Build production REST APIs with Go - handlers, middleware, security
Build production-ready Go REST APIs with routing, middleware, authentication, and validation. Use when creating HTTP handlers, implementing JWT/auth, or adding logging and error recovery to Go web services.
/plugin marketplace add pluginagentmarketplace/custom-plugin-go/plugin install go-development-assistant@pluginagentmarketplace-goThis skill inherits all available tools. When active, it can use any tool Claude has access to.
assets/config.yamlassets/schema.jsonreferences/GUIDE.mdreferences/PATTERNS.mdscripts/validate.pyBuild production-ready REST APIs with Go's net/http and popular frameworks.
Complete guide for building secure, performant web APIs including routing, middleware, authentication, and best practices.
| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
| framework | string | no | "stdlib" | Framework: "stdlib", "gin", "echo", "chi" |
| auth_type | string | no | "jwt" | Auth method: "jwt", "api-key", "oauth" |
| include_openapi | bool | no | false | Generate OpenAPI spec |
type Server struct {
db *sql.DB
logger *slog.Logger
}
func (s *Server) handleGetUser() http.HandlerFunc {
return func(w http.ResponseWriter, r *http.Request) {
id := chi.URLParam(r, "id")
user, err := s.db.GetUser(r.Context(), id)
if err != nil {
if errors.Is(err, sql.ErrNoRows) {
http.Error(w, "user not found", http.StatusNotFound)
return
}
s.logger.Error("get user", "error", err)
http.Error(w, "internal error", http.StatusInternalServerError)
return
}
w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(user)
}
}
func LoggingMiddleware(logger *slog.Logger) func(http.Handler) http.Handler {
return func(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
start := time.Now()
ww := &responseWriter{ResponseWriter: w, status: 200}
defer func() {
logger.Info("request",
"method", r.Method,
"path", r.URL.Path,
"status", ww.status,
"duration", time.Since(start),
)
}()
next.ServeHTTP(ww, r)
})
}
}
func RecoveryMiddleware(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
defer func() {
if err := recover(); err != nil {
http.Error(w, "internal error", http.StatusInternalServerError)
}
}()
next.ServeHTTP(w, r)
})
}
func JWTMiddleware(secret []byte) func(http.Handler) http.Handler {
return func(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
auth := r.Header.Get("Authorization")
if !strings.HasPrefix(auth, "Bearer ") {
http.Error(w, "unauthorized", http.StatusUnauthorized)
return
}
token, err := jwt.Parse(strings.TrimPrefix(auth, "Bearer "), func(t *jwt.Token) (interface{}, error) {
return secret, nil
})
if err != nil || !token.Valid {
http.Error(w, "invalid token", http.StatusUnauthorized)
return
}
claims := token.Claims.(jwt.MapClaims)
ctx := context.WithValue(r.Context(), "user_id", claims["sub"])
next.ServeHTTP(w, r.WithContext(ctx))
})
}
}
type CreateUserRequest struct {
Name string `json:"name" validate:"required,min=2,max=100"`
Email string `json:"email" validate:"required,email"`
Age int `json:"age" validate:"gte=0,lte=130"`
}
func (s *Server) handleCreateUser() http.HandlerFunc {
validate := validator.New()
return func(w http.ResponseWriter, r *http.Request) {
var req CreateUserRequest
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
http.Error(w, "invalid json", http.StatusBadRequest)
return
}
if err := validate.Struct(req); err != nil {
http.Error(w, err.Error(), http.StatusBadRequest)
return
}
// process valid request
}
}
type HTTPClient struct {
client *http.Client
backoff []time.Duration
}
func (c *HTTPClient) Do(req *http.Request) (*http.Response, error) {
var resp *http.Response
var err error
for i, delay := range c.backoff {
resp, err = c.client.Do(req)
if err == nil && resp.StatusCode < 500 {
return resp, nil
}
if i < len(c.backoff)-1 {
time.Sleep(delay)
}
}
return resp, err
}
func TestHandleGetUser(t *testing.T) {
srv := &Server{db: mockDB, logger: slog.Default()}
req := httptest.NewRequest("GET", "/users/123", nil)
w := httptest.NewRecorder()
srv.handleGetUser().ServeHTTP(w, req)
if w.Code != http.StatusOK {
t.Errorf("got status %d, want %d", w.Code, http.StatusOK)
}
var user User
json.NewDecoder(w.Body).Decode(&user)
if user.ID != 123 {
t.Errorf("got id %d, want 123", user.ID)
}
}
| Symptom | Cause | Fix |
|---|---|---|
| 5xx spike | Handler panic | Add recovery middleware |
| Slow responses | Missing timeouts | Configure server timeouts |
| Memory leak | Unclosed body | Always defer resp.Body.Close() |
Skill("go-web-apis")
This skill should be used when the user asks to "create an agent", "add an agent", "write a subagent", "agent frontmatter", "when to use description", "agent examples", "agent tools", "agent colors", "autonomous agent", or needs guidance on agent structure, system prompts, triggering conditions, or agent development best practices for Claude Code plugins.
This skill should be used when the user asks to "create a slash command", "add a command", "write a custom command", "define command arguments", "use command frontmatter", "organize commands", "create command with file references", "interactive command", "use AskUserQuestion in command", or needs guidance on slash command structure, YAML frontmatter fields, dynamic arguments, bash execution in commands, user interaction patterns, or command development best practices for Claude Code.
This skill should be used when the user asks to "create a hook", "add a PreToolUse/PostToolUse/Stop hook", "validate tool use", "implement prompt-based hooks", "use ${CLAUDE_PLUGIN_ROOT}", "set up event-driven automation", "block dangerous commands", or mentions hook events (PreToolUse, PostToolUse, Stop, SubagentStop, SessionStart, SessionEnd, UserPromptSubmit, PreCompact, Notification). Provides comprehensive guidance for creating and implementing Claude Code plugin hooks with focus on advanced prompt-based hooks API.