authlet

package module

v1.0.1 Latest Latest Go to latest Published: May 14, 2026 License: GPL-3.0 Imports: 0 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/eliminyro/authlet

Links

Open Source Insights

README ¶

authlet

A small, embeddable OAuth 2.1 / OIDC Authorization Server library for Go.

Domain-agnostic. Pluggable upstream OIDC IdP. JWT access tokens, opaque rotating refresh tokens, RFC 7591 DCR, PKCE S256, RFC 8707 audience binding, RFC 9728 PRM helpers for MCP.

Features

Feature	Standard
AS metadata	RFC 8414
OIDC Discovery	OIDC Core
Protected Resource Metadata	RFC 9728
Dynamic Client Registration	RFC 7591
Authorization Code + PKCE S256	OAuth 2.1
Resource Indicators	RFC 8707
Refresh-token rotation with reuse detection	OAuth 2.1, RFC 6819 §5.2.2.3
Token revocation	RFC 7009

Packages

pkg/as — Authorization Server endpoints (mountable as http.Handler)
pkg/rs — Bearer middleware + JWKS client for resource servers
pkg/idp — Generic OIDC RP for upstream authentication
pkg/jwt — RS256 signing, JWKS publication, 30-day key rotation
pkg/crypto — AES-GCM helper for at-rest encryption of signing keys
pkg/storage — Storage interfaces + in-memory reference (pkg/storage/memstore)
pkg/mcp — Optional helpers for MCP (PRM handler, WWW-Authenticate)

Minimal embed

import (
    "github.com/eliminyro/authlet/pkg/as"
    "github.com/eliminyro/authlet/pkg/idp"
    "github.com/eliminyro/authlet/pkg/jwt"
    "github.com/eliminyro/authlet/pkg/storage/memstore"
)

store := memstore.New()
mgr := jwt.NewManager(store.SigningKeys(), masterKey)
_ = mgr.Bootstrap(ctx)

upstream, _ := idp.NewOIDC(ctx, googleIssuer, clientID, secret, redirect, []string{"openid", "email"})

server, _ := as.New(as.Config{
    Issuer: "https://api.example.com", PathPrefix: "/oauth",
    Upstream: upstream, UserResolver: yourResolver,
    Storage: store, KeyManager: mgr,
})

Full embed examples for chi and stdlib mux: see examples/.

Development

Run all tests: go test ./...
Run integration tests: go test -tags=integration ./...
Lint: golangci-lint run ./...
Build the standalone binary: go build ./cmd/authletd
Drive end-to-end with MCP Inspector: see docs/INSPECTOR.md

Status

v1.0.0 — first stable release. API stable within v1.x.

License

GPL 3.0. See LICENSE.

Documentation ¶

Overview ¶

Package authlet is a small, embeddable OAuth 2.1 / OIDC Authorization Server library for Go. Domain-agnostic with a pluggable upstream OIDC IdP.

The library is organized into sub-packages under pkg/. Apps embed pkg/as (the AS endpoints) and pkg/rs (the bearer middleware for protected resources). See https://github.com/eliminyro/authlet for details.

Source Files ¶

View all Source files

doc.go

Directories ¶

Path	Synopsis
cmd
authletd command authletd is a standalone authlet AS for development and integration testing.	authletd is a standalone authlet AS for development and integration testing.
examples
hilo-embed command Package main is a reference embedding of authlet in a chi-router application like Hilo.	Package main is a reference embedding of authlet in a chi-router application like Hilo.
memory-embed command Package main is a reference embedding of authlet in a stdlib http.ServeMux application like Memory MCP, with dual-auth (API key OR Bearer JWT) on /mcp.	Package main is a reference embedding of authlet in a stdlib http.ServeMux application like Memory MCP, with dual-auth (API key OR Bearer JWT) on /mcp.
pkg
as Package as implements an OAuth 2.1 / OIDC Authorization Server.	Package as implements an OAuth 2.1 / OIDC Authorization Server.
crypto Package crypto provides an AES-GCM helper for encrypting small at-rest payloads such as RSA private keys.	Package crypto provides an AES-GCM helper for encrypting small at-rest payloads such as RSA private keys.
idp Package idp is a thin generic OIDC RP — authlet's AS uses it to forward user authentication to an upstream issuer (Google, another authlet, etc).	Package idp is a thin generic OIDC RP — authlet's AS uses it to forward user authentication to an upstream issuer (Google, another authlet, etc).
jwt Package jwt provides RS256 signing, JWKS publication, and 30-day key rotation for authlet's authorization server.	Package jwt provides RS256 signing, JWKS publication, and 30-day key rotation for authlet's authorization server.
mcp Package mcp provides Model Context Protocol-flavored helpers on top of authlet's AS.	Package mcp provides Model Context Protocol-flavored helpers on top of authlet's AS.
rs Package rs provides bearer-token middleware for resource servers protected by an authlet AS.	Package rs provides bearer-token middleware for resource servers protected by an authlet AS.
storage
storage/memstore Package memstore is the in-memory reference implementation of pkg/storage.	Package memstore is the in-memory reference implementation of pkg/storage.

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL