Skip to content
Scalekit Docs
Talk to an Engineer Dashboard
DEVELOPER KIT
Tools and examples to accelerate your integration
Build with AIIntegrate auth with AI coding agents
Reference & toolingImplement auth with SDKs, REST APIs, OpenAPI specs, and Postman collections
Testing UtilitiesTest and debug auth integrations locally
RESOURCES
Guides, references, and community resources
IntegrationsConnect external identity providers and platforms
WorkflowsAutomate user lifecycle and auth events with webhooks
CookbooksImplement common patterns with step-by-step recipes
Code SamplesCopy and adapt code examples by language

Go SDK

Install

GitHub
go get -u github.com/scalekit-inc/scalekit-sdk-go
v2.9.0Thread-safeZero dependenciesUpdated 1 week ago

Initialize

Initialize the client
package main


import (
    "os"
    "github.com/scalekit-inc/scalekit-sdk-go/scalekit"
)


func main() {
    scalekitClient := scalekit.NewScalekitClient(
        os.Getenv("SCALEKIT_ENVIRONMENT_URL"),
        os.Getenv("SCALEKIT_CLIENT_ID"),
        os.Getenv("SCALEKIT_CLIENT_SECRET"),
    )
    // Use scalekitClient for authentication
}

Changelog

View all releases →
v2.9.0

What's Changed

New Contributors

Full Changelog: v2.8.0...v2.9.0

v2.8.0

What's Changed

  • [SK-1339] feat: typed UpdateLoginUserDetails response, issuer validation, listEventsPaginated by @AkshayParihar33 in #88

Full Changelog: v2.7.0...v2.8.0

v2.7.0

What's Changed

Full Changelog: v2.6.0...v2.7.0

v2.5.0

What's Changed

Full Changelog: v2.4.0...v2.5.0

v2.4.0

Added

  • Multi-app client management support with Client() APIs for client CRUD and client secret management.
  • PKCE helper support via GeneratePKCEConfiguration(...) for public client authorization flows.
  • WithSecret(...) to derive a secret-enabled client without mutating the original client.
  • ValidateTokenWithOptions(...) with audience and scope validation support.

Changed

  • NewScalekitClient(...) now supports initialization without a client secret for public clients while preserving backward compatibility.
  • GenerateClientToken(...) now accepts structured options and returns token metadata.
  • RefreshAccessToken(...) now includes id_token in the response.
  • SDK and API versions were updated, along with regenerated gRPC/Connect client code.

Fixed

  • AuthenticateWithCode(...) and RefreshAccessToken(...) now send client_secret only when configured.
  • Clear fail-fast errors are now returned when authenticated API calls require a client secret but none is configured.
v2.3.0
  • Document DeleteMembership cascade param
  • feat: add DeleteRoleBase for env-level role inheritance removal
  • feat: change ListPermissions signature to accept pageToken and pageSize
  • feat add global ListUsers to Go UserService interface
  • feat: add ValidateToken, GenerateClientToken, GetClientAccessToken to Scalekit interface
  • chore: bump version to 2.3.0, api-version to 20260310
  • fix: surface deleteEnvRole failures instead of swallowing them
v2.2.0

Release Notes v2.2.0

Release date: 2026-03-06
Previous release: v2.1.0 (2026-02-24)

PRs included in this release

# Title
#45 API tokens
#50 chore: add CODEOWNERS
#58 Structured error handling, sentinel errors, and thread-safe client

New Features

API Token Management (token.go)

A new TokenClient is available on ScalekitClient for managing API tokens programmatically:

  • Create tokens - user-scoped or machine tokens with optional expiry
  • List tokens - filter by user ID or token type
  • Revoke/delete tokens - revoke individual tokens or all tokens for a user
  • Validate tokens - validate a raw token string; returns structured claims
// Example
token, err := client.Token().CreateToken(ctx, scalekit.CreateTokenOptions{...})

Structured Error Handling

Non-2xx HTTP responses are now surfaced as *scalekit.Error with an inspectable StatusCode field:

var e *scalekit.Error
if errors.As(err, &e) {
    fmt.Println(e.StatusCode) // e.g. 403
}

Sentinel Errors

Callers can now use errors.Is instead of string matching for common failure modes:

Sentinel Condition
ErrTokenRequired empty token passed to ValidateToken
ErrTokenValidationFailed token validation connect error
ErrMissingExpClaim token lacks exp claim
ErrCodeOrLinkTokenRequired missing code/link token
ErrOrganizationIdRequired missing org ID
ErrDirectoryNotFound directory lookup returned nothing

Improvements

Thread Safety

  • accessToken and jsonWebKeySet now use atomic.Pointer with singleflight groups — eliminates data races on concurrent requests.
  • JWKS read lock removed in favour of atomic load.

HTTP Client Hardening

  • A 10s default timeout is attached to every outbound request via withDefaultTimeout. Callers with their own context.Deadline are unaffected.
  • Auth retry is now scoped to genuine 401 / CodeUnauthenticated responses only; authenticateClient failures are propagated instead of silently ignored.

API Version Header

  • x-api-version header updated to 20260226.

Breaking Changes

None. A potentially breaking change (removal of external ID field) was reverted before this release. All existing method signatures remain compatible with v2.1.0.

Internal / Chore

  • Added .github/CODEOWNERS to enforce required reviews on all PRs (owners: @AkshayParihar33, @dhawani).
  • Proto stubs regenerated from source; ListTokensRequest.UserId changed to *string pointer.
  • go.mod updated.

Upgrade

go get github.com/scalekit-inc/scalekit-sdk-go/v2@v2.2.0
v2.1.0

v2.1.0

⚠️ Breaking Changes

All methods that make network calls now require a context.Context as the first argument to support cancellation or timeout propagation.

Method Old Signature New Signature
AuthenticateWithCode (code, redirectUri, options) (ctx, code, redirectUri, options)
ValidateAccessToken (accessToken) (ctx, accessToken)
GetAccessTokenClaims (accessToken) (ctx, accessToken)
GetIdpInitiatedLoginClaims (token) (ctx, token)
RefreshAccessToken (refreshToken) (ctx, refreshToken)
ValidateToken (token, jwksFn) (ctx, token, jwksFn)

Migration: Pass ctx as the first argument.

// Before
scalekitClient.AuthenticateWithCode(token)

// After
scalekitClient.AuthenticateWithCode(ctx, token)

✨ New Features

  • Connection.CreateConnection — programmatically create SSO connections for an organization
  • Connection.DeleteConnection — delete an existing SSO connection
  • Directory.CreateDirectory — programmatically create a directory for an organization
  • Directory.DeleteDirectory — delete an existing directory