Authentication for Go

Gorta

A minimal, adapter-based auth library. Gorta handles password hashing, sessions, OAuth flows, and secure cookies

Get startedView on GitHub

Built for control, not ceremony

Standard library HTTP, explicit configuration, no ORM requirement.

  • You own the data

    Implement core.Storage against your database, ORM, and schema

  • Composable plugins

    • Email & password
    • Magic links
    • Google & GitHub OAuth

  • Sessions & cookies

    Password hashing, secure cookies, session validation, and RequireAuth middleware

A few lines to go live

Mount routes under /auth, wrap your mux with session middleware, protect handlers with RequireAuth.

Full example →
storage := sqladapter.New(db)

emailPlugin, _ := emailpassword.New(storage, storage, mailer, emailpassword.Config{
    VerifyEmail: true,
})

auth, _ := gorta.New(storage, gorta.Config{
    Secret:  os.Getenv("SECRET"),
    BaseURL: os.Getenv("BASE_URL"),
}, gorta.WithPlugin(emailPlugin))

mux := http.NewServeMux()
mux.Handle("/auth/", http.StripPrefix("/auth", auth.Handler()))
mux.Handle("/dashboard", auth.RequireAuth()(http.HandlerFunc(dashboard)))

http.ListenAndServe(":8080", auth.Middleware()(mux))

Auth methods

Available today

  • Email & password
  • Magic links
  • Google & GitHub OAuth

On the roadmap

  • Passkeys (WebAuthn)
  • Email OTP
  • Phone number
  • Username
  • Anonymous sign-in
  • One-tap sign-in

Ready to wire up auth?

Follow the getting started guide, then copy patterns from cmd/main.go.

Read the docs