auth-flows

Document JWT, API key, and GUI session authentication in a Go API.

125|18|Updated Jun 21, 2025

Search Tags:#authorization #authentication #jwt #middleware #rbac #session management

Ready to run

npx skills add https://github.com/gjovanovicst/golang-auth-api --skill auth-flows

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: auth-flows
Source: https://github.com/gjovanovicst/golang-auth-api/tree/main/.opencode/skills/auth-flows
Command: npx skills add https://github.com/gjovanovicst/golang-auth-api --skill auth-flows

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill provides a comprehensive understanding of the project's authentication and authorization mechanisms, enabling secure and robust access control.

Core Features & Use Cases

Authentication Systems: Details on JWT, API Keys, and Admin GUI sessions.
Middleware Pipeline: Explains the order and function of security middleware.
RBAC: Describes the Role-Based Access Control model and permissions.
Session Management: Covers user and admin session handling and storage.
Use Case: When implementing a new feature that requires user login or API access, consult this Skill to understand the correct middleware to apply and how to authorize user actions.

Quick Start

Explain the user JWT authentication flow, including token lifecycle and middleware.

Frequently Asked Questions about auth-flows

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I implement JWT authentication and manage the token lifecycle in a Go API?▼

JWT authentication in a Go API validates user identity through a middleware pipeline. Token lifecycle management covers generation, signing, expiration, and blacklisting to securely control user sessions.

What is the correct order for security middleware in a Go API authentication pipeline?▼

Security middleware processes requests sequentially to extract app IDs, validate API keys, and verify JWTs. The pipeline authenticates credentials first, then applies Role-Based Access Control to authorize specific user actions.

Can I use API keys alongside GUI sessions for access control in my Go application?▼

API keys and GUI sessions are supported simultaneously within the same Go application. API keys handle programmatic access, while GUI sessions manage browser-based admin panel authentication, both processed through the central middleware pipeline.

How does Role-Based Access Control (RBAC) authorize user actions after JWT validation?▼

Role-Based Access Control authorizes user actions by mapping authenticated identities to specific roles and permissions. After JWT validation confirms identity, RBAC middleware checks if the assigned role grants permission to execute the requested operation.

Why do I need token blacklisting for session management in a stateless Go API?▼

Token blacklisting prevents replay attacks by invalidating JWTs before their natural expiration. This session management technique ensures logged-out or compromised tokens are immediately rejected by the authentication middleware pipeline.