go-jwt-middleware

go-jwt-middleware is Auth0's bouncer for Go APIs: wrap a handler, and any request without a valid, correctly signed JSON Web Token gets a 401 before your code runs. It isn't tied to Auth0. Any issuer that publishes signing keys works, Okta or your own included. MIT licensed, free.

Use v3: go get github.com/auth0/go-jwt-middleware/v3. It shipped January 2026, reached v3.4 in October, moved to the lestrrat-go/jwx library and added gRPC interceptors and DPoP proof-of-possession tokens. It also caches key fetches, handles multi-tenant issuers and ships Gin, Echo and Iris examples. The README says Go 1.24+, but go.mod has required Go 1.25 since v3.2. v2 last shipped in November 2025.

Versus golang-jwt directly: golang-jwt parses and verifies tokens, then you add keyfunc for key sets and write the middleware and error responses yourself. Fine for one internal service signing its own tokens. Trusting an outside identity provider? This saves the boilerplate. Free at every team size; your identity provider is the bill.

The catch: DPoP doesn't track proof IDs yet, so a captured proof can be replayed for about five minutes unless you record jti values yourself. Auth0 documents it plainly. Read it before claiming DPoP on a security review.