Introducing GoAuth

GoAuth is a modular authentication library for Go. Compose password authentication, passkeys, OAuth, magic links, TOTP, and organizations around a shared credential-completion pipeline.

This article has been updated for the current repository API. Its original publication URL is preserved; published Go module versions may lag behind the checkout described here.

What GoAuth Provides

Core is registered automatically and handles signup, profile updates, password flows, and verification. Choose one credential strategy: Session for stored sessions and device management, or Stateless for JWT access credentials and stored refresh nonces. Stateless is the default. Both strategies check current user state on protected requests.

Optional modules include Passkeys, Two-Factor, OAuth, Magic Link, Notification, Admin, Audit, Organization, Invitation, Captcha, and CSRF. Audit's admin routes need Admin; Invitation explicitly depends on Admin. Invalid dependencies and route collisions fail initialization.

A lifecycle you control

a, err := auth.New(cfg)
if err != nil {
    return err
}
defer a.Close()
if err := a.Use(twofactor.New(nil)); err != nil {
    return err
}
if err := a.Initialize(ctx); err != nil {
    return err
}

This fragment belongs inside a function returning error. The Quick Start provides the complete server, including storage, environment variables, and HTTP shutdown.

Security and authentication

The built-in manager supports HS256, RS256, and ES256 signing, retained verification keys, and public JWKS for asymmetric keys. Passwords use bcrypt and a default 8–72-byte policy. Enable account lockout explicitly; its numeric defaults alone do not enable it.

OAuth, magic links, passkeys, and invitations all apply the same eligibility and challenge rules. A response can require 2FA before credentials are issued. Refresh preserves the original authentication time, methods, and selected organization.

Frameworks, events, and storage

The standard HTTP adapter is included in the root module. Gin, Chi, and Fiber adapters have separate Go modules. GORM storage supports PostgreSQL, MySQL, and SQLite, including atomic refresh operations and transaction-bound feature stores.

Before hooks can reject operations synchronously. After hooks normally run in the in-memory worker pool. Durable operation support uses an outbox and acknowledged, at-least-once delivery. Custom handlers should deduplicate event IDs.

Getting started

Follow Installation, then Quick Start. Existing integrations should read Upgrading, especially if they implement custom storage or use older constructors. Development lives on GitHub.