AuthEndpoints
Changelog

Changelog

Release notes for AuthEndpoints. Each entry summarizes what shipped; full notes and assets live on GitHub Releases.
GitHub ReleasesGet started
Preview

AuthEndpoints.External.OAuth 3.0.0-preview.2

Production hardening — verified email, safer linking, error redirects, JWT completer, account link/unlink.

AuthEndpoints.External.OAuth

  • Require verified email by default; auto-link by email only when verified
  • Clear Identity.External cookie after successful sign-in / link
  • Stricter returnUrl (relative-only by default; optional origin allowlist)
  • Options validation for External settings and provider ClientId/Secret
  • Browser error redirects to ErrorPath (JSON Problem when client prefers JSON)
  • AddLoginRateLimiting registered from AddExternalAuthEndpoints
  • JwtExternalLoginCompleter for JWT refresh-cookie completion
  • MapExternalAccountEndpoints for list / link / unlink while signed in

Links

Full release
Latest

v3.0.0-rc.3

Roles-aware AddAuthEndpoints overload and public login rate-limiting API.

AuthEndpoints

  • Added AddAuthEndpoints<TUser, TRole, TContext> so Identity roles register IRoleStore correctly (no second AddEntityFrameworkStores after AddRoles)
  • Made AddLoginRateLimiting / AddIdentityEndpointRateLimiting public for compose scenarios (e.g. AuthEndpoints.External.OAuth)

Packages

  • AuthEndpoints 3.0.0-rc.3
  • AuthEndpoints.External.OAuth (unchanged) 3.0.0-preview.2 — requires AuthEndpoints rc.3+ for AddLoginRateLimiting

Links

Full release
Preview

AuthEndpoints.External.OAuth 3.0.0-preview.1

First preview of modular GitHub/Google OAuth endpoints.

AuthEndpoints.External.OAuth

  • Added AuthEndpoints.External.OAuth as a separate preview NuGet package
  • Shared Core: AddExternalAuthEndpoints, provisioning service, pluggable cookie completer, shared login/callback handlers
  • GitHub and Google provider modules (AddGitHub / MapGitHubAuthEndpoints, AddGoogle / MapGoogleAuthEndpoints)
  • Default completion issues an Identity application cookie; AddCompleter<T> for future JWT (or other) modes
  • Compose-only — not wired into the AddAuthEndpoints facade

Links

Full release
RC

v3.0.0-rc.2

Split Identity management from sign-in and harden JWT defaults.

Changed

  • Split Identity management from sign-in so hosts can compose cookie, bearer, or JWT stacks independently
  • Hardened JWT defaults (hashed refresh tokens, production issuer/audience/key validation)

Links

Full release
RC

v3.0.0-rc.1

Identity/Passkey hardening and the opinionated AddAuthEndpoints facade.

Added

  • Opinionated facade: AddAuthEndpoints / UseAuthEndpoints / MapAuthEndpoints
  • Identity cookie and bearer endpoint integration tests

Changed

  • Hardened Identity and Passkey flows for the 3.0 release candidate

Links

Full release
Alpha

3.0.0-alpha.11

Hardened JWT auth and finished passwordless PasskeyEndpoints.

Added

  • Passwordless PasskeyEndpoints (register / login / manage credentials)

Changed

  • Hardened JWT authentication and refresh-token handling

Links

Full release
Alpha

v3.0.0-alpha.1

Cookie auth, Identity API endpoints, and step-up ReAuth — start of the 3.0 line.

Added

  • Cookie authentication endpoints
  • Leverage official ASP.NET Core Identity API endpoints
  • Step-up reauthentication via /confirmIdentity

Changed

  • Reorganized and simplified project structure
  • Breaking changes expected along the 3.0 alpha path

Links

Full release