Authentication for Go with every method as a plugin: password, social OAuth2, magic links, passkeys, TOTP and SMS second factors, API keys, SAML. Users, sessions, organizations, teams, RBAC and device tracking sit in the core; you compile in the methods you actually use. Ships with a dashboard.
Go★ 7↗Auth serverAn auth server in Rust covering OAuth, sessions, email templates and the usual set. A learning project that later shaped how Authsome splits authentication methods into plugins instead of configuration flags.
Rust★ 5↗Auth serverA standalone multi-tenant auth server with a three-tier user model: platform staff, the customer organizations they serve, and those organizations’ own end users. Written before Authsome, and largely the reason Authsome exists as a library instead of a service.
TypeScript★ 5↗Content safetyContent safety arranged in layers that can short-circuit, roughly the way people react to danger. Instincts catch injection and exfiltration in under 10ms. Awareness spots PII, topic and intent. Boundaries are hard deny lists. Values apply toxicity and brand rules, and judgment scores grounding and compliance last, because it is the expensive one.
Go★ 2↗Secrets & flagsSecrets, feature flags and runtime config in one library. AES-256-GCM at rest with a new version archived on every write, flags with tenant, user, percentage-rollout and schedule targeting, and config entries that fire Watch callbacks when they change. Rotation runs in the background with a per-key callback.
Go★ 1↗AuthorizationRBAC, ABAC and Zanzibar-style relation tuples behind one Check call. Precedence is fixed and stated up front, explicit deny beating allow beating default deny, so you can layer a role model, attribute conditions and a relationship graph without guessing which one wins.
Go★ 1↗Audit trailAn append-only audit log where every event carries the hash of the one before it, so an edit or a deletion breaks the chain and shows up in verification. Per-subject encryption means a GDPR erasure request destroys a key rather than a row, and the chain still verifies afterwards. Exports SOC 2, HIPAA and EU AI Act reports.
Go★ 0↗API keysAPI key lifecycle: create, validate, rotate with a grace window, revoke, suspend, and record per-request usage for analytics. The raw key is returned once at creation and never stored, since only its SHA-256 hash is kept, so a leaked database dump does not hand over live credentials.
Go★ 0↗