-plan-for) +- [Migrate Users From Another Identity System](/operate/migrate-users) +- [System Config Reference](/reference/system-config), including [Authenticator Policy](/reference/system-config#authenticator-policy), and [Environment Variables](/reference/environment-variables) (`LOGIN_METHODS`, SMS providers) +- [How To Use Organizations And Memberships](/build/organizations-memberships) +- [OAuth Login](/build/oauth-login) +- [Auth Events and Auditing](/understand/authevents) +- Source: [fells-code on GitHub](https://github.com/fells-code) diff --git a/src/content/docs/compare/firebase-auth.mdx b/src/content/docs/compare/firebase-auth.mdx new file mode 100644 index 0000000..dc41a16 --- /dev/null +++ b/src/content/docs/compare/firebase-auth.mdx @@ -0,0 +1,241 @@ +--- +title: "Seamless Auth vs Firebase Authentication" +description: "Considering a self-hosted, passkey-first alternative to Firebase Authentication? An honest comparison of Seamless Auth and Firebase Authentication (with and without Identity Platform): sign-in methods, passkeys, SAML and OIDC, multi-tenancy, blocking functions, export, hosting, and cost, with dated sources." +sidebar: + order: 7 +--- + +import { Aside } from '@astrojs/starlight/components'; + +Firebase Authentication and Seamless Auth both sign users in to your applications. Firebase +Authentication is a Google-operated service with client SDKs for Apple platforms, Android, the +web, C++, Unity, and Flutter, a drop-in UI library (FirebaseUI), and sign-in with passwords, email +links, phone numbers, anonymous accounts, custom tokens, and federated providers such as Google, +Apple, Facebook, Twitter, and GitHub. It integrates tightly with other Firebase services. An +optional upgrade, Firebase Authentication with Identity Platform, adds multi-factor authentication, +blocking functions, SAML and generic OpenID Connect providers, multi-tenancy, audit logging, and an +SLA, under a different pricing scheme. Seamless Auth is an open source (Apache-2.0), +passwordless-only auth server built around passkeys, which you self-host inside your own stack or +run on the Seamless Auth managed service. + +This page is for an engineer or technical lead deciding whether to move off Firebase +Authentication, or whether to start on it. Every Firebase detail links to a Google page +(firebase.google.com or Google Cloud's Identity Platform docs), and the [Sources](#sources) section +gives the date each one was checked. Seamless Auth details were checked against the source +repositories at Seamless Auth API v0.19.1. Prices, plan contents, and limits change, so confirm them +on [firebase.google.com/pricing](https://firebase.google.com/pricing) and the +[Identity Platform pricing page](https://cloud.google.com/identity-platform/pricing) before you +decide. + +--- + +## Choose Firebase Authentication If + +- **Your app is built on Firebase.** Firebase Authentication works with the Security Rules of the + Firebase Realtime Database and Cloud Storage, and with other Firebase services, out of the box. Seamless Auth sessions are not Firebase ID tokens; to use them with Security Rules, + your backend would have to bridge them, for example through Firebase's custom auth system + integration. +- **You need password sign-in or anonymous accounts.** Firebase supports email and password sign-in + and temporary anonymous accounts that can later be upgraded to regular accounts. Seamless Auth has + no password flow, by design, and no anonymous accounts. +- **You need SAML or many isolated tenants.** With the Identity Platform upgrade, Firebase supports + SAML (web only, service-provider initiated) and generic OpenID Connect providers, and + multi-tenancy: separate silos of users, identity providers, and configuration in one project. + Seamless Auth has no SAML, and one instance has a single user directory and a single runtime + configuration. +- **You want to run custom code inside the sign-in flow.** With the Identity Platform upgrade, + blocking functions run before a user is created, before a user signs in, and (in Node.js) before + an email or SMS is sent. Seamless Auth has no equivalent; that logic goes in your own backend. +- **You want mobile and game SDKs and a drop-in UI from one vendor.** Firebase ships client SDKs for + Apple platforms, Android, web, C++, Unity, and Flutter, plus FirebaseUI. Seamless Auth's frontend + SDKs cover React, Angular, Vue, Svelte, and React Native. +- **You need a vendor's compliance reports or an SLA.** Google lists ISO 27001, 27017, and 27018 + and SOC 1, 2, and 3 for Firebase Authentication; with Identity Platform it adds BAA coverage, + PCI DSS scope, TISAX, and a 99.95% uptime SLA. Seamless Auth has no third-party compliance + attestations of its own. +- **You want nothing to run yourself and a large, established product.** Google operates Firebase + Authentication. Seamless Auth is 0.x, with a much smaller community. + +## Choose Seamless Auth If + +- **You want passkeys as the primary sign-in method.** As of 2026-10-20, Firebase Authentication's + documentation lists no passkey or WebAuthn sign-in method. The only passkey mention we found on + Google's Firebase pages is mock passkey support added to the Authentication emulator in Firebase + CLI v15.21.0 (June 2026), a local testing tool. In Seamless Auth, passkeys are the default sign-in + method, and the `phishing_resistant_only` setting accepts only a passkey to start a session. +- **Users and sessions must stay inside your own boundary, or outside the United States.** Google + states that the Firebase Authentication service runs only from US data centers and processes data + exclusively in the United States. Self-hosted, the Seamless Auth API and its Postgres database run + wherever you deploy them. +- **You want the auth server's source under a permissive license.** The auth API, server adapters, + frontend SDKs, admin dashboard, and CLI are all Apache-2.0. Firebase Authentication is a + proprietary Google service. +- **You want MFA, an audit trail, and organizations without a paid upgrade.** In Firebase, + multi-factor authentication (SMS or TOTP), audit logging, and multi-tenancy need the Identity + Platform upgrade. Seamless Auth ships TOTP as a second factor, passkey step-up, organizations and + memberships with per-organization roles and scopes, and an append-only, hash-chained auth event + trail, all in the open source release. +- **You prefer not to pay per active user or per SMS.** Self-hosting has no per-user fee; you pay for + the infrastructure you run and your own SMS provider (Twilio or AWS SNS). Identity Platform + charges per monthly active user above its free tier, more for SAML and OIDC users, and per SMS. +- **You want your user data in a database you can query.** Self-hosted, users, memberships, and auth + events are rows in a Postgres database you run. + +--- + +## Feature Comparison + +Firebase column as checked on the dates in [Sources](#sources). "Identity Platform" means Firebase +Authentication with Identity Platform, the paid upgrade. + +| | Seamless Auth | Firebase Authentication | +| --- | --- | --- | +| License | Apache-2.0 for the server, SDKs, dashboard, and CLI | Proprietary Google service | +| Hosting | Self-host (Docker, Postgres) or Seamless Auth managed hosting | Operated by Google; the Authentication emulator is for local testing and issues unsigned tokens that production rejects | +| Where user data lives | Your Postgres when self-hosted; Fells Code's infrastructure on the managed path | Google, US data centers only | +| Passkeys | Yes, primary sign-in method (WebAuthn via SimpleWebAuthn); passkey-only mode | No passkey sign-in method in the docs as checked; mock passkey support in the Authentication emulator only | +| Magic links | Yes | Yes, email link sign-in (the email/password provider must be enabled); 5 sign-in emails a day on Spark | +| Email OTP | Yes | Not listed among the sign-in methods | +| SMS OTP | Yes (Twilio or AWS SNS, configured by you) | Yes, phone sign-in on the Blaze plan only, billed per SMS | +| MFA | TOTP and passkey (WebAuthn) step-up as a second factor | SMS and TOTP, with Identity Platform only | +| Passwords | No, by design | Yes | +| Anonymous accounts | No | Yes | +| Social and OIDC login | Yes, instance-wide; CLI presets for Google, GitHub, Microsoft (Entra ID), GitLab | Google, Apple, Facebook, Twitter, GitHub, and more; generic OIDC with Identity Platform | +| SAML enterprise SSO | No | With Identity Platform; web only, service-provider initiated | +| Multi-tenancy | One user directory and one configuration per instance | With Identity Platform: tenants with their own users, providers, and configuration | +| Organizations | Yes: memberships, per-organization roles and scopes, active organization on the session | No organizations feature in the docs checked; tenants with Identity Platform | +| Extensibility | Logic in your own backend, behind the server adapter | Blocking functions with Identity Platform (before create, before sign-in, before email and SMS); must respond within 7 seconds | +| Prebuilt UI | Built-in auth routes (`AuthRoutes` in React; equivalents in Angular, Vue, Svelte), or headless | FirebaseUI, open source drop-in UI, or the SDK with your own UI | +| User import | `seamless migrate csv`, `POST /admin/users/import`; identities only, no credentials | `firebase auth:import`, including password hashes in many algorithms | +| User export | No bulk export endpoint; self-hosted, the data is in your own Postgres. Paginated admin user list and a passkey coverage report (CSV) | `firebase auth:export` to JSON or CSV, including scrypt password hashes and salts; hash parameters in the console | +| Audit trail | Append-only, hash-chained auth events; NDJSON export with an integrity check | Admin activity and user activity audit logs in Cloud Logging, with Identity Platform | +| Third-party compliance attestations | None for Seamless Auth itself | ISO 27001/27017/27018 and SOC 1/2/3; BAA, PCI DSS, and TISAX with Identity Platform | +| SLA | None | 99.95% uptime with Identity Platform | +| Maturity | 0.x, small community | Established Google product | +| Pricing model | Free to self-host; managed plans in the portal | Spark (no cost) and Blaze (pay as you go) plans; Identity Platform priced per MAU, SAML and OIDC users higher, SMS per message | + + + +--- + +## Architecture Difference + +**Firebase Authentication** is a Google-operated backend that your client SDK talks to directly. +The app collects credentials (or an OAuth token from a federated provider), passes them to the +Firebase Authentication SDK, and Firebase returns an ID token. Firebase services enforce Security +Rules against that token, and your own backend can verify it. Users live in Firebase's user +database, and with Identity Platform, blocking functions can change the outcome of sign-up and +sign-in. + +**Seamless Auth** is a service you run next to your backend: + +```txt +browser or native app + -> your backend's /auth routes (@seamless-auth/express, fastify, nextjs, or the Python/Go/Rust adapter) + -> seamless-auth-api (your infrastructure, or Seamless Auth managed) + -> Postgres +``` + +Clients never call the auth API directly. Your backend mounts the adapter routes, forwards calls +with a service token, and keeps the session in signed `httpOnly` cookies on your domain (native +apps use bearer tokens in the platform keystore). Your backend verifies sessions locally against the +auth API's JWKS. Authorization stays in your own code. See +[What Is Seamless Auth?](/start/overview#how-the-pieces-connect). + +The practical consequence: Firebase Authentication is a client-first service designed to sit in +front of Firebase's own data products; Seamless Auth needs a backend of yours in the path, and the +session lives on your domain. + +--- + +## When Not To Use Seamless Auth + +Be direct with yourself about these before planning a move off Firebase Authentication. If any is a +hard requirement today, stay on Firebase or choose another product. + +- **Your data access depends on Firebase Security Rules.** Realtime Database and Cloud Storage rules + see Firebase-authenticated users, not Seamless Auth sessions. Moving means routing that + access through your backend or bridging identities with custom tokens. +- **Your app has no backend.** Seamless Auth's clients go through a server adapter in your backend; + there is no direct client-to-auth-server mode. +- **Your users sign in with passwords, or you rely on anonymous accounts.** Neither exists in + Seamless Auth, and no password hashes are imported. +- **A customer requires SAML SSO into your app, or you need tenants with separate configuration.** + Seamless Auth has no SAML and no multi-tenancy. Its OAuth and OpenID Connect providers are + configured instance-wide. +- **You depend on blocking functions to shape tokens or gate sign-in.** There is no hook system; you + move that logic into your backend. +- **You need a vendor's SOC 2 report, BAA, or SLA for the auth service itself.** Seamless Auth has no + third-party attestations. Self-hosted, it is covered by your own controls. +- **You need a 1.0 stability guarantee.** Every Seamless Auth package is still 0.x. + +The full list is in +[When Seamless Auth Is Not The Right Choice](/start/overview#when-seamless-auth-is-not-the-right-choice). + +--- + +## Migrating From Firebase Authentication + +There is no Firebase migration guide yet. This page does not describe a tested Firebase migration, +and you should plan one as you would any identity migration, with a dry run. + +What the docs do support today is the generic identity import in +[Migrate Users From Another Identity System](/operate/migrate-users): a CSV of email, external id, +phone, roles, and organizations, imported with `seamless migrate csv`. Firebase's +`firebase auth:export` writes JSON, or a CSV with fixed column positions and no header row, holding +each user's UID, email, and phone number among other fields. Those are the kind of fields the import +reads, but the export has to be converted into the import's CSV first, and this page does not +provide that conversion. Seamless Auth imports no credentials of any kind, so the password hashes in +a Firebase export are not used (the import ignores every column it does not map), and each user +proves their email once and enrolls a new passkey. The generic guide's optional +step of signing users in through the old provider during cutover needs the old system to act as an +OpenID Connect provider for Seamless Auth; this page does not cover whether or how that applies to +Firebase. + +Fells Code, which maintains Seamless Auth, offers hands-on migration help: +[fellscode.com](https://fellscode.com). + +--- + +## Sources + +Firebase Authentication and Identity Platform details, each checked on the date shown: + +- [Firebase pricing](https://firebase.google.com/pricing), checked 2026-10-20: Spark and Blaze, 50,000 MAU and 50 SAML or OIDC MAU at no cost, phone sign-in on Blaze only and billed per SMS, overage at Identity Platform rates +- [Identity Platform pricing](https://cloud.google.com/identity-platform/pricing), checked 2026-10-20: tier 1 and tier 2 per-MAU prices, per-SMS prices by country, first ten SMS a day not billed +- [Firebase Authentication](https://firebase.google.com/docs/auth), checked 2026-10-20: sign-in methods, SDK platforms, FirebaseUI, custom auth system integration, Security Rules, Identity Platform upgrade features (MFA, blocking functions, SAML and OIDC, audit logging, multi-tenancy, SLA), Spark limit of 3,000 DAU after upgrading, Blaze per-MAU range +- [Differences between Identity Platform and Firebase Authentication](https://cloud.google.com/identity-platform/docs/product-comparison), checked 2026-10-20: features only in Identity Platform, compliance table (ISO 27001, SOC 1/2/3, TISAX, BAA, PCI DSS), 99.95% SLA +- [Identity Platform multi-tenancy](https://cloud.google.com/identity-platform/docs/multi-tenancy), checked 2026-10-20: tenants and what each one has, supported providers, limitations +- [Extend Firebase Authentication with blocking functions](https://firebase.google.com/docs/auth/extend-with-blocking-functions), checked 2026-10-20: events, 7-second limit, Identity Platform required +- [Authenticate using SAML in web apps](https://firebase.google.com/docs/auth/web/saml), checked 2026-10-20: Identity Platform required, service-provider initiated flow only +- [Add multi-factor authentication to your web app](https://firebase.google.com/docs/auth/web/multi-factor) and [Add TOTP multi-factor authentication](https://firebase.google.com/docs/auth/web/totp-mfa), checked 2026-10-20: SMS and TOTP MFA after the Identity Platform upgrade +- [Email link authentication](https://firebase.google.com/docs/auth/web/email-link-auth), checked 2026-10-20: email/password provider must be enabled +- [Authentication limits](https://firebase.google.com/docs/auth/limits), checked 2026-10-20: email link sign-in emails per day on Spark and Blaze, SMS on Blaze only +- [auth:import and auth:export](https://firebase.google.com/docs/cli/auth), checked 2026-10-20: JSON and CSV export, password hash and salt fields, hash parameters in the console, modified scrypt +- [Connect your app to the Authentication emulator](https://firebase.google.com/docs/emulator-suite/connect_auth), checked 2026-10-20: local emulation, unsigned ID tokens rejected by production +- [Firebase CLI release notes](https://firebase.google.com/support/release-notes/cli), checked 2026-10-20: v15.21.0 (June 17, 2026) added mock passkey (WebAuthn) support to the Authentication emulator +- [Privacy and security in Firebase](https://firebase.google.com/support/privacy), checked 2026-10-20: Firebase Authentication runs only from US data centers; ISO 27001/27017/27018 and SOC 1/2/3 for Firebase Authentication + +Seamless Auth details (Seamless Auth API v0.19.1): + +- [What Is Seamless Auth?](/start/overview), including [When Seamless Auth Is Not The Right Choice](/start/overview#when-seamless-auth-is-not-the-right-choice) +- [Migrate Users From Another Identity System](/operate/migrate-users) +- [System Config Reference](/reference/system-config) and [Environment Variables](/reference/environment-variables) (`LOGIN_METHODS`, SMS providers) +- [How To Use Organizations And Memberships](/build/organizations-memberships) +- [OAuth Login](/build/oauth-login) +- [Auth Events and Auditing](/understand/authevents) +- Source: [fells-code on GitHub](https://github.com/fells-code) From 7c17d58ee170c9e59388be672ac1c09c1c6690fb Mon Sep 17 00:00:00 2001 From: Brandon Corbett Date: Wed, 21 Oct 2026 10:15:01 -0400 Subject: [PATCH 2/2] docs: re-check the Cognito and Firebase sources on publish day Re-fetch every AWS and Google source on 2026-10-21 and move the checked dates forward. All vendor facts still match except the Firebase export CSV having no header row, which the CLI page does not state, so that phrase is removed. Seamless Auth claims are now stated at API v0.19.3, and the user import rows list `seamless migrate entra-id` (seamless-cli 0.25.0), matching the Auth0 page. --- src/content/docs/compare/cognito.mdx | 36 +++++++++--------- src/content/docs/compare/firebase-auth.mdx | 44 +++++++++++----------- 2 files changed, 40 insertions(+), 40 deletions(-) diff --git a/src/content/docs/compare/cognito.mdx b/src/content/docs/compare/cognito.mdx index ae0b2d9..4860909 100644 --- a/src/content/docs/compare/cognito.mdx +++ b/src/content/docs/compare/cognito.mdx @@ -19,7 +19,7 @@ Cognito, and it is not tied to AWS. This page is for an engineer or technical lead deciding whether to move off Cognito, or whether to start on it. Every Cognito detail links to an AWS page, and the [Sources](#sources) section gives the date each one was checked. Seamless Auth details were checked against the source repositories -at Seamless Auth API v0.19.1. Prices, plan contents, and feature limits change, so confirm them on +at Seamless Auth API v0.19.3. Prices, plan contents, and feature limits change, so confirm them on [aws.amazon.com/cognito/pricing](https://aws.amazon.com/cognito/pricing/) before you decide. --- @@ -102,7 +102,7 @@ pool feature plans. | Extensibility | Logic in your own backend, behind the server adapter | Lambda triggers on sign-up, authentication, token generation, migration, and messages | | Prebuilt UI | Built-in auth routes (`AuthRoutes` in React; equivalents in Angular, Vue, Svelte), or headless | Managed login on a user pool domain (Essentials and Plus); classic hosted UI on all plans | | AWS integration | None; your backend verifies sessions with a server adapter | Identity pools for AWS credentials, API Gateway authorizers, Amplify | -| User import | `seamless migrate csv`, `POST /admin/users/import`; identities only, no credentials | CSV import jobs (up to 500,000 users per file), optionally with password hashes; user migration Lambda trigger | +| User import | `seamless migrate csv`, `seamless migrate entra-id`, `POST /admin/users/import`; identities only, no credentials | CSV import jobs (up to 500,000 users per file), optionally with password hashes; user migration Lambda trigger | | User export | No bulk export endpoint; self-hosted, the data is in your own Postgres. Paginated admin user list and a passkey coverage report (CSV) | No bulk export job; `ListUsers`, 60 users per call, with no password field | | Audit trail | Append-only, hash-chained auth events; NDJSON export with an integrity check | User activity and risk logs with export on Plus | | Third-party compliance attestations | None for Seamless Auth itself | In scope for AWS programs including SOC, PCI, FedRAMP, and HIPAA | @@ -110,7 +110,7 @@ pool feature plans. | Pricing model | Free to self-host; managed plans in the portal | Per MAU by plan, federated MAUs priced separately, M2M billed per token request, add-ons for multi-Region replication and higher quotas |