go-dev-auth v0.3.1: zero-dependency auth for Go with passkeys, SSO, 2FA and orgs
We've been building **go-dev-auth**, a batteries-included auth library for Go inspired by better-auth from the TypeScript world. The core is pure stdlib, zero dependencies.
**What's in it**
- Email/password
- Social sign-on (11 providers, PKCE)
- Sessions
- Two-factor
- Passkeys (WebAuthn)
- Magic links
- Organizations
- SSO (OIDC)
- Admin
- API keys
- JWT
Mounts as a plain `http.Handler` on any router. Storage adapters for Postgres, MySQL, SQLite and in-memory.
**New in v0.3.1**
Passkey and SSO plugins, both with no external deps. CBOR/COSE parsing and WebAuthn signature verification live in the package.
**Testing**
- A written threat model where every claim maps to a committed test
- Race detector and fuzzing on every push
- Storage suite runs against real Postgres, MySQL and SQLite in CI
**Links**
- Repo: https://github.com/go-dev-auth/go-dev-auth
- Docs: https://www.godevauth.com
It's pre-1.0. Feedback welcome, especially on the passkey implementation and the threat model.