AuthKitOAuth 2.0 / OIDC, RFC by RFC.

A modular authorization server library for Go. Bring only the grants and extensions you need — no full identity platform required.

Get Started

Why AuthKit

View on GitHub

📦

RFC-scoped packages, not a monolith

rfc6749, rfc7636, rfc7662, and rfc9068 each implement one spec and import independently. Get PKCE validation without a full OP/RP object graph.

🧩

Config + Flow pattern

Every grant is built the same way — NewConfig() → set dependencies → Must(). Learn one flow, you've learned them all.

🔌

Extensions, not inheritance

PKCE and OIDC ID Token issuance are plain extension interfaces registered onto a base flow — not subclassed or forked implementations.

🗄️

You own storage

AuthKit defines the manager interfaces (ClientManager, AuthCodeManager, TokenManager...); implement them against whatever you already use. A reference SQL implementation ships in integrations/sql.

⚡

Fails fast, not at runtime

Must() validates required dependencies at construction time. A missing TokenManager is a startup error, not a 500 in production.

🛡️

Spec coverage that keeps growing

RFC 6749 grants, RFC 6750 bearer tokens, RFC 7636 PKCE, RFC 7662 introspection, RFC 9068 JWT access tokens, and OIDC ID tokens — with Device Authorization Grant and Token Revocation on the roadmap.

At a glance

srv := authkit.NewServer()
srv.RegisterGrant(authCodeFlow)
srv.RegisterEndpoint(introspectionFlow)

srv.CreateAuthorizationResponse(r, w, user)  // GET  /authorize
srv.CreateTokenResponse(r, w)                // POST /token

bash

go get github.com/alkeyio/authkit

Requires Go 1.23+. See the Getting Started guide to wire up your first Authorization Code + PKCE + OIDC flow.