Getting theauth-go into a Go module is a single go get. This page covers the main module, the standalone mcpresource resource-server SDK, and the Postgres migration step, plus how to verify the install worked.
Requirements
- Go 1.25+
- A
chi or net/http-compatible HTTP router (the library works with any; chi is used in examples).
Install the main module
This installs the full theauth-go surface: magic links, email/password, WebAuthn, TOTP, SAML, SCIM, RBAC, audit, and the OAuth 2.1 authorization server.
Install only the MCP resource server SDK
If you are building an MCP resource server and only need JWT validation (not the auth server itself), install the zero-dependency submodule instead:
mcpresource has no third-party dependencies. Importing it does not pull in theauth core or any storage adapter.
Postgres storage adapter
The Postgres adapter uses pgx/v5 and generated SQL via sqlc. It is bundled in the main module under storage/postgres; no separate go get is needed. You do need to run migrations before first use:
Verify the installation
Release verification
Every release artifact is signed with cosign keyless signing (Sigstore OIDC). See Releases and Verification for the smoke-test commands. Last modified on October 7, 2026