AuthEndpoints
Changelog
Getting Started

Quick start

Wire the opinionated AuthEndpoints facade for cookie Identity and passkeys.

Your client app (web or mobile) calls these routes on the ASP.NET Core API.

Minimal host

// Program.cs
builder.Services.AddDbContext<AppDbContext>(/* your provider */);

builder.Services.AddAuthEndpoints<AppUser, AppDbContext>(o =>
{
    o.Passkeys.ServerDomain = "example.com"; // required in Production
});

// Required in Production (Identity's no-op sender is rejected).
builder.Services.AddTransient<IEmailSender<AppUser>, MyEmailSender>();

var app = builder.Build();

app.UseAuthEndpoints(); // authentication, authorization, rate limiting, antiforgery
app.MapAuthEndpoints<AppUser>(); // /identity (management + cookie) + /account (passkeys)

app.Run();

AddAuthEndpoints returns an IdentityBuilder for optional Identity chaining.

Roles

Use the three-type overload so EF registers IRoleStore correctly (AddRoles must run before AddEntityFrameworkStores):

builder.Services.AddAuthEndpoints<AppUser, AppRole, AppDbContext>(o =>
{
    o.Passkeys.ServerDomain = "example.com";
});

Your DbContext should be IdentityDbContext<AppUser, AppRole, TKey> (or equivalent). Do not chain bare .AddRoles<TRole>() after the two-type overload — that leaves IRoleStore unregistered.

Default routes (facade)

AreaPath prefixMain routes
Management + cookie/identityregister, login, logout, csrfToken, confirm/forgot/reset, manage/*, confirmIdentity
Passkeys/accountpasskeys register/login options + complete, credential CRUD
JWT (if enabled)/authcreate, refresh, verify, logout, csrfToken

Client usage notes

Cookie stack

  • Send cookies with credentials (credentials: "include" / Axios withCredentials).
  • Call GET /identity/csrfToken, then send the token as RequestVerificationToken on unsafe methods (POST / PUT / PATCH / DELETE).

JWT stack (when enabled)

  • POST /auth/create returns an access token; send it as Authorization: Bearer ….
  • Refresh token is an HttpOnly cookie; POST /auth/refresh and POST /auth/logout need CSRF (GET /auth/csrfToken + RequestVerificationToken).

Enable JWT (facade opt-in)

Map the refresh-token entity on your DbContext:

// AppDbContext.cs
using AuthEndpoints.Jwt;

protected override void OnModelCreating(ModelBuilder builder)
{
    base.OnModelCreating(builder);
    builder.UseRefreshToken(); // AuthEndpointsRefreshTokens table
}

Then enable JWT on the facade:

builder.Services.AddAuthEndpoints<AppUser, AppDbContext>(o =>
{
    o.Passkeys.ServerDomain = "example.com";
    o.Jwt.Enabled = true;
    o.Jwt.Path = "/auth";
    o.Jwt.Configure = jwt =>
    {
        jwt.Issuer = "https://example.com";
        jwt.Audience = "https://example.com";
        jwt.SigningOptions.SymmetricKey = builder.Configuration["Jwt:SymmetricKey"];
    };
});

Add a migration (or recreate the database) so AuthEndpoints.AuthEndpointsRefreshTokens exists. Tokens are stored hashed; recreate that table if upgrading from plaintext refresh-token storage.

Next steps

Installation

Add the AuthEndpoints NuGet package to your ASP.NET Core project.

Configuration

Reference for AuthEndpointsOptions and nested passkey/JWT settings.