auth-api

README

SweetRPG Auth API

Go API service for the platform's authentication/authorization domain: Auth0 token verification, the role model, and per-service access. Split out of users-api - see sweetrpg/platform's split-authz-into-auth-api OpenSpec change for the rationale, and its migrate-auth-users-api-to-go OpenSpec change for the Swift-to-Go rewrite.

Verifies Auth0-issued access tokens server-side (JWKS signature verification) and exposes POST /authz/check for other services to call. See AGENTS.md for the role model and consumer list.

Running Locally

go run cmd/auth-api/main.go

Requires DB_URI (or the DB_SCHEME/DB_HOST/DB_USER/DB_PW/DB_NAME/DB_OPTS parts), AUTH0_DOMAIN, and AUTH0_AUDIENCE in the environment. Serves on :8000 (BIND_ADDRESS to override).

Testing

go test ./...