Getting Started
Introduction
AuthEndpoints is an ASP.NET Core library of ready-made Identity auth endpoints for web and mobile clients.
AuthEndpoints gives you ready-made auth API endpoints on top of ASP.NET Core Identity. It fits a first-party auth API for web and mobile clients (React, Next.js, Vue, Nuxt, Svelte, native apps, and similar) with email/password, cookies, JWT, and/or passkeys.
Why AuthEndpoints?
- Ready-made endpoints — map registration, login, password reset, 2FA, and session/token flows instead of wiring them yourself
- Opinionated quick start —
AddAuthEndpoints/UseAuthEndpoints/MapAuthEndpointsfor cookie Identity + passkeys with secure defaults - Sign-in stacks you choose — cookie sessions, Identity bearer tokens, or JWT
- Passkeys (WebAuthn) — passwordless register and login
- Built-in hardening — rate limiting, antiforgery for cookie flows, lockout-aware login, hashed JWT refresh tokens with reuse detection
Facade vs compose
| Approach | When to use |
|---|---|
| Cookie facade | Browser / first-party web + passkeys (and optional JWT). AddAuthEndpoints / UseAuthEndpoints / MapAuthEndpoints. |
| Identity bearer facade | Native / mobile clients that store Identity access and refresh tokens. Same triad, with AuthEndpointsSignIn.IdentityBearer. |
| Compose | JWT-only, custom path prefixes, or a custom mix of modules. |
See Quick start for the facade, and Composable endpoints when you need to assemble modules yourself.
Modules
| Module | Role |
|---|---|
| Identity management | Register, confirm email, forgot/reset password, manage info and 2FA |
| Cookie auth | Cookie login/logout + CSRF token |
| Bearer auth | Identity bearer login/refresh/logout |
| JWT | JWT access tokens + HttpOnly refresh cookie |
| Passkeys | WebAuthn passwordless + credential management |
| ReAuth | Step-up confirmation for sensitive actions |
| External OAuth | GitHub/Google OAuth (separate preview package) |
External OAuth (
AuthEndpoints.External.OAuth) is a preview package. It is not included in the core AuthEndpoints NuGet package.Requirements
- .NET 10
- ASP.NET Core Identity
- EF Core for the user store