Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
- API
  
  Reference documentation for the pkg.go.dev API
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

authhttp

package

Go to main page

Versions in this module

v0

v0.80.0

Jul 4, 2026

Changes in this version

type Option

+ func WithEngine(opts ...embedded.Option) Option

type Service

+ func New(cfg embedded.Config, pg *pgxpool.Pool, opts ...Option) (*Service, *embedded.Client, error)

v0.79.0

Jul 4, 2026

Changes in this version

type Option

+ func WithRateLimitOverrides(overrides map[string]ratelimit.Limit) Option

type RouteSpec

+ MFAEnrollmentExempt bool

v0.78.0

Jul 3, 2026

Changes in this version

+ const AccessTokenType

+ const ActionRequestEmailVerification

+ const ActionRequestPasswordReset

+ const ActionRequestPhoneVerification

+ const ActionUpdateUsername

+ const DefaultOutboundTimeout

+ const DelegatedAccessTokenType

+ const RL2FADisable

+ const RL2FAEnable

+ const RL2FARegenerateCodes

+ const RL2FAStartPhone

+ const RL2FAStartTOTP

+ const RL2FAVerify

+ const RLAdminPasswordReset

+ const RLAdminRolesGrant

+ const RLAdminRolesRevoke

+ const RLAdminUserSessionsList

+ const RLAdminUserSessionsRevokeAll

+ const RLAuthLogout

+ const RLAuthRegister

+ const RLAuthRegisterAbandon

+ const RLAuthRegisterAvailability

+ const RLAuthRegisterResendEmail

+ const RLAuthRegisterResendPhone

+ const RLAuthSessionsCurrent

+ const RLAuthSessionsList

+ const RLAuthSessionsRevoke

+ const RLAuthSessionsRevokeAll

+ const RLAuthToken

+ const RLEmailVerifyConfirm

+ const RLEmailVerifyRequest

+ const RLInviteCreate

+ const RLOIDCCallback

+ const RLOIDCStart

+ const RLPasskeyLogin

+ const RLPasskeyRegister

+ const RLPasswordLogin

+ const RLPasswordResetConfirm

+ const RLPasswordResetRequest

+ const RLPasswordlessConfirm

+ const RLPasswordlessStart

+ const RLPhoneVerifyConfirm

+ const RLPhoneVerifyRequest

+ const RLSolanaChallenge

+ const RLSolanaLink

+ const RLSolanaLogin

+ const RLUserDelete

+ const RLUserEmailChangeCancel

+ const RLUserEmailChangeConfirm

+ const RLUserEmailChangeRequest

+ const RLUserEmailChangeResend

+ const RLUserMe

+ const RLUserPasswordChange

+ const RLUserPhoneChangeCancel

+ const RLUserPhoneChangeConfirm

+ const RLUserPhoneChangeRequest

+ const RLUserPhoneChangeResend

+ const RLUserPreferredLanguage

+ const RLUserUnlinkProvider

+ const RLUserUpdateEmail

+ const RLUserUpdateUsername

+ const RemoteApplicationAccessTokenType

+ func DefaultRateLimits() map[string]ratelimit.Limit

+ func JWKSHandler(jwks jwtkit.JWKS) http.Handler

+ func LanguageMiddleware(cfg *LanguageConfig) func(http.Handler) http.Handler

+ type ActionAvailability struct

+ Action string

+ Allowed bool

+ CooldownSeconds *int64

+ Limit *int

+ NextAllowedAt *time.Time

+ Reason string

+ Remaining *int

+ RetryAfterSeconds int64

+ WindowSeconds *int64

+ type AuthCapabilities struct

+ Languages []string

+ Passkeys AuthPasskeyCapabilities

+ Password AuthPasswordCapabilities

+ Passwordless AuthPasswordlessCapabilities

+ Providers []AuthProviderSummary

+ Registration AuthRegistrationCapabilities

+ Solana AuthSolanaCapabilities

+ Verification AuthVerificationCapabilities

+ type AuthPasskeyCapabilities struct

+ Login bool

+ type AuthPasswordCapabilities struct

+ Login bool

+ type AuthPasswordlessCapabilities struct

+ Channels []string

+ Enabled bool

+ type AuthProviderSummary struct

+ ID string

+ Kind string

+ Name string

+ SupportsLink bool

+ SupportsLogin bool

+ SupportsRegistration bool

+ type AuthRegistrationCapabilities struct

+ InviteTokenRequired bool

+ Mode string

+ type AuthSolanaCapabilities struct

+ Login bool

+ type AuthVerificationCapabilities struct

+ Registration string

+ type ClientIPFunc func(r *http.Request) string

+ func ClientIPFromForwardedHeaders(trustedProxies []netip.Prefix) ClientIPFunc

+ func DefaultClientIP() ClientIPFunc

+ func PublicRemoteAddrClientIP() ClientIPFunc

+ type ErrorCode string

+ const ErrAbandonFailed

+ const ErrAccessTokenCreateFailed

+ const ErrAccessTokenListFailed

+ const ErrAccessTokenNotFound

+ const ErrAccessTokenRevokeFailed

+ const ErrAccountAlreadyClaimed

+ const ErrAccountClaimUserFailed

+ const ErrAccountExistsLinkRequired

+ const ErrAccountParkFailed

+ const ErrAccountRestrictFailed

+ const ErrAccountUnrestrictFailed

+ const ErrAddMemberFailed

+ const ErrAddressMismatch

+ const ErrAddressRequired

+ const ErrAssignRoleFailed

+ const ErrAttributeDefNotFound

+ const ErrAttributeDefRegisterFailed

+ const ErrAttributeDefResolveFailed

+ const ErrAuthRequiredForLink

+ const ErrAuthenticationFailed

+ const ErrAuthenticationRequired

+ const ErrAuthkitNotInitialized

+ const ErrAuthlogUnavailable

+ const ErrCancelFailed

+ const ErrCannotRemoveLastOwner

+ const ErrCannotUnlinkLastLoginMethod

+ const ErrChallengeExpired

+ const ErrChallengeFailed

+ const ErrChallengeVerifyFailed

+ const ErrDatabaseError

+ const ErrDefineRoleFailed

+ const ErrDeleteRoleFailed

+ const ErrDisableTwoFAFailed

+ const ErrDuplicateResource

+ const ErrEmailAlreadyVerified

+ const ErrEmailDeliveryFailed

+ const ErrEmailInUse

+ const ErrEmailNotVerified

+ const ErrEmailPasswordResetUnavailable

+ const ErrEmailRegistrationUnavailable

+ const ErrEmailSenderUnavailable

+ const ErrEmailUnavailable

+ const ErrEmailUnchanged

+ const ErrEmailVerificationFailed

+ const ErrEmailVerificationUnavailable

+ const ErrEnableTwoFAFailed

+ const ErrEntitlementFilterUnavailable

+ const ErrExchangeFailed

+ const ErrFailedToBan

+ const ErrFailedToDelete

+ const ErrFailedToList

+ const ErrFailedToListDeletedUsers

+ const ErrFailedToListSignins

+ const ErrFailedToListUsers

+ const ErrFailedToLogout

+ const ErrFailedToRequestEmailChange

+ const ErrFailedToRequestPhoneChange

+ const ErrFailedToRestoreUser

+ const ErrFailedToRevoke

+ const ErrFailedToRevokeAll

+ const ErrFailedToRevokeSessions

+ const ErrFailedToSetPassword

+ const ErrFailedToUnban

+ const ErrFailedToUnlink

+ const ErrFailedToUpdateBiography

+ const ErrFailedToUpdateEmail

+ const ErrFailedToUpdatePreferredLanguage

+ const ErrFailedToUpdateUsername

+ const ErrForbidden

+ const ErrHashFailed

+ const ErrInvalidAddress

+ const ErrInvalidBaseURL

+ const ErrInvalidChallenge

+ const ErrInvalidCode

+ const ErrInvalidCredentials

+ const ErrInvalidDefinition

+ const ErrInvalidEmail

+ const ErrInvalidExpiresAt

+ const ErrInvalidExpiry

+ const ErrInvalidFederationIssuer

+ const ErrInvalidFederationTrustSource

+ const ErrInvalidIdentifier

+ const ErrInvalidMessageEncoding

+ const ErrInvalidMethod

+ const ErrInvalidOrExpiredCode

+ const ErrInvalidOrExpiredResetSession

+ const ErrInvalidOrExpiredToken

+ const ErrInvalidOwnerNamespaceTransition

+ const ErrInvalidPassword

+ const ErrInvalidPhoneNumber

+ const ErrInvalidPreferredLanguage

+ const ErrInvalidProvider

+ const ErrInvalidRefreshToken

+ const ErrInvalidRequest

+ const ErrInvalidResource

+ const ErrInvalidRole

+ const ErrInvalidSignature

+ const ErrInvalidSignatureEncoding

+ const ErrInvalidSlug

+ const ErrInvalidState

+ const ErrInvalidToken

+ const ErrInvalidTrustSource

+ const ErrInvalidUI

+ const ErrInvalidUntil

+ const ErrInvalidVersion

+ const ErrInviteNotFound

+ const ErrIssuerReserved

+ const ErrLinkFailed

+ const ErrMemberPermissionsLookupFailed

+ const ErrMemberRolesLookupFailed

+ const ErrMissingFields

+ const ErrMissingName

+ const ErrMissingRole

+ const ErrMissingSessionID

+ const ErrMissingSidClaim

+ const ErrNoEmail

+ const ErrNoPendingEmailChange

+ const ErrNoPendingPhoneChange

+ const ErrNotAuthenticated

+ const ErrNotFound

+ const ErrOIDCBeginFailed

+ const ErrOIDCExchangeFailed

+ const ErrOwnerMembershipRequired

+ const ErrOwnerNamespaceInfoFailed

+ const ErrOwnerSlugTaken

+ const ErrOwnerUserNotFound

+ const ErrPKCEGenerationFailed

+ const ErrPasskeyFailed

+ const ErrPasswordChangeFailed

+ const ErrPasswordResetRequestFailed

+ const ErrPasswordResetRequired

+ const ErrPasswordTooShort

+ const ErrPasswordlessDisabled

+ const ErrPendingRegistrationNotFound

+ const ErrPermissionCheckFailed

+ const ErrPermissionGrantDenied

+ const ErrPermissionValidateFailed

+ const ErrPermissionsLookupFailed

+ const ErrPhoneAlreadyVerified

+ const ErrPhoneAndCodeRequired

+ const ErrPhoneChangeUnavailable

+ const ErrPhoneInUse

+ const ErrPhoneNotVerified

+ const ErrPhoneNumberMustBeE164

+ const ErrPhoneRegistrationUnavailable

+ const ErrPhoneTwoFAUnavailable

+ const ErrPhoneUnavailable

+ const ErrPhoneUnchanged

+ const ErrPhoneVerificationFailed

+ const ErrPhoneVerificationUnavailable

+ const ErrPreferredLanguageLookupFailed

+ const ErrProtectedRole

+ const ErrProviderAlreadyLinked

+ const ErrProviderLinkFailed

+ const ErrProviderNotLinked

+ const ErrRateLimited

+ const ErrRegenerateCodesFailed

+ const ErrRegistrationDisabled

+ const ErrRegistrationFailed

+ const ErrRemoteApplicationDeleteFailed

+ const ErrRemoteApplicationLookupFailed

+ const ErrRemoteApplicationMembershipFailed

+ const ErrRemoteApplicationNotFound

+ const ErrRemoteApplicationOwnerLookupFailed

+ const ErrRemoteApplicationRegisterFailed

+ const ErrRemoveMemberFailed

+ const ErrRenameRateLimited

+ const ErrResendFailed

+ const ErrReservedAccountNotFound

+ const ErrRoleExceedsGrantor

+ const ErrRoleNotFound

+ const ErrRoleNotGrantableToAPIKey

+ const ErrRolePermissionsLookupFailed

+ const ErrRolePermissionsUpdateFailed

+ const ErrSMSDeliveryFailed

+ const ErrSMSUnavailable

+ const ErrSendCodeFailed

+ const ErrSessionCreationFailed

+ const ErrSessionIssueFailed

+ const ErrStateStoreFailed

+ const ErrStepUpFailed

+ const ErrStepUpRequired

+ const ErrTokenCreationFailed

+ const ErrTokenIssueFailed

+ const ErrTwoFAChallengeFailed

+ const ErrTwoFAEnrollmentRequired

+ const ErrTwoFASendFailed

+ const ErrUnassignRoleFailed

+ const ErrUnauthorized

+ const ErrUnknownPermission

+ const ErrUnknownProvider

+ const ErrUnknownRole

+ const ErrUserBanned

+ const ErrUserCreationFailed

+ const ErrUserInvitesLookupFailed

+ const ErrUserLookupFailed

+ const ErrUserNotFound

+ const ErrUserRecoverFailed

+ const ErrUserinfoFailed

+ const ErrUsernameCannotContainAt

+ const ErrUsernameCannotStartWithPlus

+ const ErrUsernameInUse

+ const ErrUsernameInvalidCharacters

+ const ErrUsernameMissing

+ const ErrUsernameMustStartWithLetter

+ const ErrUsernameNotAllowed

+ const ErrUsernameTooLong

+ const ErrUsernameTooShort

+ const ErrVerificationLinkExpired

+ const ErrVerificationRequestFailed

+ const ErrWalletAlreadyLinked

+ func (c ErrorCode) String() string

+ type LanguageConfig struct

+ Default string

+ Supported []string

+ type Option func(*Service)

+ func WithClientIPFunc(fn ClientIPFunc) Option

+ func WithLanguageConfig(cfg LanguageConfig) Option

+ func WithRateLimiter(rl RateLimiter) Option

+ func WithRedis(rd *redis.Client) Option

+ func WithTrustedProxies(cidrs ...string) Option

+ func WithoutRateLimiter() Option

+ type RateLimitResult struct

+ Allowed bool

+ Availability *ActionAvailability

+ RetryAfter time.Duration

+ type RateLimiter interface

+ AllowNamed func(bucket string, key string) (bool, error)

+ type RateLimiterWithResult interface

+ AllowNamedResult func(bucket string, key string) (ratelimit.Result, error)

+ type RemoteApplicationIssuerRegistration struct

+ Issuer string

+ JWKSURI string

+ PublicKeys []authkit.RemoteAppKey

+ Slug string

+ type RemoteApplicationIssuersClient struct

+ func NewRemoteApplicationIssuersClient(opts ...RemoteApplicationIssuersClientOption) *RemoteApplicationIssuersClient

+ func (fc *RemoteApplicationIssuersClient) RegisterIssuer(ctx context.Context, acceptURL string, reg RemoteApplicationIssuerRegistration) error

+ type RemoteApplicationIssuersClientOption func(*RemoteApplicationIssuersClient)

+ func WithRemoteApplicationIssuersAuthToken(token string) RemoteApplicationIssuersClientOption

+ func WithRemoteApplicationIssuersHTTPClient(c *http.Client) RemoteApplicationIssuersClientOption

+ type RouteGroup string

+ const RouteAccount

+ const RouteAdmin

+ const RouteAuth

+ const RouteBrowserOIDC

+ const RoutePermissionGroups

+ const RouteRegistration

+ type RouteSpec struct

+ Group RouteGroup

+ Handler http.Handler

+ Method string

+ Path string

+ type Routes struct

+ func (r Routes) DefaultAPI() []RouteSpec

+ func (r Routes) Groups(groups ...RouteGroup) []RouteSpec

+ func (r Routes) OIDCBrowser() []RouteSpec

+ func (r Routes) PermissionGroups() []RouteSpec

+ type Service struct

+ func NewServer(client *embedded.Client, opts ...Option) (*Service, error)

+ func (s *Service) APIHandler() http.Handler

+ func (s *Service) APIRoutes(groups ...RouteGroup) []RouteSpec

+ func (s *Service) CheckSMSHealth(ctx context.Context) error

+ func (s *Service) JWKSHandler() http.Handler

+ func (s *Service) OIDCBrowserRoutes(groups ...RouteGroup) []RouteSpec

+ func (s *Service) OIDCHandler() http.Handler

+ func (s *Service) PermissionGroupRoutes() []RouteSpec

+ func (s *Service) Routes() Routes

+ func (s *Service) SMSAvailable() bool

+ func (s *Service) SMSHealthReason() string

+ func (s *Service) SMSHealthy() bool

+ func (s *Service) Verifier() *verify.Verifier