Authentication and Authorization

42 projects

This category covers the pieces of identity and access in a Go service: token formats such as JWT, JOSE and PASETO, OAuth 2.0 and OpenID Connect clients and servers, HTTP session managers, and authorization engines that decide who may do what. Authentication libraries prove who a caller is; authorization libraries evaluate rules once you know. Most applications need one of each, and they are usually separate packages.

For tokens, golang-jwt/jwt continues the original jwt-go project and is the common choice for signing and parsing JWTs, while jwx implements the full JOSE family (JWA, JWE, JWK, JWS, JWT). golang.org/x/oauth2 handles OAuth flows, goth wraps many social login providers, and zitadel/oidc offers certified OpenID Connect client and server code. For cookie sessions, scs from Alex Edwards is small and works with plain net/http. Authorization ranges from Casbin, which evaluates ACL, RBAC and ABAC models from a policy file, to Zanzibar-style relationship systems such as SpiceDB, OpenFGA and Ory Keto, which run as separate services.

Choose by where trust is decided. If an identity provider issues tokens, you mostly need verification and JWKS handling, so jwx or an OIDC client fits. If you run logins yourself, pair a session manager with careful password hashing from golang.org/x/crypto. Start authorization with Casbin or plain code checks, and move to a Zanzibar-style service only when permissions depend on shared relationships across many objects.

casbinby hsluoyz

Authorization library that supports access control models like ACL, RBAC, and ABAC.

github.com/casbin/casbin/v3Go 1.13+ 3 dependenciesv3.11.0updated today

20.5k

jwt-goby golang-jwt

A full featured implementation of JSON Web Tokens (JWT). This library supports the parsing and verification as well as the generation and signing of JWTs.

github.com/golang-jwt/jwt/v5Go 1.21+ No dependencies v5.3.1updated 1d ago

9.3k

spicedbby authzed

A Zanzibar-inspired database that enables fine-grained authorization.

github.com/authzed/spicedbGo 1.26+ 114 dependenciesv1.57.0updated 1d ago

7.2k

gothby markbates

Provides a simple, clean, and idiomatic way to use OAuth and OAuth2. Handles multiple providers out of the box.

github.com/markbates/gothGo 1.24+ 11 dependenciesv1.82.0updated 8mo ago

6.6k

openfga

Implementation of fine-grained authorization based on the "Zanzibar: Google's Consistent, Global Authorization System" paper. Backed by CNCF.

github.com/openfga/openfgaGo 1.26+ 53 dependenciesv1.22.1updated today

6.1k

oauth2by golang

Successor of goauth2. Generic OAuth 2.0 package that comes with JWT, Google APIs, Compute Engine, and App Engine support.

golang.org/x/oauth2Go 1.26+ 1 dependencyupdated 1mo ago

5.9k

ketoby ory

Open Source (Go) implementation of "Zanzibar: Google's Consistent, Global Authorization System". Ships gRPC, REST APIs, newSQL, and an easy and granular permission language. Supports ACL, RBAC, and other access models.

github.com/ory/ketoGo 1.26+ 41 dependenciesv26.2.0updated 1mo ago

5.4k

authbossby volatiletech

Modular authentication system for the web. It tries to remove as much boilerplate and "hard things" as possible so that each time you start a new web project in Go, you can plug it in, configure it, and start building your app without having to build an authentication system each time.

github.com/aarondl/authboss/v3Go 1.24+ 4 dependenciesv3.5.3updated 3mo ago

4.2k

scsby alexedwards

Session Manager for HTTP servers.

github.com/alexedwards/scs/v2Go 1.12+ No dependencies v2.9.0updated 11mo ago

2.6k

jwxby lestrrat-go

Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies.

github.com/lestrrat-go/jwx/v4Go 1.26+ 3 dependenciesv4.6.0updated today

2.4k

gologinby dghubble

Chainable handlers for login with OAuth1 and OAuth2 authentication providers.

github.com/dghubble/gologin/v2Go 1.26+ 7 dependenciesv2.5.0updated 5d ago

2k

osinby openshift

Golang OAuth2 server library.

github.com/openshift/osinGo 1.15+ 6 dependenciesupdated 2mo ago

1.9k

loginsrvby tarent

JWT login microservice with pluggable backends such as OAuth2 (Github), htpasswd, osiam.

github.com/tarent/loginsrvGo 1.14+ 11 dependenciesv1.3.1updated 5y ago

1.9k

oidcby zitadel

Easy to use OpenID Connect client and server library written for Go and certified by the OpenID Foundation.

github.com/zitadel/oidc/v3Go 1.26+ 17 dependenciesv3.51.17updated today

1.9k

gorbacby mikespook

Provides a lightweight role-based access control (RBAC) implementation in Golang.

github.com/mikespook/gorbac/v4Go 1.24+ No dependencies 2.2.0updated 3mo ago

1.7k

pasetoby o1egl

Golang implementation of Platform-Agnostic Security Tokens (PASETO).

github.com/o1egl/paseto/v2Go 1.14+ 4 dependenciesv2.0.0updated 3y ago

940

jwtby cristalhq

Safe, simple, and fast JSON Web Tokens for Go.

github.com/cristalhq/jwt/v5Go 1.19+ No dependencies v5.4.0updated 1y ago

688

go-guardianby shaj13

Go-Guardian is a golang library that provides a simple, clean, and idiomatic way to create powerful modern API and web authentication that supports LDAP, Basic, Bearer token, and Certificate based authentication.

github.com/shaj13/go-guardian/v2Go 1.13+ 7 dependenciesv2.11.6updated 2y ago

613

go-jose

Fairly complete implementation of the JOSE working group's JSON Web Token, JSON Web Signatures, and JSON Web Encryption specs.

github.com/go-jose/go-jose/v4Go 1.24+ No dependencies v4.1.7updated today

545

jwtby pascaldekloe

Lightweight JSON Web Token (JWT) library.

github.com/pascaldekloe/jwtGo 1.18+ No dependencies v1.12.0updated 3y ago

360

jeffby abraithwaite

Simple, flexible, secure, and idiomatic web session management with pluggable backends.

github.com/abraithwaite/jeffGo 1.14+ 6 dependenciesupdated 1y ago

270

gosessionby Kwynto

This is quick session for net/http in GoLang. This package is perhaps the best implementation of the session mechanism, or at least it tries to become one.

github.com/Kwynto/gosessionGo 1.17+ No dependencies updated 2y ago

257

jwt-authby adam-hanna

JWT middleware for Golang http servers with many configuration options.

v1.2.0updated 5y ago

238

goiabadaby leodip

An open-source authentication and authorization server supporting OAuth2 and OpenID Connect.

v1.9.0updated today

204

otpgenby grijul

Library to generate TOTP/HOTP codes.

github.com/grijul/otpgenGo 1.16+ No dependencies updated 2y ago

146

sessionupby swithek

Simple, yet effective HTTP session management and identification package.

github.com/jellydator/sessionupGo 1.12+ 2 dependenciesv1.5.0updated 1y ago

131

sjwtby brianvoe

Simple jwt generator and parser.

github.com/brianvoe/sjwtGo 1.25+ No dependencies updated 11mo ago

123

sessionby icza

Go session management for web servers (including support for Google App Engine - GAE).

github.com/icza/sessionGo 1.23+ 1 dependencyv1.3.0updated 2y ago

119

melangeby pthm

Compiles OpenFGA authorization schemas into PL/pgSQL functions that run fine-grained relationship-based access control checks inside PostgreSQL.

github.com/pthm/melangeGo 1.27+ 14 dependenciesv0.10.1updated 5d ago

107

brancaby essentialkaos

Branca token specification implementation for Golang 1.15+.

github.com/essentialkaos/branca/v2Go 1.24+ 2 dependenciesv2.0.9updated today

100

securecookieby chmike

Efficient secure cookie encoding/decoding.

github.com/chmike/securecookieGo 1.13+ 1 dependencyv1.3.5updated 3y ago

87

sessionsby adam-hanna

Dead simple, highly performant, highly customizable sessions service for go http servers.

github.com/adam-hanna/sessionsGo 1.14+ 2 dependenciesv0.0.6updated 3y ago

80

otpgoby jltorresm

Time-Based One-Time Password (TOTP) and HMAC-Based One-Time Password (HOTP) library for Go.

github.com/jltorresm/otpgoGo 1.14+ 1 dependencyv0.3.0updated 5y ago

77

go-iamby melvinodsa

Developer-first Identity and Access Management system with a simple UI.

github.com/melvinodsa/go-iamGo 1.23+ 11 dependenciesv0.9.0updated 2mo ago

50

scopeby SonicRoshan

Easily Manage OAuth2 Scopes In Go.

github.com/SonicRoshan/scopeGo 1.16+ 1 dependencyupdated 5y ago

44

go-githubauthby jferrl

Utilities for GitHub authentication: generate and use GitHub application and installation tokens.

github.com/jferrl/go-githubauthGo 1.26+ 2 dependenciesv1.12.0updated today

35

cookiestxtby mengzhuo

Provides a parser of cookies.txt file format.

github.com/mengzhuo/cookiestxtGo 1.20+ No dependencies v1.0.6updated 9mo ago

23

go-jwtby pardnchiu

JWT authentication package providing access tokens and refresh tokens with fingerprinting, Redis storage, and automatic refresh capabilities.

github.com/pardnchiu/go-jwtGo 1.24+ No dependencies v1.0.3updated 3d ago

19

permissionsby xyproto

Library for keeping track of users, login states, and permissions. Uses secure cookies and bcrypt.

github.com/xyproto/permissionsGo 1.25+ 9 dependenciesupdated 2mo ago

14

x509proxyby vkuznet

Library to handle X509 proxy certificates.

github.com/vkuznet/x509proxyGo 1.16+ No dependencies v1.0.1updated 1y ago

9

go-jwtby deatil

A JWT (JSON Web Token) library for Go.

github.com/deatil/go-jwtGo 1.27+ 1 dependencyv1.0.30005updated 1mo ago

3

authgateby go-authgate

A lightweight OAuth 2.0 Authorization Server supporting Device Authorization Grant (RFC 8628), Authorization Code Flow with PKCE (RFC 6749 + RFC 7636), and Client Credentials Grant for machine-to-machine authentication.

github.com

About this site
Esc

Type to search every entry. ↑↓ to move, Enter to open.