Quick start

Install the package, then map the facade. A first-party web client can register, sign in with a cookie, and manage the account.

Install

dotnet add package AuthEndpoints

Requires .NET 10, ASP.NET Core Identity, and EF Core. Your DbContext is typically IdentityDbContext<TUser>.

Wire the host

builder.Services.AddDbContext<AppDbContext>(/* your provider */);

builder.Services.AddAuthEndpoints<AppUser, AppDbContext>(o =>
{
    o.Passkeys.ServerDomain = "example.com"; // required in Production
});

// Required in Production. Identity's no-op sender is rejected.
builder.Services.AddTransient<IEmailSender<AppUser>, MyEmailSender>();

var app = builder.Build();

app.UseAuthEndpoints();
app.MapAuthEndpoints<AppUser>();

app.Run();

UseAuthEndpoints adds authentication, authorization, rate limiting, and antiforgery. Call it after exception-handling middleware.

What you get

Password login at POST /identity/login sets the Identity application cookie.

Call it from the browser

• Send cookies (credentials: "include" or Axios withCredentials).
• POST /identity/login does not need CSRF.
• For logout and other unsafe cookie requests, GET /identity/csrfToken then send RequestVerificationToken.

Native and mobile

Pass AuthEndpointsSignIn.IdentityBearer as the first argument. The rest of Program.cs stays the same.

builder.Services.AddAuthEndpoints<AppUser, AppDbContext>(AuthEndpointsSignIn.IdentityBearer, o =>
{
    o.Passkeys.ServerDomain = "example.com";
});

POST /identity/login then returns accessToken and refreshToken. See Bearer auth.

Roles

Use the three-type overload so AddRoles runs before AddEntityFrameworkStores:

builder.Services.AddAuthEndpoints<AppUser, AppRole, AppDbContext>(o =>
{
    o.Passkeys.ServerDomain = "example.com";
});

DbContext should be IdentityDbContext<AppUser, AppRole, TKey> (or equivalent). Do not chain .AddRoles<TRole>() after the two-type overload.

Next

• Configuration for paths, passkeys, and JWT opt-in
• Production for HTTPS, email, and passkey domain
• JWT if you want a Bearer access token with an HttpOnly refresh cookie
• Recipes for JWT-only hosts or custom prefixes