AuthInGo

The problem

Every new app needs sign-in, and teams usually pick between two bad options: hand their users to a hosted identity provider, or hand-roll sessions, cookies and token refresh and hope they got the security right.

The insight

Most products only need solid email-and-password auth that lives in their own database. The hard part isn't the login form; it's the session and cookie plumbing underneath it.

What we built

A Go library with the auth engine, HTTP routes and middleware, plus a React SDK on npm. Sessions are opaque tokens stored in the app's own database and sent only in HttpOnly cookies, so the frontend never touches a token. Access tokens refresh silently in the background, logout syncs across browser tabs, and cookies ship with Secure, SameSite and anti-CSRF protection. Storage is a pluggable interface with a ready-made PostgreSQL adapter, and the site includes docs and a live playground.

Under the hood

• Go
• PostgreSQL (database/sql adapter)
• React
• TypeScript
• npm package (@authingo/react)

What it proves

We get the security-critical parts right and package them so other developers can drop them in: the same care that goes into every login we build for clients.