How to Add Authentication to a Go API

// Service auth validates API keys for every endpoint marked "auth".
package auth

import (
	"context"
	"crypto/sha256"
	"encoding/hex"
	"errors"

	"encore.dev/beta/auth"
	"encore.dev/beta/errs"
	"encore.dev/storage/sqldb"
)

var db = sqldb.NewDatabase("auth", sqldb.DatabaseConfig{
	Migrations: "./migrations",
})

// UserData is available to handlers via auth.Data().
type UserData struct {
	Email string `json:"email"`
	Plan  string `json:"plan"`
}

// AuthHandler runs before every endpoint that requires auth.
// Encore reads the token from the Authorization: Bearer header.
//
//encore:authhandler
func AuthHandler(ctx context.Context, token string) (auth.UID, *UserData, error) {
	sum := sha256.Sum256([]byte(token))
	var (
		uid  string
		data UserData
	)
	err := db.QueryRow(ctx, `
		SELECT user_id, email, plan FROM api_keys
		WHERE key_hash = $1 AND revoked_at IS NULL`,
		hex.EncodeToString(sum[:]),
	).Scan(&uid, &data.Email, &data.Plan)
	if errors.Is(err, sqldb.ErrNoRows) {
		return "", nil, &errs.Error{Code: errs.Unauthenticated, Message: "invalid api key"}
	} else if err != nil {
		return "", nil, err
	}
	return auth.UID(uid), &data, nil
}

CREATE TABLE api_keys (
    key_hash   TEXT PRIMARY KEY,
    user_id    TEXT NOT NULL,
    email      TEXT NOT NULL,
    plan       TEXT NOT NULL DEFAULT 'free',
    revoked_at TIMESTAMPTZ
);

-- Seed a local key: the SHA-256 of "dev-key-123".
INSERT INTO api_keys (key_hash, user_id, email, plan) VALUES
  (encode(sha256('dev-key-123'), 'hex'), 'user_1', 'ada@example.com', 'pro');

// Service account serves endpoints for signed-in users.
package account

import (
	"context"

	"encore.app/auth"
	encauth "encore.dev/beta/auth"
)

type Me struct {
	UserID string `json:"userId"`
	Email  string `json:"email"`
	Plan   string `json:"plan"`
}

// GetMe requires a valid API key; Encore rejects the call before it runs otherwise.
//
//encore:api auth method=GET path=/me
func GetMe(ctx context.Context) (*Me, error) {
	uid, _ := encauth.UserID()
	data := encauth.Data().(*auth.UserData)
	return &Me{UserID: string(uid), Email: data.Email, Plan: data.Plan}, nil
}

type ctxKey struct{}

type User struct {
	ID, Email, Plan string
}

func requireKey(db *pgxpool.Pool, next http.HandlerFunc) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		token, ok := strings.CutPrefix(r.Header.Get("Authorization"), "Bearer ")
		if !ok || token == "" {
			http.Error(w, "missing api key", http.StatusUnauthorized)
			return
		}
		sum := sha256.Sum256([]byte(token))
		var u User
		err := db.QueryRow(r.Context(), `
			SELECT user_id, email, plan FROM api_keys
			WHERE key_hash = $1 AND revoked_at IS NULL`,
			hex.EncodeToString(sum[:]),
		).Scan(&u.ID, &u.Email, &u.Plan)
		if err != nil {
			http.Error(w, "invalid api key", http.StatusUnauthorized)
			return
		}
		next(w, r.WithContext(context.WithValue(r.Context(), ctxKey{}, u)))
	}
}

func userFrom(ctx context.Context) User {
	u, _ := ctx.Value(ctxKey{}).(User)
	return u
}

// mux.HandleFunc("GET /me", requireKey(pool, getMe))