[{"data":1,"prerenderedAt":1404},["ShallowReactive",2],{"navigation":3,"\u002Fconcepts\u002Fstock-identity-vs-authendpoints":203,"\u002Fconcepts\u002Fstock-identity-vs-authendpoints-surround":1399},[4,33,96,114,177],{"title":5,"path":6,"stem":7,"children":8,"icon":32},"Get started","\u002Fgetting-started","1.getting-started\u002F1.index",[9,12,17,22,27],{"title":10,"path":6,"stem":7,"icon":11},"Introduction","i-lucide-house",{"title":13,"path":14,"stem":15,"icon":16},"Install AuthEndpoints","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F2.installation","i-lucide-download",{"title":18,"path":19,"stem":20,"icon":21},"Quick start","\u002Fgetting-started\u002Fquick-start","1.getting-started\u002F3.quick-start","i-lucide-play",{"title":23,"path":24,"stem":25,"icon":26},"Choose a sign-in stack","\u002Fgetting-started\u002Fchoose-a-sign-in-stack","1.getting-started\u002F4.choose-a-sign-in-stack","i-lucide-signpost",{"title":28,"path":29,"stem":30,"icon":31},"Use the AuthEndpoints skill with coding agents","\u002Fgetting-started\u002Fai-agents","1.getting-started\u002F5.ai-agents","i-lucide-bot","i-lucide-rocket",{"title":34,"path":35,"stem":36,"children":37,"icon":95},"Guides","\u002Fguides","2.guides\u002F01.index",[38,40,45,50,55,60,65,70,75,80,85,90],{"title":34,"path":35,"stem":36,"icon":39},"i-lucide-list-checks",{"title":41,"path":42,"stem":43,"icon":44},"Register users","\u002Fguides\u002Fregistration","2.guides\u002F02.registration","i-lucide-user-plus",{"title":46,"path":47,"stem":48,"icon":49},"Sign users in","\u002Fguides\u002Fsign-in","2.guides\u002F03.sign-in","i-lucide-log-in",{"title":51,"path":52,"stem":53,"icon":54},"Sign users out","\u002Fguides\u002Fsign-out","2.guides\u002F04.sign-out","i-lucide-log-out",{"title":56,"path":57,"stem":58,"icon":59},"Turn on two-factor authentication","\u002Fguides\u002Ftwo-factor","2.guides\u002F05.two-factor","i-lucide-smartphone",{"title":61,"path":62,"stem":63,"icon":64},"Reset a forgotten password","\u002Fguides\u002Freset-password","2.guides\u002F06.reset-password","i-lucide-key-round",{"title":66,"path":67,"stem":68,"icon":69},"Change a user's email or password","\u002Fguides\u002Fmanage-account","2.guides\u002F07.manage-account","i-lucide-user-cog",{"title":71,"path":72,"stem":73,"icon":74},"Add, rename, and remove passkeys","\u002Fguides\u002Fmanage-passkeys","2.guides\u002F08.manage-passkeys","i-lucide-scan-face",{"title":76,"path":77,"stem":78,"icon":79},"Link and unlink GitHub or Google accounts","\u002Fguides\u002Flink-external-accounts","2.guides\u002F09.link-external-accounts","i-lucide-link",{"title":81,"path":82,"stem":83,"icon":84},"Require step-up before sensitive actions","\u002Fguides\u002Fstep-up","2.guides\u002F10.step-up","i-lucide-shield-check",{"title":86,"path":87,"stem":88,"icon":89},"Call the API from a browser","\u002Fguides\u002Fbrowser-clients","2.guides\u002F11.browser-clients","i-lucide-globe",{"title":91,"path":92,"stem":93,"icon":94},"Prepare for production","\u002Fguides\u002Fproduction","2.guides\u002F12.production","i-lucide-factory","i-lucide-waypoints",{"title":97,"path":98,"stem":99,"children":100,"icon":113},"Composable endpoints","\u002Fcomposables","3.composables\u002F1.index",[101,104,108],{"title":102,"path":98,"stem":99,"icon":103},"How composition works","i-lucide-layout-grid",{"title":105,"path":106,"stem":107,"icon":39},"Composition requirements","\u002Fcomposables\u002Frequirements","3.composables\u002F2.requirements",{"title":109,"path":110,"stem":111,"icon":112},"Compose a custom auth stack","\u002Fcomposables\u002Frecipes","3.composables\u002F3.recipes","i-lucide-book-marked","i-lucide-blocks",{"title":115,"icon":116,"path":117,"stem":118,"children":119,"page":176},"Reference","i-lucide-book-open","\u002Fmodules","4.modules",[120,125,129,134,139,144,148,153,157,162,166,171],{"title":121,"path":122,"stem":123,"icon":124},"Endpoint reference","\u002Fmodules\u002Fendpoints","4.modules\u002F01.endpoints","i-lucide-route",{"title":126,"path":127,"stem":128,"icon":69},"Identity management module","\u002Fmodules\u002Fidentity-management","4.modules\u002F02.identity-management",{"title":130,"path":131,"stem":132,"icon":133},"Cookie sign-in module","\u002Fmodules\u002Fcookie-auth","4.modules\u002F03.cookie-auth","i-lucide-cookie",{"title":135,"path":136,"stem":137,"icon":138},"Identity bearer sign-in module","\u002Fmodules\u002Fbearer-auth","4.modules\u002F04.bearer-auth","i-lucide-key",{"title":140,"path":141,"stem":142,"icon":143},"JWT module","\u002Fmodules\u002Fjwt","4.modules\u002F05.jwt","i-lucide-fingerprint",{"title":145,"path":146,"stem":147,"icon":74},"Passkeys module","\u002Fmodules\u002Fpasskeys","4.modules\u002F06.passkeys",{"title":149,"path":150,"stem":151,"icon":152},"ReAuth module","\u002Fmodules\u002Freauth","4.modules\u002F07.reauth","i-lucide-shield-alert",{"title":154,"path":155,"stem":156,"icon":49},"External OAuth packages","\u002Fmodules\u002Fexternal-oauth","4.modules\u002F08.external-oauth",{"title":158,"path":159,"stem":160,"icon":161},"Configuration options","\u002Fmodules\u002Fconfiguration","4.modules\u002F09.configuration","i-lucide-settings",{"title":163,"path":164,"stem":165,"icon":84},"Antiforgery (CSRF) rules","\u002Fmodules\u002Fcsrf","4.modules\u002F10.csrf",{"title":167,"path":168,"stem":169,"icon":170},"Responses and errors","\u002Fmodules\u002Ferrors","4.modules\u002F11.errors","i-lucide-circle-alert",{"title":172,"path":173,"stem":174,"icon":175},"Rate-limit policies","\u002Fmodules\u002Frate-limits","4.modules\u002F12.rate-limits","i-lucide-gauge",false,{"title":178,"icon":179,"path":180,"stem":181,"children":182,"page":176},"Concepts","i-lucide-lightbulb","\u002Fconcepts","5.concepts",[183,188,193,198],{"title":184,"path":185,"stem":186,"icon":187},"AuthEndpoints compared with other options","\u002Fconcepts\u002Fcompare","5.concepts\u002F1.compare","i-lucide-git-compare",{"title":189,"path":190,"stem":191,"icon":192},"Stock Identity endpoints vs AuthEndpoints","\u002Fconcepts\u002Fstock-identity-vs-authendpoints","5.concepts\u002F2.stock-identity-vs-authendpoints","i-lucide-columns-2",{"title":194,"path":195,"stem":196,"icon":197},"Security model","\u002Fconcepts\u002Fsecurity-model","5.concepts\u002F3.security-model","i-lucide-shield",{"title":199,"path":200,"stem":201,"icon":202},"FAQ","\u002Fconcepts\u002Ffaq","5.concepts\u002F4.faq","i-lucide-circle-help",{"id":204,"title":189,"body":205,"description":1392,"extension":1393,"links":1394,"meta":1395,"navigation":1396,"path":190,"seo":1397,"stem":191,"__hash__":1398},"docs\u002F5.concepts\u002F2.stock-identity-vs-authendpoints.md",{"type":206,"value":207,"toc":1379},"minimark",[208,240,260,281,301,311,316,324,457,460,464,644,653,677,681,847,852,856,1015,1030,1034,1152,1157,1161,1317,1324,1328,1343,1347,1375],[209,210,211,212,216,217,221,222,225,226,229,230,221,233,221,236,239],"p",{},"Both stacks sit on ASP.NET Core Identity and your EF user store. ",[213,214,215],"strong",{},"Stock"," here means Microsoft's Identity API endpoints (",[218,219,220],"code",{},"AddIdentityApiEndpoints"," \u002F ",[218,223,224],{},"MapIdentityApi",") or the same routes written by hand. ",[213,227,228],{},"AuthEndpoints"," means the cookie facade: ",[218,231,232],{},"AddAuthEndpoints",[218,234,235],{},"UseAuthEndpoints",[218,237,238],{},"MapAuthEndpoints",".",[209,241,242,243,246,247,246,250,246,253,246,256,259],{},"Request bodies stay Identity-shaped (",[218,244,245],{},"RegisterRequest",", ",[218,248,249],{},"LoginRequest",[218,251,252],{},"ForgotPasswordRequest",[218,254,255],{},"ResetPasswordRequest",[218,257,258],{},"TwoFactorRequest","). AuthEndpoints maps the routes and adds cookie login, CSRF where required, rate limits, and ReAuth. It does not invent alternate DTOs.",[209,261,262,263,266,267,270,271,273,274,277,278,239],{},"AuthEndpoints tables use the facade default prefix ",[218,264,265],{},"\u002Fidentity"," (",[218,268,269],{},"IdentityPath","). Stock ",[218,272,224],{}," has ",[213,275,276],{},"no"," built-in prefix unless the host wraps it in ",[218,279,280],{},"MapGroup",[209,282,283,284,287,288,291,292,246,295,270,298,300],{},"AuthEndpoints-only on this surface: ",[218,285,286],{},"GET \u002Fidentity\u002FcsrfToken",", cookie ",[218,289,290],{},"POST \u002Fidentity\u002Flogout",", and ReAuth (",[218,293,294],{},"\u002Fmanage\u002FauthMethods",[218,296,297],{},"\u002FconfirmIdentity",[218,299,224],{}," does not map logout.",[209,302,303,304,307,308,239],{},"Client steps for these flows: ",[305,306,34],"a",{"href":35},". Product positioning against OpenIddict: ",[305,309,310],{"href":185},"Compare",[312,313,315],"h2",{"id":314},"host-setup","Host setup",[317,318,320,321,323],"h3",{"id":319},"stock-mapidentityapi","Stock (",[218,322,224],{},")",[325,326,331],"pre",{"className":327,"code":328,"language":329,"meta":330,"style":330},"language-cs shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","builder.Services\n    .AddIdentityApiEndpoints\u003CAppUser>()\n    .AddEntityFrameworkStores\u003CAppDbContext>();\n\nvar app = builder.Build();\n\n\u002F\u002F Optional prefix — without MapGroup, routes are at the app root (\u002Fregister, \u002Flogin, …).\napp.MapGroup(\"\u002Fidentity\").MapIdentityApi\u003CAppUser>();\n","cs","",[218,332,333,348,367,383,390,413,418,425],{"__ignoreMap":330},[334,335,338,342,345],"span",{"class":336,"line":337},"line",1,[334,339,341],{"class":340},"sTEyZ","builder",[334,343,239],{"class":344},"sMK4o",[334,346,347],{"class":340},"Services\n",[334,349,351,354,357,360,364],{"class":336,"line":350},2,[334,352,353],{"class":344},"    .",[334,355,220],{"class":356},"s2Zo4",[334,358,359],{"class":344},"\u003C",[334,361,363],{"class":362},"sBMFI","AppUser",[334,365,366],{"class":344},">()\n",[334,368,370,372,375,377,380],{"class":336,"line":369},3,[334,371,353],{"class":344},[334,373,374],{"class":356},"AddEntityFrameworkStores",[334,376,359],{"class":344},[334,378,379],{"class":362},"AppDbContext",[334,381,382],{"class":344},">();\n",[334,384,386],{"class":336,"line":385},4,[334,387,389],{"emptyLinePlaceholder":388},true,"\n",[334,391,393,396,399,402,405,407,410],{"class":336,"line":392},5,[334,394,395],{"class":362},"var",[334,397,398],{"class":362}," app",[334,400,401],{"class":344}," =",[334,403,404],{"class":340}," builder",[334,406,239],{"class":344},[334,408,409],{"class":356},"Build",[334,411,412],{"class":344},"();\n",[334,414,416],{"class":336,"line":415},6,[334,417,389],{"emptyLinePlaceholder":388},[334,419,421],{"class":336,"line":420},7,[334,422,424],{"class":423},"sHwdD","\u002F\u002F Optional prefix — without MapGroup, routes are at the app root (\u002Fregister, \u002Flogin, …).\n",[334,426,428,431,433,435,438,441,444,446,449,451,453,455],{"class":336,"line":427},8,[334,429,430],{"class":340},"app",[334,432,239],{"class":344},[334,434,280],{"class":356},[334,436,437],{"class":344},"(",[334,439,440],{"class":344},"\"",[334,442,265],{"class":443},"sfazB",[334,445,440],{"class":344},[334,447,448],{"class":344},").",[334,450,224],{"class":356},[334,452,359],{"class":344},[334,454,363],{"class":362},[334,456,382],{"class":344},[209,458,459],{},"You still wire authentication, authorization, antiforgery, CORS, and rate limiting yourself. Login is bearer-first unless the client passes cookie query flags.",[317,461,463],{"id":462},"authendpoints-cookie-facade","AuthEndpoints (cookie facade)",[325,465,467],{"className":327,"code":466,"language":329,"meta":330,"style":330},"builder.Services.AddAuthEndpoints\u003CAppUser, AppDbContext>(o =>\n{\n    o.Passkeys.Enabled = false; \u002F\u002F thin cookie path; omit or set ServerDomain when passkeys stay on\n    o.Jwt.Enabled = false;\n});\nbuilder.Services.AddTransient\u003CIEmailSender\u003CAppUser>, MyEmailSender>();\n\nvar app = builder.Build();\n\napp.UseAuthEndpoints(); \u002F\u002F authentication, authorization, rate limiting, antiforgery\napp.MapAuthEndpoints\u003CAppUser>();\n",[218,468,469,501,506,534,554,559,589,593,609,614,629],{"__ignoreMap":330},[334,470,471,473,475,478,480,482,484,486,489,492,495,498],{"class":336,"line":337},[334,472,341],{"class":340},[334,474,239],{"class":344},[334,476,477],{"class":340},"Services",[334,479,239],{"class":344},[334,481,232],{"class":356},[334,483,359],{"class":344},[334,485,363],{"class":362},[334,487,488],{"class":344},",",[334,490,491],{"class":362}," AppDbContext",[334,493,494],{"class":344},">(",[334,496,497],{"class":362},"o",[334,499,500],{"class":344}," =>\n",[334,502,503],{"class":336,"line":350},[334,504,505],{"class":344},"{\n",[334,507,508,511,513,516,518,521,524,528,531],{"class":336,"line":369},[334,509,510],{"class":340},"    o",[334,512,239],{"class":344},[334,514,515],{"class":340},"Passkeys",[334,517,239],{"class":344},[334,519,520],{"class":340},"Enabled ",[334,522,523],{"class":344},"=",[334,525,527],{"class":526},"sfNiH"," false",[334,529,530],{"class":344},";",[334,532,533],{"class":423}," \u002F\u002F thin cookie path; omit or set ServerDomain when passkeys stay on\n",[334,535,536,538,540,543,545,547,549,551],{"class":336,"line":385},[334,537,510],{"class":340},[334,539,239],{"class":344},[334,541,542],{"class":340},"Jwt",[334,544,239],{"class":344},[334,546,520],{"class":340},[334,548,523],{"class":344},[334,550,527],{"class":526},[334,552,553],{"class":344},";\n",[334,555,556],{"class":336,"line":392},[334,557,558],{"class":344},"});\n",[334,560,561,563,565,567,569,572,574,577,579,581,584,587],{"class":336,"line":415},[334,562,341],{"class":340},[334,564,239],{"class":344},[334,566,477],{"class":340},[334,568,239],{"class":344},[334,570,571],{"class":356},"AddTransient",[334,573,359],{"class":344},[334,575,576],{"class":362},"IEmailSender",[334,578,359],{"class":344},[334,580,363],{"class":362},[334,582,583],{"class":344},">,",[334,585,586],{"class":362}," MyEmailSender",[334,588,382],{"class":344},[334,590,591],{"class":336,"line":420},[334,592,389],{"emptyLinePlaceholder":388},[334,594,595,597,599,601,603,605,607],{"class":336,"line":427},[334,596,395],{"class":362},[334,598,398],{"class":362},[334,600,401],{"class":344},[334,602,404],{"class":340},[334,604,239],{"class":344},[334,606,409],{"class":356},[334,608,412],{"class":344},[334,610,612],{"class":336,"line":611},9,[334,613,389],{"emptyLinePlaceholder":388},[334,615,617,619,621,623,626],{"class":336,"line":616},10,[334,618,430],{"class":340},[334,620,239],{"class":344},[334,622,235],{"class":356},[334,624,625],{"class":344},"();",[334,627,628],{"class":423}," \u002F\u002F authentication, authorization, rate limiting, antiforgery\n",[334,630,632,634,636,638,640,642],{"class":336,"line":631},11,[334,633,430],{"class":340},[334,635,239],{"class":344},[334,637,238],{"class":356},[334,639,359],{"class":344},[334,641,363],{"class":362},[334,643,382],{"class":344},[209,645,646,647,650,651,239],{},"Passkeys and JWT are off. When you leave passkeys enabled (facade default), set ",[218,648,649],{},"Passkeys.ServerDomain"," in Production. See ",[305,652,18],{"href":19},[209,654,655,656,246,659,662,663,666,667,670,671,674,675,239],{},"CSRF on the AuthEndpoints cookie stack applies to cookie ",[213,657,658],{},"logout",[213,660,661],{},"manage"," POSTs, ",[213,664,665],{},"ReAuth",", authenticated ",[213,668,669],{},"resendConfirmationEmail",", and every passkey route except the list. It does ",[213,672,673],{},"not"," apply to register, login, forgotPassword, or resetPassword. See ",[305,676,163],{"href":164},[312,678,680],{"id":679},"register","Register",[682,683,684,699],"table",{},[685,686,687],"thead",{},[688,689,690,693,696],"tr",{},[691,692],"th",{},[691,694,695],{},"Stock Identity API",[691,697,698],{},"AuthEndpoints facade",[700,701,702,724,741,759,774,791,807,836],"tbody",{},[688,703,704,708,720],{},[705,706,707],"td",{},"Route",[705,709,710,713,714,717,718,323],{},[218,711,712],{},"POST \u002Fregister"," (or ",[218,715,716],{},"POST \u002Fidentity\u002Fregister"," with ",[218,719,280],{},[705,721,722],{},[218,723,716],{},[688,725,726,729,738],{},[705,727,728],{},"Body",[705,730,731,732,246,735,323],{},"Identity register (",[218,733,734],{},"email",[218,736,737],{},"password",[705,739,740],{},"Same Identity body",[688,742,743,746,749],{},[705,744,745],{},"CSRF",[705,747,748],{},"Host policy (endpoint does not require antiforgery by default)",[705,750,751,754,755,758],{},[213,752,753],{},"Not"," required (",[218,756,757],{},"RequireAntiforgery"," is not on register)",[688,760,761,764,770],{},[705,762,763],{},"Duplicate email",[705,765,766,769],{},[218,767,768],{},"200"," (no enumeration)",[705,771,772,769],{},[218,773,768],{},[688,775,776,779,782],{},[705,777,778],{},"Confirmed-account policy",[705,780,781],{},"Host Identity options",[705,783,784,787,788],{},[218,785,786],{},"RequireConfirmedAccount"," default ",[218,789,790],{},"true",[688,792,793,798,801],{},[705,794,795,796],{},"After ",[218,797,768],{},[705,799,800],{},"Not signed in",[705,802,803,804,806],{},"Not signed in (",[218,805,768],{}," ≠ session)",[688,808,809,812,817],{},[705,810,811],{},"Confirm",[705,813,814],{},[218,815,816],{},"GET …\u002FconfirmEmail?userId&code",[705,818,819,822,823,826,827,717,830,221,833],{},[218,820,821],{},"GET \u002Fidentity\u002FconfirmEmail?userId&code",", then login. Optional ",[218,824,825],{},"ConfirmEmailRedirectUri"," → ",[218,828,829],{},"302",[218,831,832],{},"status",[218,834,835],{},"flow",[688,837,838,841,844],{},[705,839,840],{},"Rate limit",[705,842,843],{},"Host-owned",[705,845,846],{},"Built-in account rate limits",[209,848,849,850,239],{},"Client flow: register → check email → confirm → login. Steps: ",[305,851,41],{"href":42},[312,853,855],{"id":854},"login","Login",[682,857,858,868],{},[685,859,860],{},[688,861,862,864,866],{},[691,863],{},[691,865,695],{},[691,867,698],{},[700,869,870,887,902,918,939,967,977,992,1004],{},[688,871,872,874,882],{},[705,873,707],{},[705,875,876,879,880,323],{},[218,877,878],{},"POST \u002Flogin"," (or under your ",[218,881,280],{},[705,883,884],{},[218,885,886],{},"POST \u002Fidentity\u002Flogin",[688,888,889,892,897],{},[705,890,891],{},"Handler",[705,893,894,895],{},"Identity ",[218,896,855],{},[705,898,899],{},[218,900,901],{},"LoginCookie",[688,903,904,906,910],{},[705,905,728],{},[705,907,894,908],{},[218,909,249],{},[705,911,912,913,246,915,917],{},"Same (",[218,914,734],{},[218,916,737],{},", optional 2FA fields)",[688,919,920,923,929],{},[705,921,922],{},"Default success",[705,924,925,926,323],{},"Identity bearer tokens (",[218,927,928],{},"AccessTokenResponse",[705,930,931,932,266,935,938],{},"Application cookie only (no bearer): empty body + ",[218,933,934],{},"Set-Cookie",[218,936,937],{},"TypedResults.Empty","). Session when the flag is omitted",[688,940,941,944,953],{},[705,942,943],{},"Cookie query flags",[705,945,946,221,949,952],{},[218,947,948],{},"useCookies",[218,950,951],{},"useSessionCookies"," select cookie vs bearer",[705,954,955,958,959,266,961,963,964],{},[213,956,957],{},"Only"," ",[218,960,951],{},[218,962,948],{}," ignored). Persistent: ",[218,965,966],{},"?useSessionCookies=false",[688,968,969,972,975],{},[705,970,971],{},"CSRF on login",[705,973,974],{},"Not required",[705,976,974],{},[688,978,979,982,987],{},[705,980,981],{},"Logout",[705,983,984,985],{},"Not in ",[218,986,224],{},[705,988,989,991],{},[218,990,290],{}," (auth + CSRF)",[688,993,994,997,999],{},[705,995,996],{},"CSRF helper",[705,998,843],{},[705,1000,1001,1003],{},[218,1002,286],{}," for logout, manage, ReAuth, resend",[688,1005,1006,1009,1012],{},[705,1007,1008],{},"Lockout",[705,1010,1011],{},"Identity lockout",[705,1013,1014],{},"Lockout + login rate limit",[209,1016,1017,1018,1021,1022,1025,1026,1029],{},"Full flag tables: ",[305,1019,1020],{"href":131},"Cookie auth",". Bearer-style Identity login stays available via compose (",[218,1023,1024],{},"MapBearerAuthEndpoints",") or ",[218,1027,1028],{},"SignIn = IdentityBearer",". It is not the cookie-facade default.",[312,1031,1033],{"id":1032},"password-reset","Password reset",[682,1035,1036,1046],{},[685,1037,1038],{},[688,1039,1040,1042,1044],{},[691,1041],{},[691,1043,695],{},[691,1045,698],{},[700,1047,1048,1071,1080,1094,1108,1127,1136],{},[688,1049,1050,1053,1064],{},[705,1051,1052],{},"Forgot",[705,1054,1055,958,1058,1061,1062],{},[218,1056,1057],{},"POST …\u002FforgotPassword",[218,1059,1060],{},"{ email }"," → always ",[218,1063,768],{},[705,1065,1066,1061,1069],{},[218,1067,1068],{},"POST \u002Fidentity\u002FforgotPassword",[218,1070,768],{},[688,1072,1073,1076,1078],{},[705,1074,1075],{},"CSRF \u002F session on forgot",[705,1077,974],{},[705,1079,974],{},[688,1081,1082,1085,1091],{},[705,1083,1084],{},"Mail",[705,1086,1087,1088],{},"Your ",[218,1089,1090],{},"IEmailSender\u003CTUser>",[705,1092,1093],{},"Same (Production rejects Identity's no-op sender)",[688,1095,1096,1099,1102],{},[705,1097,1098],{},"Reset code",[705,1100,1101],{},"From mail",[705,1103,1104,1105],{},"Base64Url token from the sender; send that value as ",[218,1106,1107],{},"resetCode",[688,1109,1110,1113,1121],{},[705,1111,1112],{},"Reset",[705,1114,1115,958,1118],{},[218,1116,1117],{},"POST …\u002FresetPassword",[218,1119,1120],{},"{ email, resetCode, newPassword }",[705,1122,1123,1124],{},"Same Identity body on ",[218,1125,1126],{},"\u002Fidentity\u002FresetPassword",[688,1128,1129,1132,1134],{},[705,1130,1131],{},"CSRF \u002F session on reset",[705,1133,974],{},[705,1135,974],{},[688,1137,1138,1141,1146],{},[705,1139,1140],{},"Then",[705,1142,1143],{},[218,1144,1145],{},"POST …\u002Flogin",[705,1147,1148,266,1150,323],{},[218,1149,886],{},[218,1151,901],{},[209,1153,1154,1155,239],{},"Client steps: ",[305,1156,61],{"href":62},[312,1158,1160],{"id":1159},"two-factor-authentication","Two-factor authentication",[682,1162,1163,1173],{},[685,1164,1165],{},[688,1166,1167,1169,1171],{},[691,1168],{},[691,1170,695],{},[691,1172,698],{},[700,1174,1175,1204,1225,1243,1262,1280,1296],{},[688,1176,1177,1180,1195],{},[705,1178,1179],{},"Status",[705,1181,1182,1186,1187,1190,1191,1194],{},[1183,1184,1185],"em",{},"No GET"," — use ",[218,1188,1189],{},"POST \u002Fidentity\u002Fmanage\u002F2fa"," (response includes ",[218,1192,1193],{},"sharedKey"," \u002F flags)",[705,1196,1197,826,1200,1203],{},[218,1198,1199],{},"GET \u002Fidentity\u002Fmanage\u002F2fa",[218,1201,1202],{},"isTwoFactorEnabled"," only",[688,1205,1206,1209,1215],{},[705,1207,1208],{},"Shared key",[705,1210,1211,1212,323],{},"On stock POST response (",[218,1213,1214],{},"TwoFactorResponse.sharedKey",[705,1216,1217,1218,1220,1221,1224],{},"Mint\u002Fread via ",[218,1219,1189],{}," + ",[218,1222,1223],{},"{}"," (not GET); CSRF + ReAuth",[688,1226,1227,1230,1238],{},[705,1228,1229],{},"Enable \u002F disable",[705,1231,1232,1233,266,1236,323],{},"Auth’d ",[218,1234,1235],{},"POST \u002Fmanage\u002F2fa",[218,1237,258],{},[705,1239,1232,1240,1242],{},[218,1241,1189],{}," (same Identity body); CSRF + ReAuth",[688,1244,1245,1251,1256],{},[705,1246,1247,1248],{},"CSRF on ",[218,1249,1250],{},"POST",[705,1252,1253,1254],{},"Not required by ",[218,1255,224],{},[705,1257,1258,1259,323],{},"Required (",[218,1260,1261],{},"RequestVerificationToken",[688,1263,1264,1267,1270],{},[705,1265,1266],{},"Step-up",[705,1268,1269],{},"Not built in",[705,1271,1272,1273,1276,1277,323],{},"ReAuth required (",[218,1274,1275],{},"confirmIdentity",", then cookie or ",[218,1278,1279],{},"X-AuthEndpoints-Reauth",[688,1281,1282,1290,1293],{},[705,1283,1284,1220,1287],{},[218,1285,1286],{},"enable",[218,1288,1289],{},"resetSharedKey",[705,1291,1292],{},"Avoid together",[705,1294,1295],{},"Do not send together (validation problem)",[688,1297,1298,1301,1312],{},[705,1299,1300],{},"Login with 2FA",[705,1302,1303,221,1306,1309,1310],{},[218,1304,1305],{},"twoFactorCode",[218,1307,1308],{},"twoFactorRecoveryCode"," on ",[218,1311,855],{},[705,1313,1314,1315],{},"Same fields on ",[218,1316,901],{},[209,1318,1154,1319,1321,1322,239],{},[305,1320,56],{"href":57}," and ",[305,1323,81],{"href":82},[312,1325,1327],{"id":1326},"after-these-four-flows","After these four flows",[209,1329,1330,1331,1333,1334,1337,1338,1321,1340,239],{},"AuthEndpoints also maps manage info, ReAuth routes, and optional passkeys\u002FJWT. Stock ",[218,1332,224],{}," does not include passkeys, ReAuth, cookie logout, or ",[218,1335,1336],{},"csrfToken",". Compose only the modules you need when the facade is too much. See ",[305,1339,97],{"href":98},[305,1341,1342],{"href":127},"Modules",[312,1344,1346],{"id":1345},"related","Related",[1348,1349,1350,1355,1359,1363,1367,1371],"ul",{},[1351,1352,1353],"li",{},[305,1354,310],{"href":185},[1351,1356,1357],{},[305,1358,18],{"href":19},[1351,1360,1361],{},[305,1362,34],{"href":35},[1351,1364,1365],{},[305,1366,41],{"href":42},[1351,1368,1369],{},[305,1370,61],{"href":62},[1351,1372,1373],{},[305,1374,56],{"href":57},[1376,1377,1378],"style",{},"html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}",{"title":330,"searchDepth":337,"depth":350,"links":1380},[1381,1386,1387,1388,1389,1390,1391],{"id":314,"depth":350,"text":315,"children":1382},[1383,1385],{"id":319,"depth":369,"text":1384},"Stock (MapIdentityApi)",{"id":462,"depth":369,"text":463},{"id":679,"depth":350,"text":680},{"id":854,"depth":350,"text":855},{"id":1032,"depth":350,"text":1033},{"id":1159,"depth":350,"text":1160},{"id":1326,"depth":350,"text":1327},{"id":1345,"depth":350,"text":1346},"Side-by-side register, login, password reset, and 2FA for MapIdentityApi and the AuthEndpoints facade.","md",null,{},{"icon":192},{"title":189,"description":1392},"6z54cIvqYBqJShsiRtyR67wqsN1yXPY9AEgNLhWEHo8",[1400,1402],{"title":184,"path":185,"stem":186,"description":1401,"icon":187,"children":-1},"How AuthEndpoints differs from wiring ASP.NET Core Identity yourself, from OpenIddict, and from Identity API endpoints.",{"title":194,"path":195,"stem":196,"description":1403,"icon":197,"children":-1},"How AuthEndpoints protects sign-in and account changes, and which trade-offs it leaves to the host.",1791096173729]