The lazy me wants to use this for future projects to secure my apis, but the curious me wants to reimplement this type of project in go.

Were there any gotchas in implementing this type of identity access management system?