Repository navigation
chore: relicense the Seamless Auth ecosystem to Apache-2.0 #335
Description
Part of #334.
Decision
Relicense the whole ecosystem from AGPL-3.0-only to Apache-2.0: the API, the SDKs, types, CLI, templates, messaging, admin dashboard and docs.
The SDKs are the main reason. @seamless-auth/react, client, core, express, fastify and types are all AGPL-3.0-only today and get bundled or linked into the adopter's own application, which most company and government legal reviews will block. Apache-2.0 over MIT for the explicit patent grant, which those same reviewers look for.
Before changing any file
External contributors hold copyright in their contributions and have to agree to the change (or those contributions are rewritten). From git log:
| Repo | Contributors other than the maintainer |
|---|---|
| seamless-auth-react | Peter (12 commits), nightcityblade (1), kcorbettsr (1) |
| seamless-cli | Bharat Bhojwani (1) |
| seamless-auth-docs | Peter (11 commits) |
- Written consent from each, recorded on this issue or linked from it
- Re-check every repo's history for new contributors right before switching
Per repo
For each of seamless-auth-api, seamless-auth-server, seamless-auth-react, seamless-auth-types, seamless-cli, seamless-templates, seamless-auth-messaging, seamless-auth-admin-dashboard, seamless-auth-docs:
- Replace
LICENSE/LICENSE.mdwith the Apache-2.0 text (and remove duplicates; several repos have both) -
licensefield in everypackage.json, including workspace packages (some are missing it entirely) - Update the license header rule in eslint config and rewrite the header in every source file
- README license section
- Changeset (minor, describing the change) for each published package
Known leftovers to clean up on the way: seamless-auth-react/LICENSE.md still has template boilerplate, and seamless-auth-server/packages/fastify/LICENSE.md calls itself the Express package.
Outside the repos
- Website license page and pricing: remove the commercial license tier and the AGPL wording. In fells-code/seamless-website#21
- Docs: any page that mentions AGPL
- Update the licensing milestone in Epic: v1.0 stable platform #66. Noted on Epic: v1.0 stable platform #66
Activity
Bccorb commentedon Oct 6, 2026
Written consent to relicense under Apache-2.0 has been obtained from every external contributor listed above (seamless-auth-react: Peter, nightcityblade, kcorbettsr; seamless-cli: Bharat Bhojwani; seamless-auth-docs: Peter). Still to do right before switching: re-check each repo's history for contributors added since.
Bccorb commentedon Oct 6, 2026
Relicense PRs are open for every repo. Before starting, I re-checked each repo's history for new outside contributors and found none beyond the ones listed above, whose consent is recorded here.
Every repo now has the canonical Apache-2.0
LICENSE, with SHA-256cfc7749b…3d30, the hash of the apache.org text. The AGPLLICENSE.mdsummaries are removed, including the template boilerplate and the Fastify one mislabelled as Express. Several of the oldLICENSEfiles were truncated 79-line copies of the AGPL. Thelicensefields, the license headers (and the eslint header templates where they exist), and the README badges and sections are updated. Each published package gets a minor changeset, except messaging, which releases by version bump.Docs: no page mentions the AGPL. #66's licensing milestone now notes this decision and ticks when these merge.
Each published package's own lockfile entry is updated in its PR. Lockfile entries that point at a published
@seamless-auth/*dependency keepAGPL-3.0-onlyuntil that package is released under Apache-2.0 and the dependency is bumped. So releasing types, messaging, server and react first and then bumping the API, templates and dashboard clears them.chore: relicense from AGPL-3.0-only to Apache-2.0 (#85)
chore: relicense from AGPL-3.0-only to Apache-2.0 (#174)
chore: relicense from AGPL-3.0-only to Apache-2.0 (#158)
chore: relicense from AGPL-3.0-only to Apache-2.0 (#349)