auth.gawaak.ovh

Zero-registration Google sign-in for *.gawaak.ovh. Your app's origin is its client id — nothing to configure, ever.

Live demo of the exact flow your apps get.

Browser — two lines

<script src="https://auth.gawaak.ovh/auth.js"></script>
<a href="#" onclick="auth.startSignIn(); return false">Login</a>

auth.ready resolves after the callback; then auth.claims(), auth.token(), auth.signOut().

Go backend — three lines

v := verify.New("https://auth.gawaak.ovh", baseURL)   // github.com/znoraka/auth/verify
mux.Handle("/api/", v.Middleware(api))
claims := verify.FromContext(r.Context())            // claims.Sub, claims.Email

How it works

OAuth 2.0 + PKCE (S256 only), brokered through one shared Google client.
Issues ES256 id_tokens — verify with plain JWKS, no SDK.
aud is origin:<your app>; sub is a pairwise id, stable per app, uncorrelatable across apps.

Self-hosted, single Go binary · source