{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-ciam/sdks/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["InteractiveLink","Notification","CodeBlockCustom","CodeItem"]},"type":"markdown"},"seo":{"title":"Entitlements quickstart","siteUrl":"https://developers.frontegg.com/","llmstxt":{"title":"Frontegg Developer Documentation","description":"Authentication, authorization, and user management for Customer Identity, plus Agen for SaaS and Agen for Work. Guides, SDKs, and API references.","sections":[{"title":"Customer Identity (CIAM)","description":"Auth, SSO, SCIM, entitlements, and user management — guides, SDKs, and APIs.","includeFiles":["ciam/**/*.md"],"excludeFiles":[]},{"title":"Agen for SaaS","description":"Agentic access and authorization for SaaS products.","includeFiles":["agen-for-saas/**/*.md"],"excludeFiles":[]},{"title":"Agen for Work","description":"Agentic access and authorization for internal and workforce use.","includeFiles":["agen-for-work/**/*.md"],"excludeFiles":[]},{"title":"Platform","description":"Shared platform overview.","includeFiles":["platform/**/*.md"],"excludeFiles":[]}],"excludeFiles":["internal-docs/**","ciam/guides/env-settings/inject-client-ip.md","CLAUDE.md","**/images/**"],"hide":false}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"entitlements-quickstart","__idx":0},"children":["Entitlements quickstart"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["entitlements"]}]}," package from the Frontegg Go SDK to evaluate feature and permission entitlements locally. The client maintains an in-memory snapshot that refreshes in the background — there is no network round-trip per check."]},{"$$mdtype":"Tag","name":"br","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"InteractiveLink","attributes":{"href":"https://github.com/frontegg/go-sdk","target":"_blank","justifyContent":"center"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Check out the repo on GitHub"]}]},{"$$mdtype":"Tag","name":"br","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Notification","attributes":{"title":"Prerequisites","type":"attention"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Go ≥ 1.24 and a Frontegg workspace with a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client ID"]}," and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["API Key"]}," (Frontegg Portal → ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings → API Tokens"]},"). For conceptual background on features, plans, and flags, see ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/ciam/guides/authorization/entitlements/intro"},"children":["Getting started with Entitlements"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"install-the-sdk","__idx":1},"children":["Install the SDK"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The entitlements client is included in the main Go SDK package:"]},{"$$mdtype":"Tag","name":"CodeBlockCustom","attributes":{"tabs":["go"]},"children":[{"$$mdtype":"Tag","name":"CodeItem","attributes":{},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"go get github.com/frontegg/go-sdk\n"},"children":[]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"initialize-the-client","__idx":2},"children":["Initialize the client"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Create a Frontegg client and obtain the entitlements sub-client. If you already initialized the SDK at application startup, reuse that client:"]},{"$$mdtype":"Tag","name":"CodeBlockCustom","attributes":{"tabs":["go"]},"children":[{"$$mdtype":"Tag","name":"CodeItem","attributes":{},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"go","header":{"controls":{"copy":{}}},"source":"import \"github.com/frontegg/go-sdk\"\n\nclient := frontegg.New(frontegg.Credentials{\n\tClientID: \"<YOUR_CLIENT_ID>\",\n\tAPIKey:   \"<YOUR_API_KEY>\",\n})\n\nent := client.Entitlements()\n","lang":"go"},"children":[]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"start-the-background-refresher","__idx":3},"children":["Start the background refresher"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Call ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Start"]}," to begin loading and refreshing the entitlements snapshot. Use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Ready"]}," to block until the first snapshot is available before serving checks:"]},{"$$mdtype":"Tag","name":"CodeBlockCustom","attributes":{"tabs":["go"]},"children":[{"$$mdtype":"Tag","name":"CodeItem","attributes":{},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"go","header":{"controls":{"copy":{}}},"source":"import \"github.com/frontegg/go-sdk/entitlements\"\n\nif err := ent.Start(ctx); err != nil {\n\tlog.Fatal(err)\n}\ndefer ent.Close()\n\nif err := ent.Ready(ctx); err != nil {\n\tlog.Fatal(err)\n}\n","lang":"go"},"children":[]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Call ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ent.Close()"]}," to stop the background refresher when you are done."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"scope-to-a-user-or-tenant","__idx":4},"children":["Scope to a user or tenant"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before running checks, scope the client to the subject you are evaluating:"]},{"$$mdtype":"Tag","name":"CodeBlockCustom","attributes":{"tabs":["go"]},"children":[{"$$mdtype":"Tag","name":"CodeItem","attributes":{},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"go","header":{"controls":{"copy":{}}},"source":"// From a raw Frontegg token (the SDK validates it and derives attributes):\nscoped, err := ent.ForFronteggToken(ctx, token)\n\n// Or from an entity you already validated:\n//   scoped := ent.ForUser(entity)\n","lang":"go"},"children":[]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"query-entitlements","__idx":5},"children":["Query entitlements"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"feature-entitlement","__idx":6},"children":["Feature entitlement"]},{"$$mdtype":"Tag","name":"CodeBlockCustom","attributes":{"tabs":["go"]},"children":[{"$$mdtype":"Tag","name":"CodeItem","attributes":{},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"go","header":{"controls":{"copy":{}}},"source":"res := scoped.IsEntitledToFeature(ctx, \"advanced-analytics\", nil)\n\nif !res.Result {\n\tlog.Printf(\"User is not entitled to feature: %s\", res.Justification)\n}\n","lang":"go"},"children":[]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"permission-entitlement","__idx":7},"children":["Permission entitlement"]},{"$$mdtype":"Tag","name":"CodeBlockCustom","attributes":{"tabs":["go"]},"children":[{"$$mdtype":"Tag","name":"CodeItem","attributes":{},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"go","header":{"controls":{"copy":{}}},"source":"res := scoped.IsEntitledToPermission(ctx, \"fe.secure.read\", nil)\n\nif !res.Result {\n\tlog.Printf(\"User is not entitled to permission: %s\", res.Justification)\n}\n","lang":"go"},"children":[]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"unified-api","__idx":8},"children":["Unified API"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Provide exactly one of a feature key or permission key:"]},{"$$mdtype":"Tag","name":"CodeBlockCustom","attributes":{"tabs":["go"]},"children":[{"$$mdtype":"Tag","name":"CodeItem","attributes":{},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"go","header":{"controls":{"copy":{}}},"source":"res, err := scoped.IsEntitledTo(ctx, \"advanced-analytics\", \"\", nil)\nif err != nil {\n\tlog.Fatal(err)\n}\n","lang":"go"},"children":[]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"result-shape","__idx":9},"children":["Result shape"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Each check returns an ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["IsEntitledResult"]},":"]},{"$$mdtype":"Tag","name":"CodeBlockCustom","attributes":{"tabs":["go"]},"children":[{"$$mdtype":"Tag","name":"CodeItem","attributes":{},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"go","header":{"controls":{"copy":{}}},"source":"type IsEntitledResult struct {\n\tResult        bool\n\tJustification Justification // when Result is false\n}\n","lang":"go"},"children":[]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Result"]}," is ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["false"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Justification"]}," explains why (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["missing-feature"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["missing-permission"]},", or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["bundle-expired"]},")."]},{"$$mdtype":"Tag","name":"Notification","attributes":{"title":"Permissions in JWTs","type":"attention"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Some JWTs do not include permissions in their payload. Permissions are required for entitlement checks. When validating tokens before scoping, set ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["WithRolesAndPermissions: true"]}," on ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ValidateTokenOptions"]},". See ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/ciam/sdks/backend/go/go-integrate#validating-jwt"},"children":["Validating JWT"]}," in the Go integrate guide."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"related-documentation","__idx":10},"children":["Related documentation"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/ciam/sdks/backend/go/go-integrate"},"children":["Go SDK integrate guide"]}," — authentication, middleware, and other clients"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/ciam/guides/authorization/entitlements/intro"},"children":["Getting started with Entitlements"]}," — features, plans, and feature flags"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://github.com/frontegg/go-sdk"},"children":["Source & issues"]}," — Go SDK on GitHub"]}]}]},"headings":[{"value":"Entitlements quickstart","id":"entitlements-quickstart","depth":2},{"value":"Install the SDK","id":"install-the-sdk","depth":3},{"value":"Initialize the client","id":"initialize-the-client","depth":3},{"value":"Start the background refresher","id":"start-the-background-refresher","depth":3},{"value":"Scope to a user or tenant","id":"scope-to-a-user-or-tenant","depth":3},{"value":"Query entitlements","id":"query-entitlements","depth":3},{"value":"Feature entitlement","id":"feature-entitlement","depth":4},{"value":"Permission entitlement","id":"permission-entitlement","depth":4},{"value":"Unified API","id":"unified-api","depth":4},{"value":"Result shape","id":"result-shape","depth":3},{"value":"Related documentation","id":"related-documentation","depth":3}],"frontmatter":{"seo":{"title":"Entitlements quickstart"}},"lastModified":"2026-06-25T15:13:53.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/ciam/sdks/backend/go/entitlements","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}