// the find
go-pkgz/auth
Authenticator via oauth2, direct, email and telegram
A Go library that handles social login (GitHub, Google, Facebook, a dozen others), email verification, Telegram, and custom credential checkers, all wired up as HTTP middleware with JWT-in-cookie auth. It's built on top of the standard library's HTTP stack, so it plugs into chi, stdlib mux, or anything else without friction. Aimed at Go developers building multi-tenant web apps who want social auth without pulling in a full identity platform.
The dev provider is genuinely useful — a fake OAuth2 server you can spin up locally to avoid real provider credentials during development, something most auth libraries skip entirely. The avatar proxy is a smart inclusion: it fetches and locally caches provider avatars on login, preventing rate-limit hits when you embed avatars on public pages. The ClaimsUpdater/Validator split is a good design — expensive logic (set the 'blocked' flag) runs once at token creation, cheap logic (check the flag) runs per-request. The confirmation token replay protection via SHA-256 keying with a pluggable backend store is honest about the multi-instance problem and gives you a clean interface to fix it rather than silently ignoring it.
The v1/v2 split lives in the same repo as a subdirectory (`/v2/`), which means the directory tree is nearly doubled and the module boundaries require care — easy to import the wrong one, and the README mixes v1 and v2 examples without always being clear which is which. The CustomServer bind address problem is documented but unresolved: `URL` does double duty as both the advertised OAuth endpoint and the bind address, so containerized deployments require a reverse proxy workaround that the library acknowledges but doesn't fix. Email-as-identity caveats are documented thoroughly, but the library still doesn't offer any first-class hook for mapping verified addresses to stable internal IDs — that's left entirely to the caller, which means most integrators will get it wrong. GridFS (MongoDB) as an avatar store feels like legacy surface area that adds a dependency most people will never use.