--- title: "theAuth examples: Go and TypeScript, with run commands" description: "Every runnable example in the theauth-go and theauth repositories, with a one-line description, the command to run it and a GitHub link." canonical: https://theauth.dev/examples/ lastmod: 2026-10-31 --- # Runnable examples for Go and TypeScript Generated from the examples/ directories of [theauth-go](https://github.com/glincker/theauth-go/tree/main/examples) (32) and [theauth](https://github.com/glincker/theauth/tree/main/examples) (19). Run commands from a clone of the repository. Snapshot of main at c1ec752 and 5d81d947, taken 2026-10-31. [Go examples](https://theauth.dev/examples/#go) [TypeScript examples](https://theauth.dev/examples/#typescript) ## Go examples Memory storage keeps most of them dependency free. Examples with their own go.mod run from inside their directory. Start with [single-binary-sqlite](https://github.com/glincker/theauth-go/tree/main/examples/single-binary-sqlite) for a complete app. See the [Go library page](https://theauth.dev/go/) for the install path. ### agent-policy An autonomy denylist enforced as an IAM Deny: the token endpoint refuses to mint a denied action, whatever the agent prompt says. `go run ./examples/agent-policy` [View on GitHub](https://github.com/glincker/theauth-go/tree/main/examples/agent-policy) ### agent-tool-guard A framework-agnostic tool guard: a refund tool runs freely for small amounts and needs a single-use human approval above a threshold. `go run ./examples/agent-tool-guard` [View on GitHub](https://github.com/glincker/theauth-go/tree/main/examples/agent-tool-guard) ### audit-receipts-go A signed audit checkpoint, a portable receipt and a consistency proof over a chained SQLite audit log. `cd examples/audit-receipts-go && go run .` [View on GitHub](https://github.com/glincker/theauth-go/tree/main/examples/audit-receipts-go) ### chi-app Minimal runnable example demonstrating magic-link auth. `cd examples/chi-app && go run .` [View on GitHub](https://github.com/glincker/theauth-go/tree/main/examples/chi-app) ### cli-device-login Sign a CLI in with the RFC 8628 device grant: a short code and URL, approval on any device, and the CLI polls until tokens arrive. `go run ./examples/cli-device-login` [View on GitHub](https://github.com/glincker/theauth-go/tree/main/examples/cli-device-login) ### cli-login A host CLI that authenticates against a theauth-go server with RFC 8628 device login, using the clientauth package. `go run ./examples/cli-login` [View on GitHub](https://github.com/glincker/theauth-go/tree/main/examples/cli-login) ### doctor-admin Serves /healthz publicly and a root-only /admin/security page that renders the report from Doctor, the configuration auditor. `go run ./examples/doctor-admin` [View on GitHub](https://github.com/glincker/theauth-go/tree/main/examples/doctor-admin) ### echo-app theauth-go behind an Echo v4 router, mounted on a chi subrouter and wrapped with echo.WrapHandler. `cd examples/echo-app && go run .` [View on GitHub](https://github.com/glincker/theauth-go/tree/main/examples/echo-app) ### gin-app theauth-go inside a Gin router, mounted on a chi subrouter and wrapped with gin.WrapH. `cd examples/gin-app && go run .` [View on GitHub](https://github.com/glincker/theauth-go/tree/main/examples/gin-app) ### github-actions-oidc GitHub Actions OIDC login, end to end and offline. `go run ./examples/github-actions-oidc` [View on GitHub](https://github.com/glincker/theauth-go/tree/main/examples/github-actions-oidc) ### hooks Wires every Config.LifecycleHooks callback to a log line so you can see when each one fires. `go run ./examples/hooks` [View on GitHub](https://github.com/glincker/theauth-go/tree/main/examples/hooks) ### mcp-server A small MCP resource server built on the separate mcpresource module. `cd examples/mcp-server && go run .` [View on GitHub](https://github.com/glincker/theauth-go/tree/main/examples/mcp-server) ### oauth-apple Sign in with Apple using the provider/apple package. `cd examples/oauth-apple && go run .` [View on GitHub](https://github.com/glincker/theauth-go/tree/main/examples/oauth-apple) ### oauth-bitbucket Sign in with Bitbucket Cloud using the provider/bitbucket package. `cd examples/oauth-bitbucket && go run .` [View on GitHub](https://github.com/glincker/theauth-go/tree/main/examples/oauth-bitbucket) ### oauth-consent A host-owned OAuth consent page that returns a one-hour grant with one scope unticked. Runs in memory with no network. `go run ./examples/oauth-consent` [View on GitHub](https://github.com/glincker/theauth-go/tree/main/examples/oauth-consent) ### oauth-facebook Sign in with Facebook using the provider/facebook package. `cd examples/oauth-facebook && go run .` [View on GitHub](https://github.com/glincker/theauth-go/tree/main/examples/oauth-facebook) ### oauth-gitlab Sign in with GitLab using the provider/gitlab package. `cd examples/oauth-gitlab && go run .` [View on GitHub](https://github.com/glincker/theauth-go/tree/main/examples/oauth-gitlab) ### oauth-linkedin Sign in with LinkedIn using the provider/linkedin package. `cd examples/oauth-linkedin && go run .` [View on GitHub](https://github.com/glincker/theauth-go/tree/main/examples/oauth-linkedin) ### oauth-multi-provider A single theAuth instance wired up with all four OAuth providers shipped by the library: GitHub, Google, Microsoft, and Discord. `cd examples/oauth-multi-provider && go run .` [View on GitHub](https://github.com/glincker/theauth-go/tree/main/examples/oauth-multi-provider) ### oauth-slack Sign in with Slack using the provider/slack package. `cd examples/oauth-slack && go run .` [View on GitHub](https://github.com/glincker/theauth-go/tree/main/examples/oauth-slack) ### oauth-twitch Sign in with Twitch using the provider/twitch package. `cd examples/oauth-twitch && go run .` [View on GitHub](https://github.com/glincker/theauth-go/tree/main/examples/oauth-twitch) ### oauth-x Sign in with X (formerly Twitter) using the provider/x package. `cd examples/oauth-x && go run .` [View on GitHub](https://github.com/glincker/theauth-go/tree/main/examples/oauth-x) ### observability-otel Reference adapter bridging theauth.Tracer to go.opentelemetry.io/otel. `cd examples/observability-otel && go run .` [View on GitHub](https://github.com/glincker/theauth-go/tree/main/examples/observability-otel) ### observability-prom A reference adapter that bridges theauth.Metrics to the Prometheus client library. `cd examples/observability-prom && go run .` [View on GitHub](https://github.com/glincker/theauth-go/tree/main/examples/observability-prom) ### policy-shrink Records an agent's tool decisions, proposes a smaller policy from what it actually used, and replays the decisions against it. `go run ./examples/policy-shrink` [View on GitHub](https://github.com/glincker/theauth-go/tree/main/examples/policy-shrink) ### single-binary-sqlite A complete app with auth in one static Go binary and one SQLite file: no database server, no cgo, no framework. `cd examples/single-binary-sqlite && go run .` [View on GitHub](https://github.com/glincker/theauth-go/tree/main/examples/single-binary-sqlite) ### stdlib-app theauth-go behind a plain net/http ServeMux with Go 1.22 pattern routing, no router dependency. `cd examples/stdlib-app && go run .` [View on GitHub](https://github.com/glincker/theauth-go/tree/main/examples/stdlib-app) ### taint-guard-go A taint-aware tool guard (policy/toolguard with policy.TaintRule) that blocks a tool call when untrusted input reached its arguments. `go run ./examples/taint-guard-go` [View on GitHub](https://github.com/glincker/theauth-go/tree/main/examples/taint-guard-go) ### token-vault-smoke Checks a token vault provider preset against the real provider with your own test credentials. Never runs in CI. `go run ./examples/token-vault-smoke` [View on GitHub](https://github.com/glincker/theauth-go/tree/main/examples/token-vault-smoke) ### token-vault An agent gets a short-lived access token for a connected provider on a user's behalf without holding the refresh token. A stub provider runs in process. `go run ./examples/token-vault` [View on GitHub](https://github.com/glincker/theauth-go/tree/main/examples/token-vault) ### totp-stepup Password sign-in with a TOTP second factor: sign up, enroll TOTP, sign out and sign back in through the pending-second-factor session. `go run ./examples/totp-stepup` [View on GitHub](https://github.com/glincker/theauth-go/tree/main/examples/totp-stepup) ### webauthn-passkey Passkey registration and discoverable login with Config.WebAuthn on a single page. `go run ./examples/webauthn-passkey` [View on GitHub](https://github.com/glincker/theauth-go/tree/main/examples/webauthn-passkey) ## TypeScript examples Packages in this list are pnpm workspace members, so install once at the repository root and filter by path. Single-file demos list their setup steps in their README. See the [TypeScript page](https://theauth.dev/typescript/) for the npm packages. ### admin-approval-flow An admin MCP server proposes a revoke_delegation, self-approval is refused with 403, and a second admin approves it. `pnpm install && pnpm --filter ./examples/admin-approval-flow start` [View on GitHub](https://github.com/glincker/theauth/tree/main/examples/admin-approval-flow) ### agent-accountability A runnable, in-memory demo of the accountability loop for an AI agent: who it is, what it may do, who said yes, and what the record shows. `pnpm install && pnpm --filter ./examples/agent-accountability start` [View on GitHub](https://github.com/glincker/theauth/tree/main/examples/agent-accountability) ### agent-delegation-e2e One script: a user delegates a scoped token to an agent, an MCP server verifies it, and the agent is denied once the delegation is revoked. `pnpm install && pnpm --filter ./examples/agent-delegation-e2e start` [View on GitHub](https://github.com/glincker/theauth/tree/main/examples/agent-delegation-e2e) ### audit-receipts Sign a checkpoint of the audit log, mint a receipt that reveals only a few fields, and verify it from the receipt JSON and a public key. `npx tsx index.ts (setup steps in the README)` [View on GitHub](https://github.com/glincker/theauth/tree/main/examples/audit-receipts) ### basic-agent Minimal example showing agent creation, permission scoping, and authorization with theAuth. `pnpm install && pnpm --filter ./examples/basic-agent start` [View on GitHub](https://github.com/glincker/theauth/tree/main/examples/basic-agent) ### browser-extension A Manifest V3 browser extension that signs in with OAuth 2.1 and PKCE through @glinr/theauth-extension. `Load examples/browser-extension as an unpacked extension` [View on GitHub](https://github.com/glincker/theauth/tree/main/examples/browser-extension) ### cloudflare-workers theAuth running on Cloudflare Workers with D1 as the database. `pnpm install && pnpm --filter ./examples/cloudflare-workers dev` [View on GitHub](https://github.com/glincker/theauth/tree/main/examples/cloudflare-workers) ### hono-server Full auth server using theAuth with the Hono adapter. `pnpm install && pnpm --filter ./examples/hono-server start` [View on GitHub](https://github.com/glincker/theauth/tree/main/examples/hono-server) ### mcp-revocation-demo Revoke a delegation and the agent's MCP token stops working on the next request, even though the signed token has not expired. `Load examples/mcp-revocation-demo as an unpacked extension` [View on GitHub](https://github.com/glincker/theauth/tree/main/examples/mcp-revocation-demo) ### mcp-server theAuth as an MCP OAuth 2.1 authorization server. `pnpm install && pnpm --filter ./examples/mcp-server start` [View on GitHub](https://github.com/glincker/theauth/tree/main/examples/mcp-server) ### migrate-from-auth0 Runnable companion to the Auth0 migration guide: a machine-to-machine client rebuilt as a scoped agent with rotation and policy constraints. `pnpm install && pnpm --filter ./examples/migrate-from-auth0 start` [View on GitHub](https://github.com/glincker/theauth/tree/main/examples/migrate-from-auth0) ### migrate-from-better-auth-agent-plugin Runnable companion to the Better Auth agent plugin migration guide: agent identities, multi-hop delegation chains and cascading revocation. `pnpm install && pnpm --filter ./examples/migrate-from-better-auth-agent-plugin start` [View on GitHub](https://github.com/glincker/theauth/tree/main/examples/migrate-from-better-auth-agent-plugin) ### nextjs-app Full-stack Next.js 15 app with theAuth authentication. `pnpm install && pnpm --filter ./examples/nextjs-app dev` [View on GitHub](https://github.com/glincker/theauth/tree/main/examples/nextjs-app) ### nextjs-demo A working demo of theAuth auth and agent features built with Next.js App Router. `pnpm install && pnpm --filter ./examples/nextjs-demo dev` [View on GitHub](https://github.com/glincker/theauth/tree/main/examples/nextjs-demo) ### openai-agents-guard A runnable demo of guardTool in front of OpenAI Agents SDK tools. `npx tsx index.ts (setup steps in the README)` [View on GitHub](https://github.com/glincker/theauth/tree/main/examples/openai-agents-guard) ### policy-shrink Records an agent's tool decisions, proposes a smaller policy from what it actually used, and replays the decisions against it. `npx tsx index.ts (setup steps in the README)` [View on GitHub](https://github.com/glincker/theauth/tree/main/examples/policy-shrink) ### scim-okta A minimal SCIM 2.0 server you can point Okta at. `pnpm install && pnpm --filter ./examples/scim-okta start` [View on GitHub](https://github.com/glincker/theauth/tree/main/examples/scim-okta) ### taint-guard A runnable demo of provenance labels with guardTool. `npx tsx index.ts (setup steps in the README)` [View on GitHub](https://github.com/glincker/theauth/tree/main/examples/taint-guard) ### vercel-ai-sdk-guard A runnable demo of guardTool in front of Vercel AI SDK tools. `npx tsx index.ts (setup steps in the README)` [View on GitHub](https://github.com/glincker/theauth/tree/main/examples/vercel-ai-sdk-guard) ## Longer walkthroughs [Guides](https://theauth.dev/guides/) [Documentation](https://docs.theauth.dev) [Get started](https://theauth.dev/get-started/)