Complete step-up (ReAuth)

Sensitive manage mutations and any host endpoint with .RequireReauth() need a fresh ReAuth proof. Browser clients get the AuthEndpoints.ReAuth cookie (5 minutes). API clients can send header X-AuthEndpoints-Reauth with the reauthToken from confirm.

Assume a signed-in cookie session and CSRF for POST /confirmIdentity when mapped with management.

Steps

1. Call the protected action (for example POST /identity/manage/info). On missing ReAuth, expect 401 or 403.
2. GET /identity/manage/authMethods to list available proofs.
3. Collect exactly one proof for POST /identity/confirmIdentity:
   • { "password": "…" }
   • { "twoFactorCode": "…" }
   • { "twoFactorRecoveryCode": "…" }
   • { "credentialJson": "…" } after passkey options
4. For passkey step-up: POST /identity/confirmIdentity/passkeyOptions, run navigator.credentials.get(…), then send credentialJson.
5. POST /identity/confirmIdentity with CSRF and one proof field.
6. On success, retry the protected action with the same session cookies. Send X-AuthEndpoints-Reauth when the client stores reauthToken instead of relying on the ReAuth cookie.

Where ReAuth is required

• POST /identity/manage/2fa and POST /identity/manage/info
• Passkey add, rename, delete, and authenticated creation options
• Host endpoints that call .RequireReauth()

See ReAuth for schemes, policy, and host wiring.

Related

• Enable and disable two-factor authentication
• ReAuth
• Identity management
• Passkeys