🚀 Go2Auth

Ultra-fast, secure magic link authentication for any SaaS app in seconds.

Zero dependencies • Zero SDKs • JWT-free • GDPR-ready

Quickstart • The Authentication Flow • Webhooks & Backend Integration • Privacy & Security

---

💡 What is Go2Auth?

Go2Auth is a closed, zero-dependency authentication ecosystem. We do not use SDKs, third-party code, JWTs, or external authentication providers. The entire workflow operates strictly within our isolated infrastructure.

You don't need to install heavy client-side packages. Authentication is handled through simple HTML links, secure cookies, and instant signed webhooks sent directly to your backend.

---

⚡ Quickstart

1. Initiating Login / Logout

Integrate login and logout directly into your frontend using simple HTML links with your public API key:

<!-- Login Link -->
<a href="https://go2auth.com/auth/login?pk=YOUR_PUBLIC_API_KEY">
  Sign In with Magic Link
</a>

<!-- Logout Link -->
<a href="https://go2auth.com/auth/logout?pk=YOUR_PUBLIC_API_KEY">
  Sign Out
</a>

2. Session Management

Once authenticated, Go2Auth sets a secure, domain-specific HTTP-only cookie valid for 30 days on the client.

Subsequent logins can bypass email delivery entirely by authenticating directly through the existing session cookie while still dispatching secure webhooks to your backend.

---

🔄 The Authentication Flow

The workflow outlines how authentication and session termination function step by step:

1. Step 1: Initiation The user clicks the login or logout link. The API key is sent to the secure Go2Auth server while the rate limiter evaluates and protects the operation against bots.

2. Step 2: Verification & Transit A first-time login verifies the email hash and sends a minimal plain-text magic link. Upon clicking the link, the plaintext email is transiently passed to your backend via webhook.

   For logout, the active session is destroyed instantly.

3. Step 3: Session Proxy Go2Auth sets or clears a secure, signed HTTP-only cookie.

4. Step 4: Webhook Dispatch Go2Auth notifies your backend through a signed POST request containing the user identity, action type (login or logout), and quota data.

---

🛡️ Webhooks & Backend Integration

When a user authenticates or logs out, Go2Auth notifies your system through a POST request.

• Security: Always store your WEBHOOK_SECRET_KEY in environment variables. Never hardcode it.
• Signature Header: X-Signature
• Signature Algorithm: HMAC-SHA256
• Diagnostics: For testing and real-time validation of webhook payloads, you can use Webhook.site.

Payload Structure

POST /your-webhook-endpoint
X-Signature: [secret_signature_value]

{
  "email": "user@domain.com",
  "action": "login/logout",
  "quota": "1499"
}

---

💻 Backend Implementation Examples

PHP

<?php

$payload = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_SIGNATURE'] ?? '';
$secret = getenv('WEBHOOK_SECRET_KEY');

$expected = hash_hmac('sha256', $payload, $secret);

if (hash_equals($expected, $signature)) {
    $data = json_decode($payload, true);

    $email = $data['email'] ?? '';
    $action = $data['action'] ?? ''; // 'login' or 'logout'
    $quota = $data['quota'] ?? 0;

    // Process data...

    http_response_code(200);
} else {
    http_response_code(401);
}

Node.js (Express)

const express = require('express');
const crypto = require('crypto');

const app = express();

app.post(
    '/webhook',
    express.text({ type: 'application/json' }),
    (req, res) => {
        const signature = req.headers['x-signature'];
        const secret = process.env.WEBHOOK_SECRET_KEY;

        const hmac = crypto.createHmac('sha256', secret);
        const digest = hmac.update(req.body).digest('hex');

        if (crypto.timingSafeEqual(
            Buffer.from(signature || ''),
            Buffer.from(digest)
        )) {
            const data = JSON.parse(req.body);

            const { email, action, quota } = data;

            // Process data...

            res.sendStatus(200);
        } else {
            res.sendStatus(401);
        }
    }
);

Python (Flask)

import os
import hmac
import hashlib

from flask import Flask, request, abort

app = Flask(__name__)

WEBHOOK_SECRET = os.getenv(
    "WEBHOOK_SECRET_KEY"
).encode()


@app.route('/webhook', methods=['POST'])
def webhook():
    signature = request.headers.get('X-Signature', '')
    payload = request.get_data()

    expected = hmac.new(
        WEBHOOK_SECRET,
        payload,
        hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(expected, signature):
        abort(401)

    data = request.get_json()

    email = data.get("email")
    action = data.get("action")  # 'login' or 'logout'
    quota = data.get("quota")

    # Process data...

    return "OK", 200

Go

func webhookHandler(w http.ResponseWriter, r *http.Request) {
    body, _ := io.ReadAll(r.Body)

    signature := r.Header.Get("X-Signature")
    secret := os.Getenv("WEBHOOK_SECRET_KEY")

    mac := hmac.New(
        sha256.New,
        []byte(secret),
    )

    mac.Write(body)

    expected := hex.EncodeToString(
        mac.Sum(nil),
    )

    if !hmac.Equal(
        []byte(expected),
        []byte(signature),
    ) {
        w.WriteHeader(http.StatusUnauthorized)
        return
    }

    var payload struct {
        Email  string `json:"email"`
        Action string `json:"action"`
        Quota  string `json:"quota"`
    }

    json.Unmarshal(body, &payload)

    // Process payload...

    w.WriteHeader(http.StatusOK)
}

---

🔒 Privacy & Security First

• Zero Plaintext Emails Email addresses are never stored as plaintext in our database. They are processed using one-way cryptographic salted hashing.

• Transit Email Model Plaintext email addresses only appear transiently during the initial authentication phase so your backend can identify and map the user.

• Reduced Phishing Surface Keeping authentication messages minimal and handling identity data only during transit helps reduce unnecessary tracking and attack vectors.

• Minimal Attack Surface Go2Auth acts as a lightweight session proxy, helping keep your main application database isolated from authentication infrastructure.

---

🚀 Authentication without SDKs. Without JWTs. Without unnecessary complexity.

Go2Auth — Magic link authentication in seconds.