golang-jwt for Go: Complete Guide with Examples

The golang-jwt library (official name — github.com/golang-jwt/jwt/v5) is the de facto standard implementation of JSON Web Tokens (JWT) for the Go language. It provides developers with a powerful and flexible toolkit for creating, signing, verifying, and decoding JWT tokens. JWT is a compact and self-contained way to transmit information between parties as a JSON object, which can be verified because it is digitally signed. JWT tokens are widely used for authentication, authorization, and secure data exchange in REST APIs, microservice architectures, and web applications.

Why is this library needed? In modern web development with Go, almost any application requiring user authentication (e.g., API servers, microservices, single sign-on systems) encounters the need to work with JWT. The golang-jwt library handles all the complexity: generating and verifying signatures (HMAC, RSA, ECDSA, EdDSA), parsing headers and payload, processing standard fields (exp, iat, iss, sub) and custom claims. Without it, you would have to manually implement cryptographic operations and JSON parsing, which is prone to errors and vulnerabilities.

Key advantages of golang-jwt: full support for the RFC 7519 specification, ease of use thanks to a fluent interface, high performance (uses the standard crypto library), extensibility through custom signing methods and validators. The library is actively maintained by the community, has over 7,000 stars on GitHub, and is used in projects such as Kubernetes, Docker, Grafana, and many others.

Installation

The library is installed using the standard Go method via go get. Make sure you have Go version 1.18 or higher installed (1.21+ recommended).

go get github.com/golang-jwt/jwt/v5

After executing the command, the dependency will appear in your go.mod. Import the library into your code as follows:

import "github.com/golang-jwt/jwt/v5"

Quick Start — Minimal Working Example

Let's create a simple example: generating and verifying a JWT token using a symmetric key (HMAC-SHA256).

package main\n\nimport (\n    "fmt"\n    "time"\n    "github.com/golang-jwt/jwt/v5"\n)\n\nfunc main() {\n    // 1. Secret key (must be stored securely)\n    secretKey := []byte("my-super-secret-key-12345")\n\n    // 2. Creating the token\n    claims := jwt.MapClaims{\n        "user_id": 12345,\n        "role":    "admin",\n        "exp":     time.Now().Add(time.Hour * 24).Unix(), // expiration time 24 hours\n        "iat":     time.Now().Unix(),                     // issued at time\n    }\n\n    token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)\n    tokenString, err := token.SignedString(secretKey)\n    if err != nil {\n        panic(err)\n    }\n    fmt.Println("Generated token:", tokenString)\n\n    // 3. Verification and parsing of the token\n    parsedToken, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {\n        // Check that the signing method is HMAC\n        if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {\n            return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])\n        }\n        return secretKey, nil\n    })\n\n    if err != nil {\n        panic(err)\n    }\n\n    // 4. Extracting claims\n    if claims, ok := parsedToken.Claims.(jwt.MapClaims); ok && parsedToken.Valid {\n        fmt.Printf("User ID: %v\\n", claims["user_id"])\n        fmt.Printf("Role: %v\\n", claims["role"])\n    } else {\n        fmt.Println("Token is invalid")\n    }\n}

Main Methods and Functions

Let's look at the key me