wtf is yubigo?

A YubiKey is a small physical device that generates one-time passwords, you plug it in or tap it, and it produces a code that helps prove you're really you. Yubigo is a library for Go applications that lets developers add YubiKey verification to their login systems. Instead of building the integration from scratch, a developer can drop this in and start checking YubiKey codes with just a few lines of code. The library talks to Yubico's validation servers (the company behind YubiKey) to confirm whether a one-time password is legitimate. You give it an API key and ID from Yubico, then pass it the OTP string that the user's YubiKey generated. It checks the code against the server and tells you whether it's valid. A key security detail: each code can only be used once, so even if someone intercepts it, it won't work again. This is aimed at Go developers building apps where strong second-factor authentication matters. Think of an internal admin dashboard, a VPN gateway, or a financial tool where a password alone isn't secure enough. Instead of relying on SMS codes or authenticator apps, users tap their YubiKey, and the app verifies it through this library. The project offers some practical flexibility. Developers can configure their own HTTP client with custom timeouts rather than using defaults, point at their own validation servers instead of Yubico's, or toggle HTTPS certificate verification. The security-conscious defaults are sensible, but the knobs are there for teams with specific infrastructure needs. It's a lightweight, focused tool, it does one thing (verify YubiKey OTPs) and doesn't try to be a full authentication framework. The README notes that test files and more documentation are still on the to-do list, so it's a relatively mature library but with room for polish.