How HN: Go-dev-auth zero-dependency authentication library for Go

A comprehensive, framework-agnostic authentication library for Go that implements a full suite of auth features with zero external dependencies. It provides email-and-password sign-in (scrypt hashing compatible with better-auth), OAuth2/OIDC social sign-on with PKCE for many providers, sessions with sliding expiration and signed cookies, account linking, email verification, password reset, two-factor options (TOTP, email OTP, backup codes), WebAuthn passkeys (CBOR/COSE parsing included), magic links, organizations/SSO, admin tooling, API keys, EdDSA-signed JWTs with a JWKS endpoint, and bearer header auth. The handler is a plain http.Handler so it mounts on any Go web framework; storage adapters include in-memory and database/sql-backed Postgres/MySQL/SQLite (with schema/migration generation). The repo ships examples, plugins that mirror better-auth, CI with fuzzing and race detection, and production usage while still pre-1.0.

Operational and security specifics are enforced up front: New validates BaseURL, a 32+-char Secret, cookie/security settings, and refuses to start on unsafe proxy settings. Accurate client IPs (for rate limiting and session recording) require explicit TrustProxyHeaders plus TrustedProxies or configured provider-specific IP headers; otherwise limits either collapse to a single proxy bucket or become spoofable. Built-in cleanup for expired tokens, CORS helper, request/database hooks, and storage conformance tests against real databases round out a secure, auditable foundation intended to reach v1.0 after additional examples, MySQL verification, and a third-party security review.