Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
- API
  
  Reference documentation for the pkg.go.dev API
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

auth

package

Go to main page

Versions in this module

v0

v0.0.13

Nov 3, 2026

v0.0.12

Nov 3, 2026

Changes in this version

+ const FieldReasonATHMismatch

+ const FieldReasonExpired

+ const FieldReasonHTMMismatch

+ const FieldReasonHTUMismatch

+ const FieldReasonInvalidProof

+ const FieldReasonInvalidToken

+ const FieldReasonJKTMismatch

+ const FieldReasonMalformed

+ const FieldReasonMissingProof

+ const FieldReasonPCR

+ const FieldReasonStaleProof

+ const FieldReasonWrongAud

+ const FieldReasonWrongTokenUse

+ const FieldReasonWrongTyp

+ func FieldMiddleware(v *FieldTokenVerifier) func(http.Handler) http.Handler

type AccessTokenClaims

+ TokenUse string

+ type FieldError struct

+ Detail string

+ Reason string

+ func (e *FieldError) Error() string

+ func (e *FieldError) Is(target error) bool

+ type FieldPrincipal struct

+ AMR []string

+ AppCode string

+ AuthTime time.Time

+ ClientID string

+ ClientIdentifier string

+ DeviceID string

+ DeviceMode string

+ ExpiresAt time.Time

+ JKT string

+ Name string

+ SessionID string

+ TokenID string

+ WorkerCode string

+ WorkerID string

+ func FieldPrincipalFrom(ctx context.Context) (*FieldPrincipal, bool)

+ type FieldTokenVerifier struct

+ func NewFieldTokenVerifier(cfg FieldTokenVerifierConfig) *FieldTokenVerifier

+ func (v *FieldTokenVerifier) Verify(ctx context.Context, ...) (*FieldPrincipal, error)

+ type FieldTokenVerifierConfig struct

+ AppCode string

+ BaseURL string

+ ClockSkew time.Duration

+ HTTPClient *http.Client

+ Issuer string

+ JWKSRefreshInterval time.Duration

+ JWKSURL string

+ Now func() time.Time

+ ProofMaxAge time.Duration

v0.0.11

Nov 1, 2026

v0.0.10

Oct 30, 2026

v0.0.9

Oct 30, 2026

Changes in this version

+ var ErrConfig = &Error

+ var ErrCrypto = &Error

+ var ErrDiscovery = &Error

+ var ErrInvalidToken = &Error

+ var ErrTokenExchange = &Error

+ var ErrTokenExpired = &Error

+ type AccessTokenClaims struct

+ Applications []string

+ Aud Audience

+ Clients []string

+ Email string

+ Exp int64

+ Iat int64

+ Iss string

+ Jti string

+ Name string

+ Nbf int64

+ PrincipalType string

+ Roles []string

+ Scope string

+ Sub string

+ func (c *AccessTokenClaims) HasClientAccess(clientID string) bool

+ func (c *AccessTokenClaims) HasRole(role string) bool

+ func (c *AccessTokenClaims) IsAnchor() bool

+ func (c *AccessTokenClaims) IsService() bool

+ func (c *AccessTokenClaims) PrincipalID() string

+ type Audience string

+ func (a *Audience) UnmarshalJSON(b []byte) error

+ func (a Audience) String() string

+ type AuthContext struct

+ Claims AccessTokenClaims

+ Token string

+ func NewAuthContext(claims AccessTokenClaims, token string) *AuthContext

+ func (a *AuthContext) BearerToken() string

+ func (a *AuthContext) ClientIDs() []string

+ func (a *AuthContext) Email() string

+ func (a *AuthContext) HasClientAccess(clientID string) bool

+ func (a *AuthContext) HasRole(role string) bool

+ func (a *AuthContext) IsAnchor() bool

+ func (a *AuthContext) IsService() bool

+ func (a *AuthContext) Name() string

+ func (a *AuthContext) PrincipalID() string

+ func (a *AuthContext) Roles() []string

+ type AuthorizeParams struct

+ Nonce string

+ PKCE PkceChallenge

+ State string

+ type ClientCredentialsConfig struct

+ Audience string

+ ClientID string

+ ClientSecret string

+ HTTPClient *http.Client

+ IssuerURL string

+ SafetyWindow time.Duration

+ Scopes []string

+ type ClientCredentialsProvider struct

+ func NewClientCredentialsProvider(cfg ClientCredentialsConfig) *ClientCredentialsProvider

+ func (p *ClientCredentialsProvider) Invalidate()

+ func (p *ClientCredentialsProvider) Token(ctx context.Context) (string, error)

+ type Error struct

+ Kind ErrorKind

+ Message string

+ func (e *Error) Error() string

+ func (e *Error) Is(target error) bool

+ type ErrorKind int

+ const KindConfig

+ const KindCrypto

+ const KindDiscovery

+ const KindInvalidToken

+ const KindTokenExchange

+ const KindTokenExpired

+ type HmacTokenValidator struct

+ func NewHmacTokenValidator(secret, issuer, audience string) *HmacTokenValidator

+ func (v *HmacTokenValidator) Validate(token string) (*AuthContext, error)

+ func (v *HmacTokenValidator) ValidateBearer(authHeader string) (*AuthContext, error)

+ type IntrospectionResponse struct

+ Active bool

+ ClientID string

+ Exp int64

+ Iat int64

+ Scope string

+ Sub string

+ TokenType string

+ Username string

+ type JwksCache struct

+ func NewJwksCache(httpClient *http.Client, refreshInterval time.Duration) *JwksCache

+ func (c *JwksCache) Get(ctx context.Context, url string) (jwk.Set, error)

+ func (c *JwksCache) Refresh(ctx context.Context, url string) error

+ func (c *JwksCache) Register(url string) error

+ type OAuthClient struct

+ func NewOAuthClient(cfg OAuthConfig) *OAuthClient

+ func (c *OAuthClient) AuthorizeURL() (string, AuthorizeParams)

+ func (c *OAuthClient) ExchangeCode(ctx context.Context, code, codeVerifier string) (*TokenResponse, error)

+ func (c *OAuthClient) IntrospectToken(ctx context.Context, token string) (*IntrospectionResponse, error)

+ func (c *OAuthClient) LogoutURL(postLogoutRedirectURI, idTokenHint, state string) string

+ func (c *OAuthClient) RefreshToken(ctx context.Context, refreshToken string) (*TokenResponse, error)

+ func (c *OAuthClient) RevokeToken(ctx context.Context, token string) error

+ func (c *OAuthClient) UserInfo(ctx context.Context, accessToken string) (*UserInfoResponse, error)

+ type OAuthConfig struct

+ ClientID string

+ ClientSecret string

+ HTTPClient *http.Client

+ IssuerURL string

+ RedirectURI string

+ Scopes []string

+ type PkceChallenge struct

+ CodeChallenge string

+ CodeChallengeMethod string

+ CodeVerifier string

+ func NewPkceChallenge() PkceChallenge

+ type TokenResponse struct

+ AccessToken string

+ ExpiresIn int64

+ IDToken string

+ RefreshToken string

+ Scope string

+ TokenType string

+ type TokenValidator struct

+ func NewTokenValidator(cfg TokenValidatorConfig) *TokenValidator

+ func (v *TokenValidator) RefreshJWKS(ctx context.Context) error

+ func (v *TokenValidator) Validate(ctx context.Context, token string) (*AuthContext, error)

+ func (v *TokenValidator) ValidateBearer(ctx context.Context, authHeader string) (*AuthContext, error)

+ type TokenValidatorConfig struct

+ Audience string

+ ClockSkew time.Duration

+ HTTPClient *http.Client

+ IssuerURL string

+ JWKSRefreshInterval time.Duration

+ type UserInfoResponse struct

+ Email string

+ EmailVerified *bool

+ Extra map[string]any

+ Name string

+ Sub string

+ func (u *UserInfoResponse) UnmarshalJSON(b []byte) error