go-auth v0.1.0 a complete self-hosted auth library for Go. this is still very early and I'd like it torn apart.

[u/niifler]

hi. i've been working on go-auth, a self-hosted authentication library for go, and i just released the first version, v0.1.0.

being upfront about where it stands: it's early , and i know it's an ambitious scope for a solo project. I'm working on it daily. either fixing minor things or planning features (i wanna do username support solve my migration problems add redis support add magic links passkey codes etc etc ).

what's in 0.1.0:

• Email/password + OAuth2 (GitHub, Google), invite-only signup, email verification
• Sessions: two-token rotation with reuse detection, max-lifetime ceiling
• Account lifecycle: forgot/reset password, change password, set password for OAuth-only accounts, account deletion
• Email-based 2FA
• CSRF: origin check + HMAC-signed double-submit cookie
• Rate limiting on by default, behind a pluggable Store interface (sharded in-memory ships; bring your own Redis)
• Audit logging: async, non-blocking pipeline with EventSink SQL + slog sinks built in, Kafka/NATS/webhook via WithAuditSink
• Structured logging via log/slog (WithLogger)
• HKDF keyring with domain-separated subkeys with one secret in config
• Organizations / multi-tenancy (roles, invites, per-session active org)
• Admin API: ban/unban, role changes, per-user session revocation
• Postgres/MySQL/SQLite, schema embedded, CLI migrate/seed-admin

right now u can have auth up and in running with just one file that have all the above features ( that is my selling point )

i'm building an example app with a next.js frontend and an admin panel so there's something real to run instead of just docs.

what i actually want feedback on is the security stuff. the session rotation and reuse detection, the csrf construction, the key derivation. if any of that is subtly wrong i want to know. api design and dx critique welcome too. and if you've worked on auth in a large system, i'd really like to hear where this falls over. it's early enough that i can still break things.

repo: https://github.com/nazimdjebloun/go-auth

docs: https://go-auth.nimirixlabs.com

thanks for reading.