Limen: A Composable Plugin-First Authentication Library for Go

I couldn’t find Better Auth in Go, so I built one

Brian Iyoha has released Limen, an open-source authentication library designed to bring a high-level developer experience to the Go ecosystem. The system features a plugin-first architecture that supports over 10 social sign-on providers and built-in rate limiting.

Why This Matters

Go developers typically face a trade-off between low-level primitives requiring extensive manual assembly and opinionated frameworks that restrict application structure. Limen provides a middle ground by offering a composable, production-ready system that handles sessions and OAuth while remaining compatible with any database or router that supports the standard http.Handler interface.

Key Insights

• Limen utilizes a plugin-first approach where authentication methods like credential-password live as separate Go modules (Iyoha, 2026).
• The library supports over 10 social sign-on providers and includes two-factor authentication and session management out of the box.
• Limen is designed to integrate directly into existing Go applications rather than functioning as a separate, external service.
• Built-in rate limiting and database adapters allow Limen to fit into various backend stacks including GORM and standard net/http.
• The system is compatible with major Go web frameworks such as Gin, Chi, and Echo via the standard http.Handler interface.

Working Examples

Installing the core package, GORM adapter, and password plugin.

go get github.com/thecodearcher/limen github.com/thecodearcher/limen/adapters/gorm github.com/thecodearcher/limen/plugins/credential-password

Configuring Limen with a database adapter and plugins.

auth, err := limen.New(&limen.Config{BaseURL: "http://localhost:8080", Database: gormadapter.New(db), Plugins: []limen.Plugin{credentialpassword.New()}})

Mounting the Limen handler into a standard Go HTTP multiplexer.

mux := http.NewServeMux(); mux.Handle("/api/auth/", auth.Handler())

Practical Applications

• Self-Contained SaaS Backends: Integrating authentication directly into the application logic to maintain full control over the data model and credential storage. Pitfall: Using hosted auth providers that separate user data from the primary application database.
• Multi-Provider OAuth Integration: Rapidly deploying social logins across 10+ providers using a unified modular interface. Pitfall: Manually implementing disparate OAuth flows which leads to fragmented session handling and increased maintenance debt.

References:

• https://dev.to/thecodearcher/i-couldnt-find-better-auth-in-go-so-i-built-one-4d75