Getting Started
Configuration
Reference for AuthEndpointsOptions and nested passkey/JWT settings.
Configure the facade via AddAuthEndpoints<TUser, TContext>(…) or, with roles, AddAuthEndpoints<TUser, TRole, TContext>(…).
AuthEndpointsOptions
| Property | Default | Description |
|---|---|---|
IdentityPath | /identity | Route prefix for Identity management + cookie sign-in |
PasskeyPath | /account | Route prefix for passkey endpoints |
RequireConfirmedAccount | true | Identity requires a confirmed account before sign-in |
Passkeys | (enabled) | Nested passkey options |
Jwt | (disabled) | Nested JWT options |
ConfigureIdentity | null | Optional Action<IdentityOptions> applied after secure defaults |
ConfigurePasskeys | null | Optional Action<IdentityPasskeyOptions> after ServerDomain is applied |
RequireEmailSenderInProduction | true | Production must register a real IEmailSender<TUser> (not Identity's no-op) |
Passkeys
AuthEndpointsPasskeyOptions:
| Property | Default | Description |
|---|---|---|
Enabled | true | When false, passkey DI and mapping are skipped |
ServerDomain | null | WebAuthn relying-party domain (e.g. example.com). Required in Production when enabled |
JWT
AuthEndpointsJwtOptions:
| Property | Default | Description |
|---|---|---|
Enabled | false | When true, registers and maps JWT endpoints |
Path | /auth | Route prefix for JWT endpoints |
Configure | null | Optional Action<SimpleJwtOptions> for issuer, audience, signing, lifetimes |
SimpleJwtOptions (via Jwt.Configure)
Common settings:
| Property | Notes |
|---|---|
Issuer / Audience | Production rejects the library defaults (Jwt / JwtAudience) |
AccessTokenLifetime | Default 15 minutes |
SigningOptions | Symmetric (key ≥ 32 UTF-8 bytes), RSA, ECDSA, or X509 |
TokenValidationParameters | Optional override of validation parameters |
When JWT is enabled, call modelBuilder.UseRefreshToken() on your DbContext and migrate.
Example
builder.Services.AddAuthEndpoints<AppUser, AppDbContext>(o =>
{
o.IdentityPath = "/auth/cookie";
o.PasskeyPath = "/auth/passkey";
o.RequireConfirmedAccount = true;
o.Passkeys.ServerDomain = "example.com";
o.ConfigureIdentity = identity =>
{
identity.Password.RequiredLength = 10;
};
o.Jwt.Enabled = true;
o.Jwt.Path = "/auth/jwt";
o.Jwt.Configure = jwt =>
{
jwt.Issuer = "https://example.com";
jwt.Audience = "https://example.com";
jwt.SigningOptions.SymmetricKey = builder.Configuration["Jwt:SymmetricKey"];
};
});
For advanced stacks that skip the facade, see Composable endpoint requirements.