nexauth-go

go get github.com/nexabase/nexauth-go

nx := nexauth.New("sk_live_...", "")

// Offline JWT verify — JWKS fetched once, cached:
claims, err := nx.Verify(ctx, bearerToken)
// claims: {Sub, AppID, Env, Roles}

// Gin middleware:
auth := func(c *gin.Context) {
    cl, err := nx.Verify(c, bearer(c))
    if err != nil { c.AbortWithStatus(401); return }
    c.Set("user", cl)
}

// RBAC check server-side:
ok, _ := nx.CheckPermission(ctx, claims.Sub, "orders:read", "live")

// Revoke:
nx.RevokeSessions(ctx, userID, true)  // all sessions