Case study
Auth SaaS with Go — case study
Why I built a self-hostable auth service in Go over gRPC, the decisions behind it, and what I would do differently.
Every product I had worked on rebuilt the same thing: signup, login, tokens, OAuth2. Each time slightly differently, each time with the same class of bugs. This project is my answer — an auth service you deploy once, self-host with one docker run, and talk to over gRPC from any backend.
The problem
Authentication is the part of a system where "mostly correct" is not good enough, and also the part teams are most tempted to rush. I wanted a service that:
- issues and validates tokens for other services, so business backends never touch credentials;
- speaks OAuth2 for third-party flows;
- can be self-hosted by anyone — no vendor, no metered pricing, just a container and a Postgres.
Decision 1 — gRPC at the core
Auth is an internal, service-to-service concern. The consumers of this API are other backends, not browsers. gRPC gives me a typed contract (protobuf) that client services compile against, instead of a REST API where every consumer re-implements the same fragile client code. The HTTP surface you see in the live docs exists for exploration and integration testing; the contract is the proto file.
Decision 2 — Postgres as the account store
The account store is the part of an auth system you cannot get wrong. I keep it boring on purpose: a normalized Postgres schema, constraints in the database rather than only in application code, and migrations checked into the repo. Most of the difficult decisions in this project were schema decisions — which is true of most backend systems I've worked on.
Decision 3 — packaged for self-hosting from day one
"Self-hostable" is a design constraint, not a deployment afterthought. It forces the service to be configuration-complete through environment variables, to have no hidden dependencies, and to start from a single Docker image. That constraint kept the architecture honest: if it can't run on someone else's laptop, it's not done.
What I'd do differently
A case study without regrets is marketing. The honest list is in progress — ask me about token revocation.
Try it
- Live API docs: auth-service-go.onrender.com/docs (free-tier hosting — first load may take a few seconds to wake up)
- Source: github.com/MihajasoaAlain/auth-service-go