Skip to content
go-api-boilerplate

Overview

Sessions for the web app, OAuth 2 for third-party apps, and the keys that verify every access token.

go-api-boilerplate auth service 1

Section titled “go-api-boilerplate auth service 1”

Every route is served through the gateway under /api/auth. Access tokens are RFC 9068 JWTs signed with ES256; any service verifies them with the keys at /.well-known/jwks.json.

Errors are RFC 9457 problem details, except at /oauth/token and /oauth/revoke, which answer in the format of RFC 6749 §5.2. Unsafe requests that a browser sends from another origin to a cookie- authenticated route are refused with 403.

Information

  • License: MIT
  • OpenAPI version: 3.1.0

Operations

Section titled “Operations”
GET
/livez
GET
/readyz
GET
/.well-known/jwks.json
GET
/v1/sessions
POST
/v1/sessions
POST
/v1/sessions/refresh
DELETE
/v1/sessions/current
DELETE
/v1/sessions/{id}
GET
/v1/clients
POST
/v1/clients
DELETE
/v1/clients/{id}
GET
/.well-known/oauth-authorization-server
GET
/v1/authorization-requests/{id}
GET
/oauth/authorize
POST
/oauth/authorize
POST
/oauth/token
POST
/oauth/revoke

Authentication

Section titled “Authentication”

bearer

Section titled “bearer”

An RFC 9068 access token.

Security scheme type: http

Bearer format: JWT

Section titled “cookie”

The web app’s session access token.

Security scheme type: apiKey

Cookie parameter name: access_token

refreshCookie

Section titled “refreshCookie”

The web app’s session refresh token, sent only to /v1/sessions.

Security scheme type: apiKey

Cookie parameter name: refresh_token

clientBasic

Section titled “clientBasic”

Client_secret_basic, the client ID and secret each form-encoded (RFC 6749 §2.3.1).

Security scheme type: http