I built a real Helpdesk API in Go — no framework, just the standard library
Most "build an API in Go" tutorials stop at a /hello route. This one goes all the way to something you could actually put behind a support desk: accounts, hashed passwords, JWT login, role permissions, filters, automated tests and a Docker image. The whole thing uses net/http and database/sql from the standard library, plus exactly two dependencies: a SQLite driver and a JWT library. No Gin, no…
This article explains how to build a complete Helpdesk API in Go using only the standard library, without any external frameworks or ORMs. The API supports two types of users: customers who can register and manage their own tickets, and agents who can view, update, delete and comment on all tickets. The system uses a single SQLite database file to store account information, user credentials hashed with PBKDF2, ticket status and priority, and comments.
The API follows REST principles, exposing endpoints for registration, login, creating tickets, listing tickets, getting ticket details, updating tickets and deleting tickets. Customers can only view and comment on their own tickets, while agents have full access to all tickets. A JWT library is used for authentication and authorization.
Routing is handled directly with the standard http package, using method and wildcard patterns on http.ServeMux to simplify the routing table. Handlers are attached to an App struct instead of global variables, making testing easier by allowing the creation of an in-memory database. Passwords are hashed using PBKDF2, with the iteration count stored alongside the hash for future strengthening.
Authentication is implemented with JWT tokens, verified in a custom middleware layer that can be used to decorate any handler. The system never reveals different error messages for incorrect credentials, to avoid leaking information about registered users. All of the source code is available on GitHub for those interested in learning more about building robust APIs in Go.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
