SEQN Auth

SEQN Auth is the hosted Identity OS surface for Silver/SEQN apps, backed by the self-hosted Silver Auth API and Authentik. It gives AI agents one copyable setup prompt, keyless localhost auth, in-app sign-in/sign-up windows, hosted Google and email/password handoff, HttpOnly sessions, tenant/user/role management, API keys, audit logs, usage passbook records, billing-provider handoff, and exports.

Fastest path

  1. Open https://auth.seqn.in/.
  2. Sign in or create a workspace with the SEQN account that should own the dashboard.
  3. Select your stack icon.
  4. Click Copy setup prompt.
  5. Paste the prompt into your coding agent or IDE.
  6. Complete secure SEQN Auth onboarding; password entry stays inside the hosted SEQN Auth page, never in AI chat.
  7. Answer the CLI-style setup questions: Project name?, Local app URL?, and Framework detected?.
  8. Run locally with hosted auth and user management; claim production keys later from the console.

A SEQN account is required to copy and link the setup prompt. No API key, env var, Google OAuth credential, or custom auth screen is required before the first local run.

Start here:

  • Quickstart - copy the live setup prompt or use the tiny JS SDK directly.
  • Next.js App Router prompt - agent recipe with keyless dev mode.
  • React - provider, hooks, signed-in boundaries, and hosted links.
  • Next.js - server helpers, env wiring, and hosted redirects.
  • Express - middleware and route handlers for hosted auth.
  • Examples - runnable drop-in examples in examples/seqn-auth-*.
  • Hosted UI - landing page, sign-in, sign-up, account, org, and console pages.
  • API contract - planned public and backend endpoint shapes.
  • Operations - deploy-adjacent checks, key handling, and rollout notes.
  • Docs hosting - docs.seqn.in hosting, DNS, and Caddy setup.
  • Public MVP readiness - current live gates, launch smokes, and credential-bound blockers.

MVP scope

Included:

  • Public landing page at https://auth.seqn.in/ with framework icons and a signed-in Copy setup prompt path for AI-assisted setup across Next.js, React/Vite, Express, FastAPI, Django, Flask, Laravel, Rails, and generic REST API projects.
  • Hosted SDK tarball at https://auth.seqn.in/sdk/seqn-auth-js-0.1.0.tgz until public npm publishing is enabled.
  • Public MVP readiness tracking for CORS preflight, live migrations, docs persistence, authenticated smokes, SMTP, offsite backups, restore drills, and npm publishing.
  • Public application config lookup by publishable key.
  • Keyless development mode for first-run Next.js setup without accounts, keys, or env vars.
  • npx seqn-auth init first-run installer that asks only for project name, defaults localhost, and wires in-app sign-in/sign-up pages plus account controls.
  • Public signup that creates a tenant workspace for non-platform users and makes the signer the workspace admin.
  • Shared-development Google OAuth metadata without asking each developer for Google credentials up front.
  • Agent/IDE setup context at /v1/setup/agent-context with install/env/redirect/origin instructions.
  • Dependency-free ESM helpers for hosted URLs, Next.js, and Express, plus a React helper factory with an injected React runtime.
  • Backend application/key health lookup by secret key.
  • Signed webhooks with endpoint secrets and delivery logs.
  • SMTP-backed invitation email delivery with a durable outbox, automatic background processing, admin-visible sanitized delivery logs, and manual process/retry control when production SMTP credentials are configured.
  • Admin audit-log reader and built-in request rate limiting.
  • First-party admin APIs for users, sessions, roles, manual invite links, subscription plans, subscription state, and usage counters.
  • Identity OS APIs for tenants, tenant members, permission checks, hashed tenant API keys, append-only usage passbook events with idempotency, Stripe/Razorpay/Dodo handoff records, billing sync logs/retry state, webhook delivery filters/retry, and JSON/CSV export snapshots.
  • Authentik-owned account recovery handoff from /auth/recovery, plus email verification, MFA setup, and passkey setup handoff URLs in /v1/config when configured.
  • Subscription-state enforcement for project, user, webhook, and usage mutations.
  • Hosted /signin and /signup pages, with /sign-in and /sign-up kept as compatibility aliases.
  • Project/application records with redirect URL and origin allowlists.
  • Authentik as the identity engine.

Excluded for this MVP:

  • First-party password recovery, email verification, MFA, or passkey protocol engines, custom account-flow email templates, and deliverability workflows beyond invitation delivery. Authentik remains the owner of those flows.
  • Payment collection, invoices, and hosted checkout.
  • Full third-party auth API compatibility.

Endpoint targets

Public documentation target:

https://docs.seqn.in/

Production target:

https://auth.seqn.in/

SDK contract targets:

GET /v1/client/config
GET /v1/setup/agent-context
GET /v1/backend/application
GET /v1/me
GET /v1/tenants
POST /v1/usage/events
GET /v1/exports/:id/download

The service also exposes /healthz, /v1/config, hosted login/session routes, project management, tenant/user/session/role/invitation management, tenant API keys, usage passbook summaries, billing connector handoff, export snapshots/downloads, invitation email delivery logs/process controls, manual subscription management, webhook management, delivery logs/retry, and admin audit logs.