AuthEndpoints
Changelog
Composable Endpoints

Overview

Compose Identity management, sign-in stacks, and passkeys on the prefixes your host needs.

AuthEndpoints is designed as composable minimal API modules. Each facade is one composition. Advanced hosts assemble the same building blocks with custom paths and stacks.

Core idea

  1. Management is separate from sign-in
    • Lifecycle: MapIdentityManagementApi
    • Sign-in: compose one of MapCookieAuthEndpoints | MapBearerAuthEndpoints | MapJwtAuthEndpoints
  2. Optional passkeys — MapPasskeyEndpoints on another (or the same) prefix
  3. Map onto MapGroup(prefix) — paths are relative; hosts choose prefixes
  4. DI must match mapped modules — register services before mapping routes
  5. Pipeline prerequisites — rate limiting and antiforgery middleware for policies/CSRF to work
flowchart TB
  mgmt[MapIdentityManagementApi]
  signin[Cookie or Bearer or JWT]
  passkeys[MapPasskeyEndpoints]
  mgmt --> host[Your MapGroup prefixes]
  signin --> host
  passkeys --> host

Facade = one composition

MapAuthEndpoints maps:

  • Management plus cookie or Identity bearer sign-in under IdentityPath (default /identity), from AuthEndpointsOptions.SignIn
  • Passkeys under PasskeyPath (default /account) when enabled
  • JWT under Jwt.Path (default /auth) when enabled

Next

  • Requirements — DI, pipeline, antiforgery, rate limits
  • Recipes — cookie web, bearer, JWT-only, custom paths

Sign in with a passkey

Passwordless login for a confirmed account on the cookie facade.

Requirements

Hard prerequisites for composing AuthEndpoints modules correctly.