Self hosted auth for GO
A complete self-hosted authentication library for Go
email/password, OAuth, organizations, with CSRF protection and rate limiting.
Configure it with plain Go, mount the routes, and you have a real auth system in an afternoon.
Start with the complete browser example. Apply auth migrations before starting the app; New checks database readiness and never runs migrations. Production examples need a configured mailer for email features, and the Before you ship guide covers backend and browser hardening before launch.
// Required app, secret, origin, and production mailer configuration.cfg, err := goauth.NewConfig( goauth.WithApp(goauth.AppConfig{ Name: "MyApp", BaseURL: "https://myapp.com", Database: goauth.DatabaseConfig{ URL: os.Getenv("DATABASE_URL"), Driver: goauth.DriverPostgres, }, Environment: goauth.EnvironmentProd, }), // Keep a persistent secret of at least 32 random bytes. // CSRF, OAuth, and email-code keys are derived from it. goauth.WithSecret(os.Getenv("AUTH_SECRET")), goauth.WithBrowser(goauth.BrowserConfig{ APIURL: "https://api.myapp.com", AllowedOrigins: []string{"https://myapp.com"}, }), goauth.WithMailer(myMailer), // your configured port.Mailer)if err != nil { log.Fatal(err)}auth, err := goauth.New(cfg)if err != nil { log.Fatal(err)}// Call auth.Close after your HTTP server shuts down.// Signup stays closed until WithRegistration explicitly opens it.Multi-tenant Organizations
Owner/admin/member roles, invites, and a per-session active org — one config flag to enable.
Admin API
Mounted endpoints to list, ban, role-change, and session-revoke any user, with a full audit trail behind them. Bring your own UI.
Two-Token Sessions
Independent app/admin logins with session and refresh-token rotation, idle timeout, and a grace window.
OAuth2 Ready
Built-in GitHub and Google providers behind a pluggable port.OAuthProvider interface.
Security by Default
Mandatory origin checking and signed double-submit CSRF, plus per-route rate limiting enabled by default.
Audit Logging
Opt in to database-backed audit records and an outbox, with background delivery to pluggable sinks.
Bring Your Own Mailer
Swap SMTP for Resend, Postmark, or SES behind one interface; replace the email templates just as easily.
Optional Redis Cache
Encrypted session and token snapshots with SQL always authoritative, plus shared rate-limit and 2FA counters across every replica.
Multi-Driver Storage
PostgreSQL, MySQL, or SQLite — the library manages the connection, or borrows one you already opened.