Production

Before deploying, verify the following.

Checklist

• Use HTTPS
• Register a real IEmailSender<TUser> — Identity's no-op sender is rejected in Production when RequireEmailSenderInProduction is true (default)
• Set Passkeys.ServerDomain when passkeys are enabled (default)
• For JWT:
  • Call modelBuilder.UseRefreshToken() on your DbContext
  • Use a non-default issuer and audience
  • Use a symmetric key of at least 256 bits (32 UTF-8 bytes), or an asymmetric key
• Recreate the AuthEndpointsRefreshTokens table if upgrading from plaintext refresh-token storage (tokens are stored hashed with family reuse detection)

What the validators enforce

The facade options validator checks path formats, Production passkey domain, and email sender registration. JWT options validation rejects insecure Production defaults for issuer, audience, and signing material.

Related

• Configuration
• JWT module
• Passkeys module