A driver connects a service facade to its backend. Choose it from the behavior your application needs, not only from whether it implements the interface. Facades and Drivers explains which responsibilities stay portable and which belong to the backend.
State Scope
Start with where state must live. A memory cache is useful for isolated tests or disposable data in one process. It cannot share a receipt between two API replicas: each replica has its own cache. A shared Redis cache gives both replicas access to the same keys, but persistence and failover durability still depend on Redis configuration. Sharing state is not the same as preserving it indefinitely.
Local SQLite and filesystem storage can suit a single-host deployment. They do not become shared services merely because several application replicas use the same driver type. Choose a backend all relevant replicas can reach when they must observe the same records, objects, counters, or work.
Backend Requirements
Reuse a service your team can operate when it meets the contract you need. Then check the linked provider guide for credentials, permissions, supported server versions, resource provisioning, and startup requirements. A driver constructor is not proof of connectivity or permission to perform an operation.
Compare the service’s compatibility matrix before committing to a provider.
An interface method can return ErrUnsupported; vendor-native capabilities do
not automatically become portable operations. For example, a durable scheduler
can preserve timers and coordinate their delivery without guaranteeing
exactly-once application side effects. Keep handlers idempotent where repeated
delivery or an uncertain external result could duplicate work.
Service Drivers
These are the available choices and their main prerequisites. Each Docs link opens the canonical provider setup, including its compatibility evidence and limits; this catalog does not duplicate those matrices. In-process drivers are included with core. Vendor modules are installed from your application’s module directory as shown in the linked guide.
Hatchet is pending and unpublished. It is not an installable choice; its development material belongs to the contributor archive, not application setup.
| Service | Driver | Pick when | Guide |
|---|---|---|---|
| Cache | Memory | Development and tests; a single process. | Docs |
| Redis | Shared entries, counters, and locks; requires Redis 6.2 or later. | Docs | |
| Feature flags | Memory | Development and tests; flags set in code. | Docs |
| OpenFeature | Flags in flagd, GO Feature Flag, ConfigCat, Flagsmith, or any service with an OpenFeature Go provider. | Docs | |
| LaunchDarkly | Flags in LaunchDarkly, evaluated with its official Go SDK. | Docs | |
| Search | Memory | Development and tests; a single process. | Docs |
| PostgreSQL | Full-text search in an existing database; application-owned table migrations. | Docs | |
| Meilisearch | Dedicated prefix search; requires Meilisearch 1.15 or later. | Docs | |
| OpenSearch | Large indexes on an OpenSearch cluster. | Docs | |
| Database | PostgreSQL | A PostgreSQL server and pgx connection pool. | Docs |
| MySQL | An existing MySQL deployment. | Docs | |
| SQLite | An embedded database, tests, or an in-memory database. | Docs | |
| File storage | Memory | Development and tests; a single process. | Docs |
| Filesystem | Files on a local disk, on a single host. | Docs | |
| Amazon S3 | S3 and S3-compatible object stores. | Docs | |
| Queues | Memory | Development and tests; a single process. | Docs |
| RabbitMQ | Durable AMQP work queues, publisher confirms, and manual acknowledgements. | Docs | |
| NATS | JetStream streams and durable pull consumers, not Core NATS alone. | Docs | |
| Amazon SQS | AWS queues, credentials, and a logical-name-to-URL mapping. | Docs | |
| Cloudflare | Cloudflare Queues with HTTP pull consumers and an API token. | Docs | |
| Broadcasting | Memory | Development and tests; a single process. | Docs |
| Redis | Redis pub/sub. | Docs | |
| NATS | NATS subjects. | Docs | |
| RabbitMQ | An AMQP topic exchange. | Docs | |
| MQTT | An MQTT 5 broker; check session and delivery limits. | Docs | |
| Amazon SNS | Publishing to SNS and consuming from SQS. | Docs | |
| Log | Development: writes messages to the log instead of sending them. | Docs | |
| SMTP | An SMTP server; encrypted delivery is the default. | Docs | |
| Resend | A Resend API key and an authorized sender. | Docs | |
| Mailgun | A sending domain and private API key. | Docs | |
| Postmark | A server token and an authorized sender. | Docs | |
| Amazon SES | AWS credentials and SES sending permissions. | Docs | |
| Push notifications | Web Push | Visible browser notifications through standard encrypted Web Push, with application-owned subscriptions and service workers. | Docs |
| Payments | Memory | Local simulation without financial effects. | Docs |
| Stripe | Stripe credentials; hosted checkout, existing recurring Prices, and card SDK preparation. | Docs | |
| PayPal | Client credentials; Orders, explicit capture, and existing subscription Plans. | Docs | |
| Mollie | An API key and enabled creditcard profile; one-off hosted card payments and explicit refunds. | Docs | |
| Scheduled tasks | Memory | Development and tests; a single process. | Docs |
| Temporal | A Temporal service and worker host; persisted schedules and deferred workflows. | Docs | |
| Restate | A Restate deployment and registered endpoint; persisted tick chains and deferred jobs. | Docs | |
| Workflows | Memory | Development and tests; a single process. | Docs |
| Temporal | Temporal workflows and activities, with signals and timers. | Docs | |
| Restate | Restate workflow services, with signals and timers. | Docs | |
| Secrets | Memory | Development and tests. | Docs |
| Vault | A Vault KV v2 mount and token or login method with access to it. | Docs | |
| AWS | AWS Secrets Manager and credentials with secret access. | Docs | |
| Google Cloud | Secret Manager resources and Google credentials with secret access. | Docs | |
| Azure | A Key Vault URL and an identity with secret access. | Docs | |
| Encryption | AES | AES-GCM, the usual choice on hardware with AES support. | Docs |
| ChaCha20 | ChaCha20-Poly1305, for hardware without AES support. | Docs | |
| Hashing | Argon2 | Passwords. The recommended choice. | Docs |
| bcrypt | Passwords, when you need compatibility with existing bcrypt hashes. | Docs | |
| Telemetry | Memory | Trace IDs in logs and in-process inspection, without a backend. | Docs |
| OpenTelemetry | Exporting traces, metrics, and logs over OTLP. | Docs | |
| Prometheus | Metrics scraped by Prometheus. | Docs | |
| Language models | OpenAI | OpenAI credentials, or a compatible Responses/Chat Completions endpoint; capabilities vary by server and model. | Docs |
Protocol Adapters
Some driver modules adapt a protocol rather than implement a service’s Driver
interface. The MCP adapter serves application-owned mcp.Tool definitions from
arkoren.dev/core/mcp
over HTTP using the official Go SDK; it is not a storage backend or a language
model driver. Your First MCP Server shows registration
and HTTP serving; Securing MCP explains the authentication
and authorization boundaries.
The mcpserver API
provides the adapter’s constructor and transport settings.
For browser login or OIDC bearer verification, use the
OAuth adapter. It integrates with HTTP
authentication rather than implementing a service Driver interface. Provider
registration, callback URLs, and accepted token audiences remain explicit setup.
Webhook adapters authenticate provider requests and expose typed event definitions. They do not start receivers when you construct an outbound mail, payment, or LLM driver. Bind the events you accept and mount the endpoint yourself:
| Adapter | Notifications | |
|---|---|---|
| Stripe and PayPal | Payments and subscriptions. | Docs |
| Resend | Email lifecycle and inbound email. | Docs |
| Mailgun | Email delivery and engagement. | Docs |
| Postmark | Email delivery, engagement, and inbound email. | Docs |
| OpenAI | Background response lifecycle. | Docs |
Follow Receiving Webhooks for acceptance, retries, and deduplication, and Provider Adapters for authentication boundaries. The provider guides above own credential setup. Outbound calls do not require a webhook endpoint.
CAPTCHA adapters also live in vendor modules without a shared service contract. Choose the provider before its browser integration; tokens and acceptance policies differ:
| Adapter | Pick when | |
|---|---|---|
| Cloudflare Turnstile | You need token validity with hostname and action checks. | Docs |
| Google reCAPTCHA | You need a CreateAssessment risk score and an application-owned threshold or step-up policy. | Docs |
Both include optional route middleware. The CAPTCHA guide
shows decode-once handler verification and header-based middleware separately.
For adapter options, see the
cloudflarecaptcha API
and gcpcaptcha API.
Driver-Free Features
A few features need no driver of their own. Sessions store their data in any cache, so they use whichever cache driver you configured. Events are delivered in process by the application’s event bus. Secure links are computed from a secret and need no storage unless they are single-use.
After choosing a backend, follow its Docs link for construction, lifecycle ownership, and a first operation. If no available driver meets the contract you need, write an application-owned driver.