OAuth 2.0 and JWT Authorization in Go: A Complete Guide for Beginners

Introduction: Why Do You Need OAuth 2.0 and JWT in Go?

Modern web development is unthinkable without secure authentication and authorization. If you are writing your first API, microservice, or web application in Go (Golang), sooner or later you will face the need to protect user data. Two standards — OAuth 2.0 and JWT (JSON Web Token) — have become the gold standard in this area.

In this article, we will break down how OAuth 2.0 and JWT work and write a simple but working implementation in Go. You will learn how to issue access tokens, verify them, and protect your endpoints. The article is aimed at beginner developers familiar with the basics of Go and HTTP.

What Are OAuth 2.0 and JWT? In Simple Terms

OAuth 2.0 — Delegated Access Protocol

OAuth 2.0 is not a library or a function, but a protocol. Imagine you want to log into a website using Google. OAuth 2.0 allows the website to obtain limited access to your data (e.g., email) from Google without you having to give it your Google password. This is called "delegated access."

The main roles in OAuth 2.0 are:

• Resource Owner — the user (you).
• Client — the application that wants to gain access (our website).
• Authorization Server — the server that issues tokens (Google).
• Resource Server — the server with the user's data (Google API).

JWT — Token Format

JWT (JSON Web Token) is a compact and self-contained way to transmit information between parties as a JSON object. It consists of three parts separated by dots:

• Header — the token type and signing algorithm (e.g., HS256).
• Payload — the data (claims): user ID, role, expiration time.
• Signature — a signature that guarantees the token has not been altered.

JWT is often used as an Access Token in OAuth 2.0. The server signs the token with a secret key, and the client sends it in the Authorization: Bearer <token> header.

Practice: Implementing JWT Authorization in Go

We will write a small HTTP server in Go that will issue JWT tokens and verify them on protected routes. To work with JWT, we will use the popular library github.com/golang-jwt/jwt/v5.

Step 1: Installing Dependencies and Project Structure

Create a new module and install the library:

go mod init auth-examplego get github.com/golang-jwt/jwt/v5go get golang.org/x/crypto

The file structure will be simple:

• main.go — entry point and routes.
• auth.go — logic for creating and verifying JWT.
• handlers.go — HTTP handlers.

Step 2: Creating a JWT Token

Let's create the file auth.go. Here we will define the secret key (in a real project, store it in .env) and a function for generating the token.

package main

import (    "time"    "github.com/golang-jwt/jwt/v5")

var jwtSecret = []byte("your-secret-key-here")

type Claims struct {    UserID   int    `json:"user_id"`    Username string `json:"username"`    jwt.RegisteredClaims}

func GenerateToken(userID int, username string) (string, error) {    claims := Claims{        UserID:   userID,        Username: username,        RegisteredClaims: jwt.RegisteredClaims{            ExpiresAt: jwt.NewNumericDate(time.Now().Add(24 * time.Hour)),            IssuedAt:  jwt.NewNumericDate(time.Now()),            Issuer:    "auth-example",        },    }

    token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)    return token.SignedString(jwtSecret)}