README
¶
authaction-go-sdk
AuthAction JWT verification SDK for Go. Works with net/http, Gin, and any other Go HTTP framework.
Installation
go get github.com/authaction/authaction-go-sdk
Quick start
import "github.com/authaction/authaction-go-sdk"
verifier, err := authaction.New("myapp.eu.authaction.com", "https://api.myapp.com")
if err != nil { log.Fatal(err) }
// Verify a raw token
token, err := verifier.VerifyToken(tokenStr)
// Verify from a request header (nil, nil on missing)
token, err := verifier.VerifyRequest(r)
fmt.Println(token.Subject())
net/http middleware
mux := http.NewServeMux()
mux.Handle("/api/", verifier.Middleware()(apiHandler))
http.ListenAndServe(":8080", mux)
// In handlers — read the token from context
token, _ := authaction.TokenFromContext(r.Context())
fmt.Println(token.Subject())
Gin
r := gin.Default()
r.Use(verifier.GinMiddleware())
r.GET("/protected", func(c *gin.Context) {
tok, _ := authaction.TokenFromGin(c)
c.JSON(200, gin.H{"sub": tok.(jwt.Token).Subject()})
})
Error types
switch err.(type) {
case *authaction.TokenExpiredError: // exp in the past
case *authaction.TokenInvalidError: // bad signature / issuer / audience
}
Environment variables
AUTHACTION_DOMAIN=your-tenant.eu.authaction.com
AUTHACTION_AUDIENCE=https://api.your-app.com
License
MIT
Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
ErrJWKSUnavailable is returned when the JWKS endpoint cannot be reached and no cached keys are available.
var ErrTokenExpired = errors.New("authaction: token expired")
ErrTokenExpired is returned when the JWT exp claim is in the past.
var ErrTokenInvalid = errors.New("authaction: token invalid")
ErrTokenInvalid is returned when the JWT signature, issuer, audience, or structure is invalid.
var ErrTokenMissing = errors.New("authaction: token missing")
ErrTokenMissing is returned when no Bearer token is present in the request.
Functions ¶
func WithClaims ¶
func WithClaims(ctx context.Context, claims *TokenPayload) context.Context
WithClaims returns a copy of ctx carrying the verified token payload. Called by the middleware after successful token verification.
Types ¶
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client verifies AuthAction JWT access tokens using JWKS.
func New ¶
New creates a Client from the provided Config. Returns an error when Domain or Audience is empty.
func (*Client) VerifyRequest ¶
VerifyRequest extracts the Bearer token from r's Authorization header and verifies it. Returns ErrTokenMissing when the header is absent or malformed.
func (*Client) VerifyToken ¶
VerifyToken parses and validates a raw JWT string.
Checks: RS256 algorithm, issuer, audience, and expiry. Returns ErrTokenExpired, ErrTokenInvalid, or ErrJWKSUnavailable on failure.
type Config ¶
type Config struct {
// Domain is the AuthAction tenant domain, e.g. "acme.eu.authaction.com".
Domain string
// Audience is the API identifier (audience claim) registered in AuthAction.
Audience string
// JWKSCacheTTL controls how long signing keys are cached. Default: 1 hour.
JWKSCacheTTL time.Duration
// HTTPClient is used to fetch the JWKS endpoint.
// Defaults to a client with a 10-second timeout.
HTTPClient *http.Client
}
Config holds the settings for the AuthAction JWT verifier.
type TokenPayload ¶
type TokenPayload struct {
// Sub is the subject — the user or M2M client identifier.
Sub string
// Iss is the token issuer.
Iss string
// Aud contains the audience values (may be one or many).
Aud []string
// Exp is the expiry time (Unix seconds).
Exp int64
// Iat is the issued-at time (Unix seconds).
Iat int64
// Scope is the space-separated list of granted OAuth2 scopes.
Scope string
// Extra holds any additional claims not covered by the standard fields above.
Extra map[string]interface{}
}
TokenPayload holds the verified claims from an AuthAction JWT access token.
func ClaimsFromContext ¶
func ClaimsFromContext(ctx context.Context) (*TokenPayload, bool)
ClaimsFromContext retrieves the verified token payload attached by middleware. Returns (nil, false) when no claims are present in ctx.
func (*TokenPayload) HasScope ¶
func (p *TokenPayload) HasScope(scope string) bool
HasScope reports whether the token payload includes the given scope.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package authactionecho provides Echo middleware for AuthAction JWT verification.
|
Package authactionecho provides Echo middleware for AuthAction JWT verification. |
|
Package authactiongin provides Gin middleware for AuthAction JWT verification.
|
Package authactiongin provides Gin middleware for AuthAction JWT verification. |