Outcome: a Gin service that returns 401 on GET /me unless Authdog authenticates the caller. About five minutes.
Gin is the only shipped adapter. net/http, chi, and Echo need a manual adapter. The Go module has no tagged versions; pin a commit.
- Prerequisites: Go 1.25+ and an Authdog environment.
1. Create an environment and copy the public key
In the console:
- Create a tenant, a project, and an environment.
- Open Dashboard (
/dashboard/home) and copy Public key (pk_...).
The public key is publishable. Details: Environments.
2. Install the module
go get github.com/authdog/web-sdk/packages/go@latestPin the resolved pseudo-version in go.mod for reproducible builds.
3. Set the env var
export PK_AUTHDOG="pk_..."4. Create the client
ad, err := authdog.New(authdog.Config{
PublicKey: os.Getenv("PK_AUTHDOG"),
})
if err != nil {
log.Fatal(err)
}New rejects malformed keys and identity hosts outside the trusted HTTPS allowlist.
5. Protect one Gin route
r := gin.Default()
r.Use(ad.AttachSession())
r.GET("/me", ad.RequireAuth(), func(c *gin.Context) {
c.JSON(http.StatusOK, authdog.FromGin(c).User)
})
r.Run(":3000")AttachSession is informational. RequireAuth is the 401 boundary.
6. Verify
GET /me without a session should be 401 {"error":"Unauthorized"}.
GET /me with a valid authdog-session cookie or Authorization: Bearer <token> from hosted sign-in should return the user.
If it fails:
- 401 after a real sign-in —
PK_AUTHDOGis from another environment. - Compile against another router — there is no chi/Echo/net/http middleware. See the Go guide.
- Floating latest — pin a commit;
@latestis an untagged pseudo-version.
Next
The Go guide covers FetchUser, logout, and manual adapters. Apply authorization after RequireAuth.