Learn how AuthInGo brings Better Auth-style developer experience to Go backends and React apps.

AuthInGo

AuthInGo is a small, server-first authentication framework for Go applications with React or Next.js frontends.

Instead of issuing JWTs to the browser, AuthInGo creates opaque session tokens, stores the session in your database, and sends tokens with HttpOnly cookies. That means the browser can authenticate requests without ever owning readable credentials.

Good fit

AuthInGo is best when you want authentication inside your own Go service, backed by your own database, with a lightweight React client for UI state.

Architecture at a glance

AuthInGo has three main pieces:

Layer	Package	Responsibility
Server core	`github.com/binit2-1/authingo`	Registers auth routes, creates users, hashes passwords, creates sessions, sets cookies, and protects routes.
Storage	`github.com/binit2-1/authingo/adapters/postgres`	Persists users and sessions in PostgreSQL through the `Store` interface.
Frontend	`@authingo/react`	Provides global auth state, session checks, logout, and email/password client actions.

Request flow

Your React app calls signIn.email() or signUp.email().
The Go backend validates the request and creates a session.
AuthInGo sets authingo_session and authingo_refresh as HttpOnly cookies.
Your app calls /session through useAuth().checkSession().
Protected backend routes use RequireAuth to validate the session cookie before running application code.

Core routes

Mounting auth.Handler() exposes these routes relative to the path where you mount it:

Method	Route	Purpose
`POST`	`/sign-up`	Create a user and start a session.
`POST`	`/sign-in`	Authenticate a user and start a session.
`GET`	`/session`	Return the current user and session from cookies.
`POST`	`/sign-out`	Delete the current session and clear cookies.

Security defaults

AuthInGo leans on server-side controls:

Passwords are hashed with bcrypt before storage.
Session tokens are random opaque values, not signed user payloads.
Cookies are HttpOnly, so client-side JavaScript cannot read them.
The session cookie defaults to SameSite=Lax.
The refresh cookie defaults to SameSite=Strict and is scoped to /api/auth/refresh.
Cross-site embedded demos can explicitly opt into SameSite=None; Secure.
Built-in state-changing routes and protected routes require the X-Authingo-Client: true header.
Expired sessions can be cleaned up by the storage adapter.

Install AuthInGo

Create the database tables and mount the Go handler.

Understand concepts

Learn the model before customizing your app.

Introduction