theauth-go

OAuth 2.1 and sign-in for Go MCP servers and agents. It mounts into your own net/http server, your users and tokens stay in your own database, and there is no hosted service. MIT licensed.

Building an MCP server in Go means implementing OAuth 2.1, protected resource metadata (RFC 9728), PKCE and token validation yourself. This library does that part, so your server accepts tokens from MCP clients and you keep control of identity.

Checked against a real client. The official modelcontextprotocol/go-sdk client (v1.8.0) completes the full flow against it in integration/mcp-interop: discovery, dynamic client registration, PKCE S256, token exchange and an authenticated tool call. Login and consent are simulated in that test, so it proves the protocol path, not a production deployment.

Who it is for: Go developers building MCP servers, agent backends or internal tools who want to own their auth instead of renting it.

What you get

• Sign-in with passwords, magic links, social login, passkeys and TOTP, with sessions stored in your database.
• An OAuth 2.1 authorization server and an mcpresource module that guards MCP tools by scope.
• SQLite, Postgres or MySQL storage, plus SAML and SCIM when you need them (see the status table for what is stable).
• Signed releases with an SBOM you can verify.

Every line above is a real request. Run it yourself with cd integration/mcp-interop && GOWORK=off go run ./cmd/demo. Login and consent are simulated in this demo.

Quickstart

A server with sign-up, sign-in, magic links, sessions and one protected route, stored in one SQLite file. Install with go get github.com/glincker/theauth-go/v2 and go get github.com/glincker/theauth-go/storage/sqlite (both modules need Go 1.26).

package main

import (
	"context"
	"database/sql"
	"log"
	"net/http"

	"github.com/glincker/theauth-go/v2"
	sqlitestore "github.com/glincker/theauth-go/storage/sqlite"
	_ "modernc.org/sqlite"
)

func main() {
	ctx := context.Background()
	db, err := sql.Open("sqlite", "file:app.db?_pragma=foreign_keys(1)&_pragma=busy_timeout(5000)&_pragma=journal_mode(WAL)&_txlock=immediate")
	if err != nil {
		log.Fatal(err)
	}
	if err := sqlitestore.Migrate(ctx, db); err != nil {
		log.Fatal(err)
	}
	store, err := sqlitestore.New(db)
	if err != nil {
		log.Fatal(err)
	}

	a, err := theauth.New(theauth.Config{CoreStorage: store, BaseURL: "http://localhost:8080"})
	if err != nil {
		log.Fatal(err)
	}
	defer a.Close()

	mux := http.NewServeMux()
	mux.Handle("/auth/", a.Handler()) // sign-up, sign-in, magic link, sessions
	mux.Handle("GET /me", a.RequireAuth()(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		user, _ := theauth.UserFromContext(r.Context())
		w.Write([]byte("hello " + user.Email))
	})))
	log.Fatal(http.ListenAndServe(":8080", mux))
}

a.Handler() is a plain http.Handler, so no http.StripPrefix is needed. With chi, call a.Mount(r) instead. More setups are in examples and the docs.

Why this exists

I needed a Go OAuth 2.1 authorization server for MCP clients and agents that runs inside my own process: RFC 9728 protected resource metadata, Client ID Metadata Documents (CIMD) and DPoP. The same module also handles ordinary sign-in (passwords, magic links, passkeys, social login), so people and agents share one database. It is young: the first commit is dated 2026-06-20. When not to use it lists where fosite, zitadel/oidc, goth, authboss, Keycloak or Ory fit better.

Status

Stable means SemVer applies. Beta means the API is covered by SemVer but I know of behavior gaps. Experimental means it may change in a minor release, or the stability policy does not cover it yet.

Area	Status	Basis
Sign-in, sessions, social login, passkeys, TOTP	Stable	Root package, listed stable
Authorization server core: code with PKCE, refresh, client credentials, token exchange, discovery, dynamic registration	Stable	v2.0 commitment in the policy
MCP resource server (mcpresource) and RFC 9728 metadata	Stable	Listed stable package
DPoP, CIMD, PAR, JAR, CIBA, RAR, ID-JAG	Experimental	Not in the policy; CIMD options listed experimental
Agent identity and delegation	Experimental	Listed experimental
SAML SSO, SCIM, organizations, RBAC	Beta	API listed stable; no published IdP interop matrix
Memory storage, audit sinks	Stable	Listed stable
Postgres and MySQL storage	Beta	Roadmap: shared contract suite still fails on constraint edge cases
SQLite storage, clientauth, policy, Gin, Echo and Fiber adapters	Experimental	First three listed experimental; adapters not in the policy

Levelrail, another product I build, imports it (pinned at v2.12.0). I have no independent audit or OpenID certification to point to. Other facts you can check yourself are in docs/PROOF.md.

AI assistance

Parts of this code were written with AI assistance. I review it, and it is covered by tests (361 test files, count it with the commands in PROOF.md) and the threat model. Codecov reported about 46 percent line coverage on 2026-10-31, so treat the tests as a floor. Report vulnerabilities privately through the security policy.

Docs

Install and verify releases | Features | Agent quickstart | Storage | FAQ and migrating | Examples | Changelog | About | Discussions