InfluxDB 3 OSS is now GA. Transform, enrich, and act on time series data directly in the database. Automate critical tasks and eliminate the need to move data externally. Download now. Learn more →
Top 23 Go Authentication and OAuth Projects
-
casbin
An authorization library that supports access control models like ACL, RBAC, ABAC in Golang: https://discord.gg/S5UjpzGZjN
Project mention: Secure Your Business Systems: 6 Developer Tools with RBAC Support | dev.to | 2025-07-23Website: https://casbin.org/
-
Sevalla
Deploy and host your apps and databases, now with $50 credit! Sevalla is the PaaS you have been looking for! Advanced deployment pipelines, usage-based pricing, preview apps, templates, human support by developers, and much more!
-
goth
Package goth provides a simple, clean, and idiomatic way to write authentication packages for Go web applications.
Project mention: Show HN: Clace – Application Server with support for scaling down to zero | news.ycombinator.com | 2024-09-11Thanks, need to make the docs less verbose in some places :-)
https://clace.io/docs/configuration/authentication/ lists the supported auth mechanisms for apps. A builtin system account is the default. The OAuth providers supported are : github google digitalocean bitbucket amazon azuread microsoftonline gitlab auth0 okta oidc. Any other provider supported by https://github.com/markbates/goth can be easily added, with a small code change.
For admin operations (creating/updating apps) using the client CLI, a unix domain socket is used. File system permissions are used, no other auth is used for UDS. A REST API for admin operations can be optionally enabled, in which case it will use the system account https://clace.io/docs/configuration/security/#admin-api-acce....
Client cert based auth is not supported currently. Were you wanting that for app access or for admin API access?
In terms of performance, I did some testing few months back. The app access API does not hit the database (sqlite), everything is cached after the first call. So the performance will be limited by the API performance of the downstream container. The Clace server itself should not be a bottleneck. First API call to a containerized app builds the image and starts the container. That depends on how fast the image build and container startup are.
-
-
Ory Keto
The most scalable and customizable permission server on the market. Fix your slow or broken permission system with Google's proven "Zanzibar" approach. Supports ACL, RBAC, and more. Written in Go, cloud native, headless, API-first. Available as a service on Ory Network and for self-hosters.
-
-
scs - HTTP Session Management for Go.
-
-
InfluxDB
InfluxDB – Built for High-Performance Time Series Workloads. InfluxDB 3 OSS is now GA. Transform, enrich, and act on time series data directly in the database. Automate critical tasks and eliminate the need to move data externally. Download now.
-
jwx
Complete implementation of JWx (Javascript Object Signing and Encryption/JOSE) technologies for Go. #golang #jwt #jws #jwk #jwe
-
-
loginsrv
JWT login microservice with plugable backends such as OAuth2, Google, Github, htpasswd, osiam, ..
-
-
oidc
Easy to use OpenID Connect client and server library written for Go and certified by the OpenID Foundation
-
-
-
-
go-guardian
Go-Guardian is a golang library that provides a simple, clean, and idiomatic way to create powerful modern API and web authentication.
-
-
jwt-auth
This package provides json web token (jwt) middleware for goLang http servers (by adam-hanna)
-
-
-
-
-
-
SaaSHub
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
NOTE:
The open source projects on this list are ordered by number of github stars.
The number of mentions indicates repo mentiontions in the last 12 Months or
since we started tracking (Dec 2020).
Go Authentication and OAuth discussion
Go Authentication and OAuth related posts
-
Casbin: An authorization library that supports authz models like ACL, RBAC, ABAC
-
Show HN: Clace – Application Server with support for scaling down to zero
-
Should I Use jwts For Authentication Tokens?
-
Show HN: Blueprint for a distributed multi-region IAM with Go and CockroachDB
-
Show HN: Open-source IAM Ory Kratos v1.0 with Passkeys, MFA and multi-region
-
how to design database for Access Control Privileges ?
-
Understanding Google Zanzibar and Why Shines at Building Permissions
-
A note from our sponsor - InfluxDB
www.influxdata.com | 1 Sep 2025
Index
What are some of the best open-source Authentication and OAuth projects in Go? This list will help you:
| # | Project | Stars |
|---|---|---|
| 1 | casbin | 19,068 |
| 2 | goth | 6,184 |
| 3 | oauth2 | 5,685 |
| 4 | Ory Keto | 5,101 |
| 5 | authboss | 4,041 |
| 6 | scs | 2,397 |
| 7 | go-oidc | 2,211 |
| 8 | jwx | 2,192 |
| 9 | go-oauth2-server | 2,129 |
| 10 | loginsrv | 1,928 |
| 11 | gologin | 1,919 |
| 12 | oidc | 1,646 |
| 13 | gorbac | 1,635 |
| 14 | auth | 1,255 |
| 15 | paseto | 908 |
| 16 | go-guardian | 587 |
| 17 | jeff | 270 |
| 18 | jwt-auth | 234 |
| 19 | httpauth | 221 |
| 20 | branca | 173 |
| 21 | otpgen | 140 |
| 22 | sessionup | 129 |
| 23 | RBAC | 126 |
Sponsored
Deploy and host your apps and databases, now with $50 credit!
Sevalla is the PaaS you have been looking for! Advanced deployment pipelines, usage-based pricing, preview apps, templates, human support by developers, and much more!
sevalla.com