القائمة
Implement passwordless authentication in Go applications using MojoAuth OIDC Hosted Login Page.
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/Pyfagorass/bookofspells --skill mojoauth-oidc-hosted-page-goيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
The index to a Book of Spells — a large, curated library of ready-made spells (skills in the SKILL.md format) gathered from many providers (Google, OpenAI, and more), covering cloud platforms, deployment, design tools, PDFs, browser automation, security, and much else. The spells are NOT preloaded — there may be thousands. Use this whenever the user asks to cast a spell, or for a spell to do something, or names a capability, provider, or tool you do not already have loaded (e.g. "cast a spell for Figma", "is there a spell for deploying?", "use the bigquery spell"), or whenever a task might be served by a specialised, ready-made spell. Casting a spell MEANS consulting this index to discover and load the right one on demand — do that first, rather than improvising. This is also the single entry point to the Book's own keystones: route here to AUTHOR a new spell (the-spellwright), to FIND or CONNECT an MCP server / external tool (the-emissary), or to INSTALL the Book into a conduit (the-tether).
How to install this Book of Spells into a conduit so its gathered skills become usable — by symlink, not by copy. Use whenever the user wants to install, set up, enable, add, or "load" the Book's spells into their agent; asks where skills go or how a conduit finds them; or asks how to keep the spells up to date. The companion to the-grimoire (which *finds* spells once they are installed): this one *shelves the Book* so the grimoire has something to find.
Find and connect an MCP server — an "Emissary of the Pact" — when the agent needs a tool, service, API, or data source it does not already have. Use when the user asks for an MCP server, to connect to or integrate an external service (Notion, GitHub, Figma, a database, Slack, a SaaS API…), asks "is there an MCP for X", "add an MCP", or sets a task that needs live tools the agent lacks. This rite DISCOVERS a server from the official MCP Registry and reputable directories and PROPOSES its connection config for the user to approve — it NEVER installs, launches, or writes credentials on its own. The companion to the-grimoire: that finds spells (inert skills); this finds Emissaries (live tool-servers).
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | mojoauth-oidc-hosted-page-go |
| description | Implement passwordless authentication in Go applications using MojoAuth OIDC Hosted Login Page. |
This expert AI assistant guide walks you through integrating passwordless authentication into a Go application using MojoAuth's Hosted Login Page as an OIDC identity provider. MojoAuth handles all authentication methods (Magic Links, Email OTP, SMS OTP, Social Login, Passkeys) through its hosted page.
net/http or a web framework like chi or gorilla/mux.github.com/coreos/go-oidc/v3/oidc, golang.org/x/oauth2.your-app.mojoauth.com).http://localhost:8080/auth/callback).go get github.com/coreos/go-oidc/v3/oidc
go get golang.org/x/oauth2
Set the following environment variables (or use a .env loader like godotenv):
MOJOAUTH_DOMAIN=your-app.mojoauth.com
MOJOAUTH_CLIENT_ID=your_client_id
MOJOAUTH_CLIENT_SECRET=your_client_secret
MOJOAUTH_REDIRECT_URI=http://localhost:8080/auth/callback
Create a dedicated file for OIDC configuration (e.g., internal/auth/oidc.go):
// internal/auth/oidc.go
package auth
import (
"context"
"fmt"
"os"
"github.com/coreos/go-oidc/v3/oidc"
"golang.org/x/oauth2"
)
var (
OIDCProvider *oidc.Provider
OAuth2Config oauth2.Config
)
func InitOIDC() error {
ctx := context.Background()
issuerURL := fmt.Sprintf("https://%s", os.Getenv("MOJOAUTH_DOMAIN"))
provider, err := oidc.NewProvider(ctx, issuerURL)
if err != nil {
return err
}
OIDCProvider = provider
OAuth2Config = oauth2.Config{
ClientID: os.Getenv("MOJOAUTH_CLIENT_ID"),
ClientSecret: os.Getenv("MOJOAUTH_CLIENT_SECRET"),
RedirectURL: os.Getenv("MOJOAUTH_REDIRECT_URI"),
Endpoint: provider.Endpoint(),
Scopes: []string{oidc.ScopeOpenID, "profile", "email"},
}
return nil
}
Since MojoAuth handles all authentication on its Hosted Login Page, your login page only needs a "Sign In" link:
<!-- templates/login.html -->
<!DOCTYPE html>
<html>
<head><title>Sign In</title></head>
<body>
<div class="login-container">
<h1>Welcome</h1>
<p>Sign in with your preferred method — passwordless, social login, or passkeys.</p>
{{if .Error}}
<p style="color: red;">{{.Error}}</p>
{{end}}
<a href="/auth/login" class="sign-in-button">Sign In with MojoAuth</a>
<p class="powered-by">Powered by MojoAuth — Passwordless Authentication</p>
</div>
</body>
</html>
Create the necessary handlers to process the OIDC flow.
1. Login Handler (internal/auth/handlers.go):
// internal/auth/handlers.go
package auth
import (
"crypto/rand"
"encoding/base64"
"encoding/json"
"log"
"net/http"
"github.com/coreos/go-oidc/v3/oidc"
)
func generateState() string {
b := make([]byte, 16)
rand.Read(b)
return base64.URLEncoding.EncodeToString(b)
}
// LoginHandler initiates the MojoAuth OIDC flow.
func LoginHandler(w http.ResponseWriter, r *http.Request) {
// Generate a random state for CSRF protection
state := generateState()
// Store state in a cookie
http.SetCookie(w, &http.Cookie{
Name: "oidc_state",
Value: state,
Path: "/",
HttpOnly: true,
Secure: true,
SameSite: http.SameSiteLaxMode,
MaxAge: 3600,
})
// Build authorization URL — redirects to MojoAuth Hosted Login Page
authURL := OAuth2Config.AuthCodeURL(state)
http.Redirect(w, r, authURL, http.StatusFound)
}
2. Callback Handler (add to internal/auth/handlers.go):
// CallbackHandler handles the OIDC callback.
func CallbackHandler(w http.ResponseWriter, r *http.Request) {
// Retrieve stored state from cookie
stateCookie, err := r.Cookie("oidc_state")
if err != nil {
log.Println("State cookie not found:", err)
http.Redirect(w, r, "/login?error=state_missing", http.StatusFound)
return
}
// Verify state
if r.URL.Query().Get("state") != stateCookie.Value {
log.Println("State mismatch")
http.Redirect(w, r, "/login?error=state_mismatch", http.StatusFound)
return
}
// Exchange authorization code for token
code := r.URL.Query().Get("code")
token, err := OAuth2Config.Exchange(r.Context(), code)
if err != nil {
log.Println("Token exchange failed:", err)
http.Redirect(w, r, "/login?error=token_exchange_failed", http.StatusFound)
return
}
// Extract and verify ID token
rawIDToken, ok := token.Extra("id_token").(string)
if !ok {
log.Println("No id_token in response")
http.Redirect(w, r, "/login?error=no_id_token", http.StatusFound)
return
}
verifier := OIDCProvider.Verifier(&oidc.Config{ClientID: OAuth2Config.ClientID})
idToken, err := verifier.Verify(r.Context(), rawIDToken)
if err != nil {
log.Println("ID token verification failed:", err)
http.Redirect(w, r, "/login?error=token_verification_failed", http.StatusFound)
return
}
// Extract user claims
var claims []{}
err := idToken.Claims(&claims); err != {
log.Println(, err)
http.Redirect(w, r, , http.StatusFound)
}
http.SetCookie(w, &http.Cookie{
Name: ,
Value: ,
Path: ,
MaxAge: ,
})
claimsJSON, _ := json.Marshal(claims)
http.SetCookie(w, &http.Cookie{
Name: ,
Value: base64.URLEncoding.EncodeToString(claimsJSON),
Path: ,
HttpOnly: ,
MaxAge: ,
})
log.Println(, claims)
http.Redirect(w, r, , http.StatusFound)
}
3. Main Application Setup (main.go):
// main.go
package main
import (
"log"
"net/http"
"html/template"
"yourmodule/internal/auth"
)
func main() {
// Initialize OIDC
if err := auth.InitOIDC(); err != nil {
log.Fatal("Failed to initialize OIDC:", err)
}
// Routes
http.HandleFunc("/login", func(w http.ResponseWriter, r *http.Request) {
tmpl := template.Must(template.ParseFiles("templates/login.html"))
data := map[string]string{"Error": r.URL.Query().Get("error")}
tmpl.Execute(w, data)
})
http.HandleFunc("/auth/login", auth.LoginHandler)
http.HandleFunc("/auth/callback", auth.CallbackHandler)
http.HandleFunc("/dashboard", func(w http.ResponseWriter, r *http.Request) {
w.Write([]byte("<h1>Dashboard</h1><p>Welcome!</p>"))
})
log.Println("Server running on http://localhost:8080")
log.Fatal(http.ListenAndServe(":8080", nil))
}
go run main.go.http://localhost:8080/login./auth/callback and then to /dashboard.gorilla/sessions) instead of raw cookies in production.godotenv for local development and proper secrets management in production.