Outcome: a Gin service that returns 401 on `GET /me` unless Authdog authenticates the caller. About five minutes.

**Gin is the only shipped adapter.** `net/http`, chi, and Echo need a manual adapter. The Go module has no tagged versions; pin a commit.

0. Prerequisites: Go 1.25+ and an Authdog environment.

## 1. Create an environment and copy the public key

In the [console](https://console.authdog.com):

1. Create a **tenant**, a **project**, and an **environment**.
2. Open **Dashboard** (`/dashboard/home`) and copy **Public key** (`pk_...`).

The public key is publishable. Details: [Environments](/docs/console/environments).

## 2. Install the module

```bash
go get github.com/authdog/web-sdk/packages/go@latest
```

Pin the resolved pseudo-version in `go.mod` for reproducible builds.

## 3. Set the env var

```bash
export PK_AUTHDOG="pk_..."
```

## 4. Create the client

```go
ad, err := authdog.New(authdog.Config{
    PublicKey: os.Getenv("PK_AUTHDOG"),
})
if err != nil {
    log.Fatal(err)
}
```

`New` rejects malformed keys and identity hosts outside the trusted HTTPS allowlist.

## 5. Protect one Gin route

```go
r := gin.Default()
r.Use(ad.AttachSession())

r.GET("/me", ad.RequireAuth(), func(c *gin.Context) {
    c.JSON(http.StatusOK, authdog.FromGin(c).User)
})

r.Run(":3000")
```

`AttachSession` is informational. `RequireAuth` is the 401 boundary.

## 6. Verify

`GET /me` without a session should be `401 {"error":"Unauthorized"}`.

`GET /me` with a valid `authdog-session` cookie or `Authorization: Bearer <token>` from hosted sign-in should return the user.

If it fails:

- **401 after a real sign-in** — `PK_AUTHDOG` is from another environment.
- **Compile against another router** — there is no chi/Echo/net/http middleware. See the [Go guide](/docs/backend/go).
- **Floating latest** — pin a commit; `@latest` is an untagged pseudo-version.

## Next

The [Go guide](/docs/backend/go) covers `FetchUser`, logout, and manual adapters. Apply [authorization](/docs/concepts/authorization) after `RequireAuth`.