Authentication for Go with every method as a plugin: password, social OAuth2, magic links, passkeys, TOTP and SMS second factors, API keys, SAML. Users, sessions, organizations, teams, RBAC and device tracking sit in the core; you compile in the methods you actually use. Ships with a dashboard.
Password, magic link, social OAuth, SSO, passkeys, MFA, phone, API keys and more. Each registers its own strategies, migrations and hooks.
Sign-in forms, MFA challenges, session management and org switchers, styled and ready. Headless primitives underneath for teams that want their own.
Every user, session and org is scoped to an App through context, so a cross-tenant query has nowhere to run.
Identity & tenancyUses Authsome for authentication and tenant scope, with the identity core shared across the product rather than reimplemented per service.
Identity & tenancyUses Authsome for authentication and tenant scope, with the identity core shared across the product rather than reimplemented per service.
Identity & tenancyUses Authsome for authentication and tenant scope, with the identity core shared across the product rather than reimplemented per service.
Shipping something on Authsome? The list is only as complete as the people who tell me. Ask to be on it, or just say what got in your way.
Get listed →Identity for a product that has organisations, teams and more than one way to sign in.
Password, magic link, social OAuth, SSO, passkeys, MFA, phone and API keys ship in the tree. A plugin registers its strategies, migrations and hooks on its own, so adding one is a single registration call.
OIDC claims, configurable expiry, refresh rotation, a cap on sessions per user, device binding and a JWKS endpoint. Opaque or signed is a configuration value.
Every user, session and org carries its App through context, and per-app configuration overrides the defaults. Cross-tenant queries are structurally impossible.
In-memory for tests, Postgres, SQLite or MongoDB for production. Every subsystem is a Go interface, so a backend nobody has written yet is still a supported option.
Multi-org support with a team hierarchy and an invitation system. A user belongs to several orgs and holds a different role in each.
Sign-in, MFA, org changes and session revokes each emit a typed event, with a Relay bridge for streaming them in real time.
Trusted devices are tracked per user and unknown ones are challenged, feeding the risk engine that watches for anomalies.
Pre-built sign-in forms, MFA challenges, session management and org switchers for React and Next.js, with headless primitives underneath and server-side session handling through middleware.
Users, organisations and sessions, independent of how you signed in.
Password, OAuth, passkeys and SSO as plugins over the same core.
Policy, lockout and audit as first-class concerns.
Organisation scope propagated with the session.
Authsome is a composable authentication and identity engine for Go. Core identity is built in; every authentication method is a plugin, so you compile in what you use.
Password with bcrypt or argon2 and a configurable policy covering length, complexity, history and expiration. Social OAuth2 across Google, GitHub and 30-plus providers. Magic links. Passkeys and WebAuthn for FIDO2 hardware and platform authenticators. TOTP and SMS second factors. Machine-to-machine API keys. Enterprise SSO over SAML.
The plugin split matters more than it sounds. An application that never needs SAML does not carry SAML code, SAML configuration or SAML attack surface. Adding it later is a dependency and a registration rather than a fork.
Account lockout with configurable thresholds, per-endpoint rate limiting, password history and expiration, and session binding to IP and device fingerprint. Every authentication action produces a security event, which is what makes an incident reconstructable afterwards.
Frank was the first attempt, as a standalone multi-tenant auth server. It worked, and it taught me that most teams do not want to operate another service for authentication. They want it inside the process they already run. Authsome is that lesson applied, with Guardian's plugin structure from 2021 underneath it.