Wicket

v0.1.4 · Go 1.27 · Apache-2.0

An authorization server
you embed in Go

Wicket ships the full set of OpenID Connect and OAuth 2.0 endpoints as one http.Handler middleware. Your login page, your user store, your deployment — Wicket just gets the protocol right.

Get started Why embedded?
go get github.com/gonewx/wicket@v0.1.4
main.go
// 1. Composition root: wires every protocol service
root, err := di.NewRoot()
if err != nil { log.Fatal(err) }
defer root.Close()

// 2. Inject clients, resources, signing keys and stores
cfg := root.ServerConfig()
cfg.SetClients(clients)
cfg.SetApiScopes(scopes)
cfg.SetRefreshTokenStore(store.NewRefreshTokenStore(pool, logger))
cfg.Freeze() // a missing store fails right here

// 3. Put it in front of the router you already have
srv, _ := server.DefaultServer(root)
http.ListenAndServe(":443",
    hosting.ScopeMiddleware(root)(srv.UseWicket()(app)))

Where it sits in the request path

Protocol paths are handled by Wicket; every other request reaches your application untouched. No sidecar, no cross-process hop.

  1. Clients Browsers · mobile apps · backend services
  2. Your Go process Wicket middleware/connect/* · /.well-known/* Your handlersLogin · consent · business APIs
  3. Your storage PostgreSQL adapter · your own adapter

Protocol coverage

Standards-based, opt-in where it matters. Every capability maps to source and tests you can read.

Authorization code + PKCE

Issue tokens to web, mobile and single-page apps. Login and consent hand back to pages you own.

Read the flow →

Client credentials

The shortest path for service-to-service calls: one client, one scope, one request.

Read the flow →

Refresh tokens

Long-lived access via offline_access, backed by a versioned refresh-token store.

Read the flow →

CIBA

Server-initiated authentication confirmed on the user's own device — think call centers and counters.

Read the flow →

Discovery, JWKS, introspection

Standard .well-known metadata, a published key set and token introspection that resource servers can use as-is.

All endpoints →

Sessions and sign-out

An end-session endpoint with post-logout redirects, plus a pluggable server-side session store.

Read the flow →

External identity providers

Google and Facebook sign-in and JWT bearer authentication, wired in through pluggable scheme handlers.

Identity →

Signing key lifecycle

The keymgmt package rotates keys through candidate, active, retained and retired, so older tokens keep validating.

Signing keys →

Storage is a port, not a lock-in

The core module has zero database drivers. Storage is split into three families of interfaces, and you choose the implementation.

  • Official PostgreSQL adapter: github.com/gonewx/wicket-pg, migrations included.
  • Conformance suites: storagetest, sessiontest and keymgmttest — pass them and declare the version you conform to.
  • Semantics in the contract: "not found" is distinguishable from "failed", writes are insert-only by default, concurrent updates carry a version.
Persistence guide
storage Authorization codes · refresh tokens · reference tokens · consent · device codes · CIBA requests
session Server-side sessions, revocable per subject
keymgmt Signing key records and rotation state, optimistic concurrency

Defaults that side with production

Miswired means it won't start

If a store isn't injected and you haven't explicitly opted into in-memory fallback, assembly fails — instead of losing tokens at random across replicas.

No hidden goroutines

Cleanup of expired data is an entry point you schedule. When it runs, for how long and how it logs is your call.

Expiry decided in the core

Expiration is judged against an injected clock, never database time, so clock drift across a cluster can't produce split decisions.

Only need to verify sign-in tokens?
Skip the server.

Three standalone packages with no storage and no composition root. Import one and go.

Local validation vs. server exchange
oidcverify
Validate ID tokens from Apple, Google or any custom provider locally against their JWKS.
wechatverify
Exchange a WeChat mobile-app authorization code for unionid / openid on the server.
phoneverify
Exchange an Alibaba Cloud number-verification token for the user's phone number (one-tap login).

Where things stand

Wicket is at 0.x: core authorization paths are covered by integration and end-to-end tests, and the public API may still change. Some capabilities are still incomplete — the device authorization and revocation endpoints, refresh-token lifetime policies and front/back-channel logout among them — and the WeChat and phone-number packages have not been exercised against live credentials. The docs mark the status of every capability plainly.

Issue your first token in ten minutes