Self-hosted auth,
done right.
A self-hosted authentication and session library for Go
email/password, OAuth, organizations, with CSRF protection and rate limiting.
Configure it with plain Go, mount the routes, and you have a real auth system in an afternoon.
// The three required options — everything else has a default.cfg, err := goauth.NewConfig( goauth.WithApp(goauth.AppConfig{ Name: "MyApp", BaseURL: "https://myapp.com", Database: goauth.DatabaseConfig{ URL: os.Getenv("DATABASE_URL"), Driver: goauth.DriverPostgres, }, Environment: goauth.EnvironmentProd, }), // 32+ bytes. Every other key the library needs is derived // from this one — source it from the environment. goauth.WithSecret(os.Getenv("AUTH_SECRET")), goauth.WithSecurity(goauth.SecurityConfig{ AllowedOrigins: []string{"https://myapp.com"}, }),)if err != nil { log.Fatal(err)}auth, err := goauth.New(cfg)Multi-tenant Organizations
Owner/admin/member roles, invites, and a per-session active org — one config flag to enable.
Admin API
Mounted endpoints to list, ban, role-change, and session-revoke any user, with a full audit trail behind them. Bring your own UI.
Two-Token Sessions
Session + refresh token rotation with idle timeout, grace window, and CSRF protection.
OAuth2 Ready
Built-in GitHub and Google providers behind a pluggable port.OAuthProvider interface.
Security by Default
Origin checking, a double-submit CSRF token, and per-route rate limiting — all on by default, off only if you say so.
Audit Logging
Opt in with one flag for an async, non-blocking event pipeline with pluggable sinks — Kafka, NATS, a webhook, or your own.
Bring Your Own Mailer
Swap SMTP for Resend, Postmark, or SES behind one interface; replace the email templates just as easily.
Multi-Driver Storage
PostgreSQL, MySQL, or SQLite — the library manages the connection, or borrows one you already opened.