appkit

appkit is a composable Go toolkit for HTTP applications. It keeps application-owned concerns—users, persistence, authorization, and business policy—outside the toolkit while providing well-defined boundaries for configuration, identity, sessions, logging, encryption, and HTTP serving.

Start with the quickstart to assemble a small application, then select the authentication and deployment guides that match your environment. Appkit provides contracts and secure defaults; your application remains the authority for user records, persistence, and authorization rules.

Start here

• Quickstart: wire flags, logging, and independent application and management listeners.
• Configuration: register reusable deployment flag groups without handing control of application policy to the toolkit.
• HTTP server: mount application and operational routes safely.

Identity and access

• Local authentication: authenticate passwords with an application-owned credential store.
• Trusted proxy: configure a safe reverse-proxy identity boundary.
• OIDC: verify OpenID Connect identities before creating application sessions.
• Sessions: persist hashed, opaque browser sessions.
• Middleware and authorization: attach a user to a request and enforce authentication or policy.

Application services

• Secrets: encrypt deployment-managed application settings.
• Single-page applications: serve an embedded SPA with browser-navigation fallback.

Packages

• auth defines the application-independent authentication contracts.
• config registers reusable deployment flag groups.
• httpauth supplies authentication and authorization middleware.
• httpserver composes application and operational HTTP handlers.
• secrets encrypts application settings with a deployment-managed key.