# ory/fosite

Extensible security first OAuth 2.0 and OpenID Connect SDK for Go.

Repository: https://github.com/ory/fosite
Canonical: https://ross.abutalabs.com/products/fosite
Homepage: https://www.ory.com/?utm_source=github&utm_medium=banner&utm_campaign=fosite
Language: Go
License: Apache-2.0
License Family: permissive
Topics: golang, oauth, oauth2, library, sdk, security, auth, authentication, authorization, openid-connect, hacktoberfest
Last push: 2025-11-20T01:13:40+00:00

## Health v2 (maintenance only)
Score: 58/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 53, release rhythm 40, longevity 100
- inputs: {"age_days": 3904, "days_push": 287, "days_rel": 629, "gap_med": 8, "n_releases_24m": 2}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2612, forks 348 (observed 2026-08-28T04:07:04.440830+00:00)

## What it is
Fosite is a security-first, extensible OAuth 2.0 and OpenID Connect SDK for Go, implementing RFC 6749, RFC 6819, PKCE, and OpenID Connect Core 1.0 with all flows (code, implicit, hybrid). It is the framework on which Ory Hydra is built.

## Use cases
- build an OAuth 2.0 authorization server in Go
- implement OpenID Connect provider flows in a Go application
- add PKCE support to an OAuth2 server
- issue and validate OAuth2 access and refresh tokens
- build a custom identity provider with OIDC code, implicit, or hybrid flow

## When to choose
- you need to implement an OAuth2/OIDC server yourself in Go with full control
- you want a peer-reviewed, security-hardened protocol implementation
- you need extensibility for custom grant types or storage backends

## When to avoid
- you just need a ready-made OAuth2/OIDC server - use Ory Hydra instead
- you only need a client to call OAuth2-protected APIs
- you are not working in Go

## Facets
- artifact type: library
- maturity: active
- function: auth, authorization, security, middleware
- domain: security, apis, web-development, backend
- platform: go, windows, cross-platform
- tags: oauth2, openid-connect, sdk, security-first, ietf-rfc6749, pkce, identity, linux, macos

## Member repositories
- ory/fosite (main) score 58

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:07:04.440830+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T02:20:39.225209+00:00, confidence not recorded.
  - readme: https://github.com/ory/fosite (fetched 2026-08-28T04:07:04.440830+00:00, sha 2f90dd0feb18)
  - homepage: https://www.ory.com/?utm_source=github&utm_medium=banner&utm_campaign=fosite (fetched 2026-08-29T10:03:37.926858+00:00, sha 9cd75b156cd4)
  - site_page: https://www.ory.com/docs/welcome (fetched 2026-08-29T10:03:37.938645+00:00, sha e6f2747eb4d2)
  - site_page: https://www.ory.com/about (fetched 2026-08-29T10:03:37.942093+00:00, sha e44652fde9f9)
  - site_page: https://www.ory.com/pricing (fetched 2026-08-29T10:03:37.936067+00:00, sha 35c1d920fc8d)
  - site_page: https://changelog.ory.com/ (fetched 2026-08-29T10:03:37.940465+00:00, sha c8e6b35f30bb)
  - site_page: https://www.ory.com/integrations (fetched 2026-08-29T10:03:37.943682+00:00, sha 966475eed325)
- Data as of 2026-08-30T08:39:29.467469+00:00.