auth-api

module

v0.7.0 Latest Latest Go to latest Published: Sep 9, 2026 License: MIT

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/sweetrpg/auth-api

Links

Open Source Insights

README ¶

SweetRPG Auth API

Go API service for the platform's authentication/authorization domain: Auth0 token verification, the role model, and per-service access. Split out of users-api - see sweetrpg/platform's split-authz-into-auth-api OpenSpec change for the rationale, and its migrate-auth-users-api-to-go OpenSpec change for the Swift-to-Go rewrite.

Verifies Auth0-issued access tokens server-side (JWKS signature verification) and exposes POST /authz/check for other services to call. See AGENTS.md for the role model and consumer list.

Running Locally

go run cmd/auth-api/main.go

Requires DB_URI (or the DB_SCHEME/DB_HOST/DB_USER/DB_PW/DB_NAME/DB_OPTS parts), AUTH0_DOMAIN, and AUTH0_AUDIENCE in the environment. Serves on :8000 (BIND_ADDRESS to override).

Testing

go test ./...

Directories ¶

Path	Synopsis
auth0 Package auth0 verifies Auth0-issued access tokens against the tenant's JWKS.	Package auth0 verifies Auth0-issued access tokens against the tenant's JWKS.
cmd
auth-api command
backfill-audit-fields command Command backfill-audit-fields stamps the platform audit fields (PADR-0001) on auth-api's pre-convention documents in user_roles and service_deny_entries: it renames the legacy camelCase createdAt to created_at, and sets created_by / updated_by / updated_at.	Command backfill-audit-fields stamps the platform audit fields (PADR-0001) on auth-api's pre-convention documents in user_roles and service_deny_entries: it renames the legacy camelCase createdAt to created_at, and sets created_by / updated_by / updated_at.
backfill-canonical-user-ids command Command backfill-canonical-user-ids rewrites auth-api's audit *_by fields from raw Auth0 subjects to canonical users._id (or the "system" sentinel for unresolvable subjects).	Command backfill-canonical-user-ids rewrites auth-api's audit *_by fields from raw Auth0 subjects to canonical users._id (or the "system" sentinel for unresolvable subjects).
constants
docs Package docs Code generated by swaggo/swag.	Package docs Code generated by swaggo/swag.
models Package models defines the persisted document shapes for auth-api.	Package models defines the persisted document shapes for auth-api.
server

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL