An open-source authentication platform you can embed in Go, or run as a standalone auth server.
Embed in Go
Mount the handler in your own service and keep auth in process.
Run standalone
Start one auth service for every app and language.
Your data stays in your database
Authula uses the database, email and providers you already run.
The same authentication core, delivered two ways. Start with the model that fits your stack and keep your options open.
Authula lives inside your Go application.
Authula runs as its own authentication service.
Both modes share the same plugins, routes and APIs.
Authula handles the authentication flow. Your users, data and providers stay under your control.
Accounts, sessions and profiles stay in your database, under your schema.
Authula reads and writes through the database you already run and back up.
Email, OAuth and storage connect with credentials you control.
Web, mobile or backend apps
Sign-in, sessions and access checks
Your database, email and OAuth providers
Library mode runs Authula inside your Go process. Standalone mode runs the same core as its own service.
Enable the capabilities your product needs and leave the rest out of the build.
The user signs up with an email and password, or an OAuth provider.
Authula sends a link and confirms the address before sign-in.
The user gets a session cookie and a refresh token.
Your app reads the signed-in user and claims from the request.
Argon2 hashing, verification, reset and email-change flows.
GitHub, Google and Discord, with an extensible provider API.
Passwordless sign-in with expiring email links.
Expiring tokens and transactional email templates.
HTTP-only cookies, sliding renewal and automatic cleanup.
Key rotation, refresh tokens and a public JWKS endpoint.
Validate JWT access tokens from the Authorization header.
Scoped, expiring keys with per-key rate limits.
Authenticator-app 2FA with recovery codes and trusted devices.
Double-submit cookie protection on state-changing requests.
Per-route rules with memory, Redis or database storage.
Roles, permissions and weighted role hierarchy.
User, account and session management with audit trails.
Multi-tenant orgs, members, teams and invitations.
Redis, database or in-memory storage for high-churn data.
GoChannel, Redis, Kafka, NATS, RabbitMQ, PostgreSQL or SQLite.
Register routes or trigger async work from hooks.
A small Go interface gives plugins routes, hooks, migrations and shared services. Add what you need and keep the core untouched.
Shared services, hooks and migrations
Plugins register their routes, hooks and migrations with the core. Add your own without forking it.
Plugins start with the core and share its database, logger and event bus.
Plugins offer capabilities to each other and to your application.
Declare what a plugin needs and Authula starts things in the right order.
A plugin can add routes, middleware and background work.
Implement the interface
Write a Go type that matches the plugin interface.
Declare dependencies
List the plugins and migrations your plugin needs.
Register the plugin
Add it to the plugin list when you build Authula.
Authula connects it
Routes, hooks and migrations are wired into the core.
Integrations
Discord, GitHub and Google are built in. Connect any OAuth2 or OIDC provider with your own endpoints and field mappings.
No runtime, no generated client, no new mental model. The APIs feel like the rest of your Go code.
A request hits a route protected by Authula.
Authula reads the cookie or bearer token and verifies it.
The signed-in user and claims are ready in the request context.
Authula can refresh the session, add headers or record an event.
Read the signed-in user and claims without type assertions.
Protect routes with middleware that fits your existing handler chain.
Manage users and sessions from Go when HTTP is not the right tool.
Keep auth settings in Go and catch mistakes when you build.
Data, observability and deployment surfaces you can reason about—without a second control plane.
Point Authula at your database; migrations run on startup.
Export traces and metrics to the collector you already run.
Run Authula as a single Go binary on your own infrastructure.
Deploy the official container image with your config and environment.
Scale auth alongside your services using the same container image.
Operate auth like the rest of your stack.
Install the module, choose a deployment path and start the service. The docs cover the rest.
Add Authula to your Go module.
$ go get github.com/Embed it in your Go app or run it as its own service.
Open the setup guideStart the binary or official image with your database and environment. Migrations run on startup.
Every path starts from the same core.
Licensed under Apache 2.0.
Authula is Apache-2.0 and developed in public. Ask questions, report what breaks, or bring a plugin idea.
Need to talk? Contact us.
Released under the Apache 2.0 License.