Who limen is for#
API developers building SaaS platforms in Go
Limen handles credential-password, OAuth, and session management for multi-tenant SaaS backends without per-user fees. The TypeScript client SDK integrates with React, Vue, or Svelte frontends. Database adapters let you store auth data alongside application data in PostgreSQL or MySQL, simplifying data governance and backup strategies.
Skip if:
You need enterprise SSO (SAML) or directory sync (SCIM) out of the box. Limen focuses on OAuth 2.0, OIDC, and credential flows. Enterprise identity federation requires custom implementation or a commercial provider.
Go microservices teams consolidating auth logic
Deploy Limen as a shared authentication service across multiple Go microservices. The plugin architecture lets you standardize on one auth implementation while each service imports only the plugins it needs. Framework-agnostic design works whether your services use Gin, Chi, or Echo.
Skip if:
Your microservices are polyglot (mixed languages). Limen is Go-only on the backend. If your services span Go, Node.js, and Python, a language-agnostic auth service like Ory or Keycloak may fit better.
Teams migrating from Auth0 or Clerk to cut costs
Limen replicates the core feature set of Auth0 and Clerk (password auth, social login, sessions, two-factor) without monthly per-user billing. For a SaaS with 50k monthly active users, Auth0 costs $1,050/month on the Professional plan. Limen costs the price of a $20/month VPS, saving $12k annually.
Skip if:
You rely on Auth0's advanced features like bot detection, breached password detection, or anomaly detection. Limen covers authentication flows but not the fraud prevention and threat intelligence layers that managed platforms provide.
Solo developers and bootstrapped startups
Limen provides production-grade authentication without the recurring cost of managed services. The MIT license means no usage limits, no credit card required, and no pricing tier surprises as you grow. Self-hosting on a $5/month VPS is viable for early-stage products with under 10k users.
Skip if:
You are non-technical or lack Go experience. Limen requires writing Go integration code, managing database migrations, and deploying a Go application. If you need a no-code auth solution, a managed service like Supabase Auth or Firebase is faster to ship.
The problem it solves#
Authentication in Go is repetitive and expensive. Every new project requires rewriting session management, OAuth flows, password hashing, and security primitives from scratch. Commercial authentication platforms like Auth0, Clerk, and WorkOS solve the complexity problem but introduce vendor lock-in, per-user pricing that scales unpredictably, and data sovereignty concerns. Self-hosted alternatives like Ory Kratos require dedicated infrastructure, complex deployment configurations, and learning curves that delay shipping. Most Go developers either spend weeks building custom auth or pay monthly fees that compound as their user base grows, with no middle ground for teams that want control without the infrastructure burden.
How it solves it#
Plugin-first modular architecture
The core library ships interfaces, session management, and security primitives. Authentication methods like credential-password, OAuth, two-factor, and magic links live in separate Go modules that you import only when needed. This keeps your binary small and your dependencies minimal. If you only need password auth, you pull one plugin. If you add OAuth later, you import the OAuth module without touching existing code.
Framework-agnostic design
Works with any Go framework that supports the standard net/http package, including Gin, Chi, Echo, Fiber, and plain http.ServeMux. You mount Limen's handler at /auth/ and it integrates with your routing layer without framework-specific adapters. No vendor lock-in at the framework level. Migration between frameworks does not require rewriting authentication logic.
Database adapter pattern
Bring your own database. Adapters exist for GORM (PostgreSQL, MySQL, SQLite) and database/sql. If you use a different ORM or data layer, write your own adapter by implementing the storage interface. Your auth data lives in your existing database schema, not in a separate service or external provider.
TypeScript client SDK
The npm package limen-auth provides a fully typed TypeScript client for frontend integration. Handles sign-in, session management, and reactive session state with hooks for React, Vue, Svelte, and Solid. Your backend and frontend authentication code stay in sync through shared types, reducing integration bugs.
OAuth and social login support
Comprehensive OAuth 2.0 and OpenID Connect support with first-party providers for Google, GitHub, Apple, and any OAuth 2.0 or OIDC provider. Provider configuration is declarative. Add a new social login by importing the provider module and passing credentials. No external OAuth proxy required.
Built-in session management and route guards
Session storage, CSRF protection, secure cookie handling, and route guards ship in the core. Sessions are signed and encrypted by default. Rate limiting and security middleware are included, not bolted on. You configure session duration and renewal policies without implementing cryptographic primitives yourself.
Strengths and trade-offs#
Strengths
- MIT license with no usage limitsLimen is MIT licensed, so you can deploy it commercially, modify the source, and scale to any user count without licensing fees or per-user pricing. Unlike Auth0 (starts at $25/month, scales per MAU) or Clerk ($25/month for 10k MAUs), your authentication cost is fixed at server hosting regardless of traffic.
- Modular design prevents dependency bloatOnly the plugins you import get compiled into your binary. If you use password auth without OAuth, the OAuth dependencies never enter your build. This keeps binary size small and attack surface minimal. Contrast this with monolithic auth libraries where every feature ships whether you use it or not.
- Active development and recent commitsLast commit on 2026-08-11, created in August 2025, showing active maintenance. The library is under a year old but already supports credential-password, OAuth, two-factor, magic links, and multi-tenant patterns. GitHub shows 505 stars, 20 forks, and only 3 open issues, indicating clean implementation and responsive maintainers.
- No external service dependenciesAuthentication logic runs entirely in your application process. No separate auth service to deploy, no external API calls to a managed platform, no network hops for session validation. Latency stays low, and downtime risk is isolated to your own infrastructure, not a third-party SaaS.
Trade-offs
- -Newer library with smaller ecosystemLimen launched in August 2025, making it under a year old. While actively maintained, the community is smaller than established Go auth libraries like Ory or Authboss. Fewer community plugins, integrations, and Stack Overflow answers exist. Early adopters should expect to read source code for advanced use cases rather than relying on extensive documentation.
- -Self-assembly required for advanced workflowsLimen provides the building blocks but leaves orchestration to you. Multi-step flows like email verification with password reset, account linking across OAuth providers, or admin-initiated user provisioning require composing multiple plugins and writing glue code. Managed platforms like Auth0 ship these workflows as turnkey features.
- -Database migration responsibilitySchema changes for auth tables (users, sessions, accounts) are your responsibility. The GORM adapter auto-migrates tables, but production schema evolution, zero-downtime migrations, and rollback plans are on you. Managed auth services handle schema changes transparently in their infrastructure.
limen vs alternatives#
Limen vs Auth0
Auth0 is a managed authentication platform with per-user pricing. Limen is a self-hosted Go library with no usage fees.
| Feature | Limen | Auth0 |
|---|---|---|
| License | MIT | Proprietary |
| Self-hosting | Yes | No |
| Cost model | Server hosting only | Subscription with per-user pricing |
| OAuth providers | Google, GitHub, Apple, custom OIDC | 30+ social providers |
| Two-factor auth | TOTP, backup codes | SMS, TOTP, push, WebAuthn |
| Deployment | Runs in your Go app | Managed SaaS |
Limen is the better choice when you need full control over authentication data, want to avoid per-user pricing that scales with growth, or require running authentication logic inside your application process for low latency. Self-hosting means your auth data never leaves your infrastructure, satisfying data residency and compliance requirements without vendor agreements.
Auth0 wins when you need enterprise SSO (SAML, WS-Federation), advanced bot detection, breached password databases, or turnkey integrations with 30+ social providers without writing OAuth configuration code. Auth0's managed infrastructure removes deployment and maintenance burden, which matters for teams without Go expertise or server operations capacity.
Limen vs Ory Kratos
Ory Kratos is a standalone identity server written in Go. Limen is a library you import into your existing Go application.
| Feature | Limen | Ory Kratos |
|---|---|---|
| License | MIT | Apache 2.0 |
| Architecture | Library (imported) | Standalone service |
| Deployment | Runs in your app | Separate Docker container |
| Database | Any via adapters | PostgreSQL, MySQL, CockroachDB |
| Framework | Any net/http compatible | Framework-agnostic (REST API) |
| Configuration | Go structs | JSON/YAML identity schema |
Limen fits Go projects that want authentication as a library dependency, not a separate service. You avoid the operational complexity of deploying, scaling, and monitoring a standalone identity server. Database migrations happen in your existing migration tooling. Session validation is a function call, not a network request to a sidecar.
Ory Kratos is better when you need a language-agnostic authentication service that multiple applications (Go, Node.js, Python) can share. Kratos exposes a REST API, so polyglot backends integrate without language-specific SDKs. If you are building a microservices architecture with mixed languages, Kratos's service-oriented design avoids duplicating auth logic per language.
Limen vs Supabase Auth
Supabase Auth is PostgreSQL-specific and tightly integrated with Supabase's ecosystem. Limen is database-agnostic and framework-agnostic.
| Feature | Limen | Supabase Auth |
|---|---|---|
| License | MIT | MIT (part of Supabase) |
| Database support | PostgreSQL, MySQL, SQLite | PostgreSQL only |
| Ecosystem | Standalone Go library | Requires Supabase stack |
| Self-hosting | Runs in your app | Requires full Supabase self-host |
| TypeScript client | Yes (npm package) | Yes (part of Supabase SDK) |
Limen is better when you are building a Go backend and want authentication without adopting the full Supabase stack (PostgREST, Realtime, Storage). You bring your own database, your own ORM, and your own API design. Limen imposes no architectural constraints beyond net/http compatibility.
Supabase Auth wins when you are already using PostgreSQL and want a turnkey backend (database, auth, storage, realtime subscriptions) with minimal setup. If you are building a frontend-heavy application and want a batteries-included BaaS, Supabase's integrated auth is faster than assembling components yourself. Self-hosting Supabase Auth in isolation is possible but requires running the full Supabase Docker stack, which is heavier than a single Go binary.
Install and self-host#
Limen requires Go 1.25 or later. Install the core library, then add the database adapter and auth plugins your backend needs.
```bash
go get github.com/thecodearcher/limen
go get github.com/thecodearcher/limen/adapters/gorm
go get github.com/thecodearcher/limen/plugins/credential-password
```
Configure Limen with your database connection and plugins, then mount the handler at `/auth/` in your router:
```go
auth, err := limen.New(&limen.Config{
BaseURL: "http://localhost:8080",
Database: gormadapter.New(db),
Secret: []byte("your-32-byte-secret-key"),
Plugins: []limen.Plugin{
credentialpassword.New(),
},
})
mux := http.NewServeMux()
mux.Handle("/api/auth/", auth.Handler())
```
Alternatively, set the `LIMEN_SECRET` environment variable and omit the Secret field. Full configuration options and examples are at limenauth.dev.What it's built on#
- Languages
- GoTypeScript
- Frameworks
- ReactSvelteVue
- Infrastructure
- OAuth 2.0
FAQ#
Is Limen free to use?
Yes, Limen is MIT licensed and free to use commercially with no restrictions. The self-hosted version has no user limits, no feature tiers, and no paid upgrades. You pay only for the server hosting your Go application. Unlike managed auth platforms that charge per monthly active user, Limen's cost is fixed regardless of scale.
How does Limen compare to Ory Kratos or Supabase Auth?
Limen is a Go library you import into your application, while Ory Kratos is a standalone service you deploy separately. Kratos requires Docker, PostgreSQL, and learning Ory's identity schema DSL. Limen integrates directly into your existing Go codebase with standard database adapters. Supabase Auth is PostgreSQL-specific and tightly coupled to Supabase's ecosystem. Limen works with any database via adapters and any Go framework via net/http.
Does Limen work with Gin, Echo, Fiber, or Chi?
Yes, Limen is framework-agnostic and works with any Go framework that supports net/http. You mount Limen's handler at a path like /auth/ and it handles authentication routes without framework-specific adapters. The documentation includes examples for Gin, Chi, Echo, and Fiber. Plain http.ServeMux also works.
Can I use Limen with an existing database schema?
Yes, but you need to implement a custom storage adapter. Limen's GORM adapter auto-migrates default tables for users, sessions, accounts, and verification tokens. If your schema differs, write an adapter that implements the storage interface. The interface methods map cleanly to standard CRUD operations, so adapter code is typically under 200 lines.
What authentication methods does Limen support?
Limen supports credential-password (email or username plus password with secure hashing), OAuth 2.0 and OpenID Connect (Google, GitHub, Apple, and any OIDC provider), two-factor authentication (TOTP and backup codes), magic links (passwordless email login), and API keys. Multi-tenant patterns are supported. Each method is a separate plugin you import only if needed.
Similar open-source tools#
Neovim
Hyperextensible Vim-based editor with Lua plugin support
Modelence
Full-stack framework for building production-ready web apps
CodeEdit
Native Swift code editor for macOS with no Electron overhead
Better Auth
Drop-in TypeScript auth with MFA, SSO, and multi-tenancy support
Cerbos
Move access control out of app code into testable YAML policies
Falkon
Speed-first browser for KDE Plasma with built-in ad blocking