AuthEndpoints

Ready-made ASP.NET Core Identity auth endpoints for web and mobile clients. Map cookie, JWT, and passkey flows — or compose only what you need.

Get started

GitHub

Program.cs

builder.Services.AddAuthEndpoints<AppUser, AppDbContext>(o =>
{
    o.Passkeys.ServerDomain = "example.com";
});
builder.Services.AddTransient<IEmailSender<AppUser>, MyEmailSender>();

var app = builder.Build();
app.UseAuthEndpoints();
app.MapAuthEndpoints<AppUser>();

Built for first-party API auth

Ship registration, sign-in, and account management without wiring every Identity endpoint yourself.

Opinionated quick start

AddAuthEndpoints / UseAuthEndpoints / MapAuthEndpoints give you cookie Identity and passkeys with secure defaults.

Composable modules

Mix management, cookie, bearer, JWT, and passkeys on the route prefixes your host needs.

Cookie, JWT, and passkeys

Choose cookie sessions, Identity bearer tokens, JWT with refresh cookies, and WebAuthn passwordless.

Hardened defaults

Rate limiting, antiforgery for cookie flows, lockout-aware login, and hashed JWT refresh tokens with reuse detection.

ReAuth step-up

Confirm identity before sensitive manage and passkey mutations — cookie or header token for APIs.

Production validators

Production rejects no-op email senders, missing passkey domains, and default JWT issuer/audience values.

Map auth in minutes

Start with the facade, then compose modules when you need custom paths or a JWT-only stack.

Quick start

Composable endpoints