AuthEndpoints
Changelog

Changelog

Release notes for AuthEndpoints. Each entry summarizes what shipped; full notes and assets live on GitHub Releases.
GitHub ReleasesGet started
AuthEndpoints on NuGetAuthEndpoints.External.OAuth on NuGet
Latest

v3.0.7

Hosts can redirect browser email confirmation to an SPA route with status and flow query params.

AuthEndpoints

Hosts can redirect browser email confirmation to an SPA route with status and flow query params. Set EmailConfirmation.ConfirmEmailRedirectUri to a rooted path or an absolute URI so browser GET confirm-email returns 302 with status and flow instead of the thank-you body or 401. Absolute URIs stay on AllowedRedirectOrigins. Unset hosts keep the existing text response.

  • Hosts can redirect browser email confirmation to an SPA route with status and flow query params
  • Absolute ConfirmEmailRedirectUri values stay on AllowedRedirectOrigins
  • Unset ConfirmEmailRedirectUri keeps the thank-you body or 401

Packages

  • AuthEndpoints 3.0.7
  • AuthEndpoints.External.OAuth unchanged at 3.0.0-preview.3

Links

Full release

v3.0.6

Simple JWT refresh rotation is atomic under concurrent requests.

AuthEndpoints

Simple JWT refresh rotation is atomic under concurrent requests. Concurrent refresh calls against the same live refresh cookie complete with a single successor.

  • Simple JWT refresh rotation is atomic under concurrent requests
  • Concurrent refresh of a live cookie does not issue a second live refresh cookie

Packages

  • AuthEndpoints 3.0.6
  • AuthEndpoints.External.OAuth unchanged at 3.0.0-preview.3

Links

Full release

v3.0.5

Passwordless passkey register sends confirmation email; register creates only new accounts.

AuthEndpoints

Passwordless passkey register sends the same confirmation email as password register after a successful account create. Register only creates a new account: the attested user id must be new. Signed-in POST /passkeys/ still adds passkeys to existing accounts.

  • Confirmation email is sent after passwordless register creates a user
  • Passwordless register requires a new attested user id
  • Existing accounts still add passkeys via signed-in POST /passkeys/

Packages

  • AuthEndpoints 3.0.5
  • AuthEndpoints.External.OAuth unchanged at 3.0.0-preview.3

Links

Full release

v3.0.4

Optional factory for the user id minted during passwordless passkey registration.

AuthEndpoints

Passwordless passkey registration still mints Guid.NewGuid() (UUID v4) by default. Apps can register IPasskeyUserIdFactory (or AddPasskeyUserIdFactory) to choose a different user id on RegisterOptions / Register. Cookie and Identity bearer facades are unchanged.

  • Default remains Guid.NewGuid().ToString() when no factory is registered
  • Passwordless register still supports only string and Guid Identity keys

Packages

  • AuthEndpoints 3.0.4
  • AuthEndpoints.External.OAuth unchanged at 3.0.0-preview.3

Links

Full release

v3.0.3

Identity bearer facade for native and mobile clients.

AuthEndpoints

Adds Identity bearer sign-in as a SignIn choice on the existing AddAuthEndpoints / MapAuthEndpoints facade, built from the existing management, bearer, passkey, and optional JWT modules.

  • AuthEndpointsSignIn.IdentityBearer maps Identity Login (JSON access and refresh tokens) at IdentityPath
  • Cookie default (AddAuthEndpoints / MapAuthEndpoints with SignIn = Cookie) is unchanged

Packages

  • AuthEndpoints 3.0.3
  • AuthEndpoints.External.OAuth unchanged at 3.0.0-preview.3

Links

Full release

v3.0.1

Passkey register and login honor CanSignInAsync / confirmed-account policy.

AuthEndpoints

Patch release on 3.0.0. Passkey register and login now call Identity CanSignInAsync before establishing a session or issuing tokens, so confirmed-account (and other Identity sign-in) policy matches password and OAuth.

  • Unconfirmed register still returns the new credential without a session
  • Unconfirmed login returns 401, same shape as Identity login

Packages

  • AuthEndpoints 3.0.1
  • AuthEndpoints.External.OAuth unchanged at 3.0.0-preview.3

Links

Full release
Preview

AuthEndpoints.External.OAuth 3.0.0-preview.3

Retarget the preview OAuth package to depend on stable AuthEndpoints 3.0.0.

AuthEndpoints.External.OAuth

  • Bump to 3.0.0-preview.3 so the packed nupkg depends on AuthEndpoints 3.0.0 (published 3.0.0-preview.2 still depends on 3.0.0-rc.2)
  • No OAuth feature changes; the package remains preview and is not part of the core 3.0 GA

Links

Full release

v3.0.0

First stable 3.0 release — opinionated facade, cookie / bearer / JWT, passkeys, 2FA, and ReAuth on .NET 10.

AuthEndpoints

3.0 is the first stable release of the rewritten Identity auth stack. Last feature work was rc.4 (pluggable passkey sign-in); this cut is version and docs only.

  • Opinionated facade: AddAuthEndpoints / UseAuthEndpoints / MapAuthEndpoints (cookie Identity + passkeys by default; JWT opt-in)
  • Sign-in stacks you choose: cookie sessions, Identity bearer tokens, or Simple JWT (hashed refresh tokens, production issuer/audience/key validation)
  • Passkeys (WebAuthn) for passwordless register and login, including pluggable IPasskeySignInCompleter<TUser> (IdentityPasskeySignInCompleter and JwtPasskeySignInCompleter)
  • Account lifecycle: register, confirm email, forgot/reset password, manage info and 2FA
  • Step-up ReAuth for sensitive manage and passkey mutations
  • Roles-aware AddAuthEndpoints<TUser, TRole, TContext> so Identity IRoleStore registers correctly
  • .NET 10 (net10.0)

Packages

  • AuthEndpoints 3.0.0
  • AuthEndpoints.External.OAuth remains a separate preview package (3.0.0-preview.3, retargeted at this core)

Links

Full release
RC

v3.0.0-rc.4

Pluggable passkey sign-in completer with Simple JWT support.

AuthEndpoints

  • Added IPasskeySignInCompleter<TUser> so passkey register/login completion is pluggable (same idea as External.OAuth completers)
  • Default IdentityPasskeySignInCompleter preserves cookie / Identity bearer scheme selection via useCookies / useSessionCookies
  • Added JwtPasskeySignInCompleter for Simple JWT access token + refresh cookie after passwordless register/login
  • Added AddPasskeyEndpoints<TUser>() and AddPasskeySignInCompleter<TUser, TCompleter>(); facade registers the generic passkey DI overload

Packages

  • AuthEndpoints 3.0.0-rc.4
  • AuthEndpoints.External.OAuth (unchanged)

Links

Full release
Preview

AuthEndpoints.External.OAuth 3.0.0-preview.2

Production hardening — verified email, safer linking, error redirects, JWT completer, account link/unlink.

AuthEndpoints.External.OAuth

  • Require verified email by default; auto-link by email only when verified
  • Clear Identity.External cookie after successful sign-in / link
  • Stricter returnUrl (relative-only by default; optional origin allowlist)
  • Options validation for External settings and provider ClientId/Secret
  • Browser error redirects to ErrorPath (JSON Problem when client prefers JSON)
  • AddLoginRateLimiting registered from AddExternalAuthEndpoints
  • JwtExternalLoginCompleter for JWT refresh-cookie completion
  • MapExternalAccountEndpoints for list / link / unlink while signed in

Links

Full release
RC

v3.0.0-rc.3

Roles-aware AddAuthEndpoints overload and public login rate-limiting API.

AuthEndpoints

  • Added AddAuthEndpoints<TUser, TRole, TContext> so Identity roles register IRoleStore correctly (no second AddEntityFrameworkStores after AddRoles)
  • Made AddLoginRateLimiting / AddIdentityEndpointRateLimiting public for compose scenarios (e.g. AuthEndpoints.External.OAuth)

Packages

  • AuthEndpoints 3.0.0-rc.3
  • AuthEndpoints.External.OAuth (unchanged) 3.0.0-preview.2 — requires AuthEndpoints rc.3+ for AddLoginRateLimiting

Links

Full release
Preview

AuthEndpoints.External.OAuth 3.0.0-preview.1

First preview of modular GitHub/Google OAuth endpoints.

AuthEndpoints.External.OAuth

  • Added AuthEndpoints.External.OAuth as a separate preview NuGet package
  • Shared Core: AddExternalAuthEndpoints, provisioning service, pluggable cookie completer, shared login/callback handlers
  • GitHub and Google provider modules (AddGitHub / MapGitHubAuthEndpoints, AddGoogle / MapGoogleAuthEndpoints)
  • Default completion issues an Identity application cookie; AddCompleter<T> for future JWT (or other) modes
  • Compose-only — not wired into the AddAuthEndpoints facade

Links

Full release
RC

v3.0.0-rc.2

Split Identity management from sign-in and harden JWT defaults.

Changed

  • Split Identity management from sign-in so hosts can compose cookie, bearer, or JWT stacks independently
  • Hardened JWT defaults (hashed refresh tokens, production issuer/audience/key validation)

Links

Full release
RC

v3.0.0-rc.1

Identity/Passkey hardening and the opinionated AddAuthEndpoints facade.

Added

  • Opinionated facade: AddAuthEndpoints / UseAuthEndpoints / MapAuthEndpoints
  • Identity cookie and bearer endpoint integration tests

Changed

  • Hardened Identity and Passkey flows for the 3.0 release candidate

Links

Full release
Alpha

3.0.0-alpha.11

Hardened JWT auth and finished passwordless PasskeyEndpoints.

Added

  • Passwordless PasskeyEndpoints (register / login / manage credentials)

Changed

  • Hardened JWT authentication and refresh-token handling

Links

Full release
Alpha

v3.0.0-alpha.1

Cookie auth, Identity API endpoints, and step-up ReAuth — start of the 3.0 line.

Added

  • Cookie authentication endpoints
  • Leverage official ASP.NET Core Identity API endpoints
  • Step-up reauthentication via /confirmIdentity

Changed

  • Reorganized and simplified project structure
  • Breaking changes expected along the 3.0 alpha path

Links

Full release