DEVELOPER DOCUMENTATION

Go

Verify MANDATE tokens in Go applications.

Start in Observe on one route. Use the deployment URL and installed package version supplied for your workspace. Historical host examples and source capabilities do not establish a live service or published release.

Install the local candidate

The module lives at sdks/go/ and is not a published public Go module.

Use an approved checkout/archive and an explicit replacement in your consumer:

bash
go mod edit -replace github.com/mandate-security/mandate-go=/absolute/path/to/mandate/sdks/go
go get github.com/mandate-security/mandate-go

Hosted net/http middleware

go
highValue := true
hosted := mandate.HostedMiddleware{
    Options: mandate.HostedValidateOptions{
        SiteSecret: os.Getenv("MANDATE_SITE_SECRET"),
        SiteKey: os.Getenv("MANDATE_SITE_KEY"),
        APIKey: os.Getenv("MANDATE_API_KEY"),
        GateURL: os.Getenv("MANDATE_GATE_URL"),
        CredentialMode: "cookie", CredentialCookieName: "Mndt-Sess",
        HighValue: &highValue, Origin: "https://app.example.com",
    },
    Mode: "observe",
}
http.Handle("/api/checkout", hosted.Handler(checkoutHandler))

Import net/http, os, and

mandate "github.com/mandate-security/mandate-go". Authenticate your user before

checkout. Observe permits the handler; after reviewing route evidence, enforce

this route. The helper derives original method/raw target and forwards proofs.

ValidateHostedRequest supports a direct request; ValidateHosted a raw opaque

credential. Use response adapters to preserve authenticated cookie/companion and

native-state updates. Configured endpoints are explicit HTTPS; no public fallback.

Managed candidate

ManagedMiddleware.Handler calls the canonical managed endpoint once for Verify

v1 or explicit Limit v2. It supports trusted Subject, Off/unmatched handling,

Observe decisions and admission metadata. Do not call hosted validation again.

Private response updates preserve browser and native rotation; conflicting or

duplicate native state refuses authority. This source/package-tested capability

is unpublished and not a customer deployment claim.

Production browser credentials stay in an HttpOnly cookie. The repository

reader prefers _mndt and accepts legacy Mndt-Sess only when unambiguous;

the currently deployed writer uses Mndt-Sess. Match the live collector/Gate

configuration. Manual hosted helpers support credentialMode: "cookie" and

credentialCookieName: "Mndt-Sess" or "_mndt"; never rename a cookie without a

coordinated writer/reader rollout. Request proof uses x-md-vq, with legacy

x-mndt-req accepted. x-md-w, x-md-h and md_<seed> purpose cookies are

opaque, authenticated transport. Preserve SDK response updates and application

cookies. Do not copy credentials into page storage or logs.

Results and recovery

Hosted Result.Success and documented Action drive the adapter. Raw scores

remain internal; local Score is not human identity. Throttle maps to 429;

queue to 202 with opaque retry token; fresh proof to 401; customer-owned step-up

and block to 403. Honor RetryAfterSeconds and never retry business actions

automatically. The full Error/Reason remains server-side support context.

Local VerifyToken/VerifyRequest is limited to explicit legacy/test use;

DEADMAN has dedicated window/domain/route-scoped readers. Local crypto cannot

consume copied credentials globally and is not hosted-unavailability fallback.

See Recipes and sdks/go/examples/hosted-nethttp/.