AuthEndpoints
Changelog
Composable Endpoints

Overview

Compose Identity management, sign-in stacks, and passkeys on the prefixes your host needs.

AuthEndpoints is designed as composable minimal API modules. The opinionated facade is one composition; advanced hosts assemble the same building blocks with custom paths and stacks.

Core idea

  1. Management is separate from sign-in
    • Lifecycle: MapIdentityManagementApi
    • Sign-in: compose one of MapCookieAuthEndpoints | MapBearerAuthEndpoints | MapJwtAuthEndpoints
  2. Optional passkeys — MapPasskeyEndpoints on another (or the same) prefix
  3. Map onto MapGroup(prefix) — paths are relative; hosts choose prefixes
  4. DI must match mapped modules — register services before mapping routes
  5. Pipeline prerequisites — rate limiting and antiforgery middleware for policies/CSRF to work
flowchart TB
  mgmt[MapIdentityManagementApi]
  signin[Cookie or Bearer or JWT]
  passkeys[MapPasskeyEndpoints]
  mgmt --> host[Your MapGroup prefixes]
  signin --> host
  passkeys --> host

Facade = one composition

MapAuthEndpoints maps:

  • Management + cookie under IdentityPath (default /identity)
  • Passkeys under PasskeyPath (default /account) when enabled
  • JWT under Jwt.Path (default /auth) when enabled

Next

  • Requirements — DI, pipeline, antiforgery, rate limits
  • Recipes — cookie SPA, bearer, JWT-only, custom paths

Production

Checklist for running AuthEndpoints safely in Production.

Requirements

Hard prerequisites for composing AuthEndpoints modules correctly.