Getting Started
Introduction
AuthEndpoints is an ASP.NET Core library of ready-made Identity auth endpoints for SPA backends.
AuthEndpoints gives you ready-made auth API endpoints on top of ASP.NET Core Identity. It fits a single-backend API serving a SPA or frontend with first-party email/password, cookies, JWT, and/or passkeys.
Why AuthEndpoints?
- Ready-made endpoints — map registration, login, password reset, 2FA, and session/token flows instead of wiring them yourself
- Opinionated quick start —
AddAuthEndpoints/UseAuthEndpoints/MapAuthEndpointsfor cookie Identity + passkeys with secure defaults - Sign-in stacks you choose — cookie sessions, Identity bearer tokens, or JWT
- Passkeys (WebAuthn) — passwordless register and login
- Built-in hardening — rate limiting, antiforgery for cookie flows, lockout-aware login, hashed JWT refresh tokens with reuse detection
Facade vs compose
| Approach | When to use |
|---|---|
| Facade | Cookie SPA + passkeys (and optional JWT). One DI call, one pipeline call, one map call. |
| Compose | Identity bearer, custom path prefixes, JWT-only, or a custom mix of modules. |
See Quick start for the facade, and Composable endpoints when you need to assemble modules yourself.
Modules
| Module | Role |
|---|---|
| Identity management | Register, confirm email, forgot/reset password, manage info and 2FA |
| Cookie auth | Cookie login/logout + CSRF token |
| Bearer auth | Identity bearer login/refresh/logout |
| JWT | JWT access tokens + HttpOnly refresh cookie |
| Passkeys | WebAuthn passwordless + credential management |
| ReAuth | Step-up confirmation for sensitive actions |
| External OAuth | GitHub/Google OAuth (separate preview package) |
External OAuth (
AuthEndpoints.External.OAuth) is a preview package with its own version. It is not included in the core AuthEndpoints NuGet package.Requirements
- .NET 10
- ASP.NET Core Identity
- EF Core for the user store