Go SDK

wocha-go is the Go SDK for the Wocha authentication and authorisation platform Management API. Standard library only — no external HTTP dependencies.

Configuration

import "github.com/Elementary-Digital/wocha-go"
 
client, err := wocha.NewClient(
    wocha.WithTenant("acme"),
    wocha.WithAPIKey(os.Getenv("WOCHA_API_KEY")),
)

For self-hosted deployments:

client, err := wocha.NewClient(
    wocha.WithBaseURL("https://your-domain.com/v1"),
    wocha.WithAPIKey("wocha_mgmt_..."),
)

Environment variables WOCHA_API_KEY and WOCHA_TENANT are used as fallbacks.

Quick start

users, err := client.Users.List(ctx, &wocha.UserListParams{PageSize: 25})
if err != nil {
    log.Fatal(err)
}
for _, u := range users.Data {
    fmt.Println(u.Email)
}

Key services

Service	Example
`Users`	`client.Users.Get(ctx, "usr_abc")`
`Organisations`	`client.Organisations.Create(ctx, params)`; `Invite(ctx, orgID, params)`
`Permissions`	`client.Permissions.Check(ctx, params)`
`Sessions`	`client.Sessions.RevokeAll(ctx, "usr_abc")`
`Webhooks`	`wocha/webhook` package for signature verification
`Applications`	`client.Applications.RotateSecret(ctx, id)`

Organisation invites

invite, err := client.Organisations.Invite(ctx, orgID, &wocha.OrgMemberInviteParams{
    Email:    "alex@example.com",
    Role:     "member",
    ReturnTo: "https://app.example.com/api/auth/login",
    Send:     wocha.Bool(false), // product-owned mail: use invite.ActionUrl yourself
})

See Organisation invites for send: false (product-owned mail) and the hosted /invite flow. Send and RequireMfa are *bool (server default true); pass wocha.Bool(false) for an explicit false. Requires wocha-go v1.1.0+.

Permission check

resp, err := client.Permissions.Check(ctx, &wocha.PermissionCheckParams{
    UserID:       "user_123",
    Permission:   "read",
    ResourceType: "document",
    ResourceID:   "doc_456",
})
if resp.Allowed {
    // grant access
}

Webhook verification

import "github.com/Elementary-Digital/wocha-go/webhook"
 
event, err := webhook.ConstructEvent(payload, signatureHeader, secret)