[{"data":1,"prerenderedAt":1339},["ShallowReactive",2],{"navigation":3,"\u002Fgetting-started\u002Fstock-identity-vs-authendpoints":144,"\u002Fgetting-started\u002Fstock-identity-vs-authendpoints-surround":1334},[4,53,84,103],{"title":5,"path":6,"stem":7,"children":8,"icon":52},"Getting Started","\u002Fgetting-started","1.getting-started\u002F1.index",[9,12,17,22,27,32,37,42,47],{"title":10,"path":6,"stem":7,"icon":11},"Introduction","i-lucide-house",{"title":13,"path":14,"stem":15,"icon":16},"Installation","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F2.installation","i-lucide-download",{"title":18,"path":19,"stem":20,"icon":21},"AI agents","\u002Fgetting-started\u002Fai-agents","1.getting-started\u002F3.ai-agents","i-lucide-bot",{"title":23,"path":24,"stem":25,"icon":26},"Quick start","\u002Fgetting-started\u002Fquick-start","1.getting-started\u002F4.quick-start","i-lucide-play",{"title":28,"path":29,"stem":30,"icon":31},"Configuration","\u002Fgetting-started\u002Fconfiguration","1.getting-started\u002F5.configuration","i-lucide-settings",{"title":33,"path":34,"stem":35,"icon":36},"Production","\u002Fgetting-started\u002Fproduction","1.getting-started\u002F6.production","i-lucide-shield-check",{"title":38,"path":39,"stem":40,"icon":41},"Compare","\u002Fgetting-started\u002Fcompare","1.getting-started\u002F7.compare","i-lucide-git-compare",{"title":43,"path":44,"stem":45,"icon":46},"FAQ","\u002Fgetting-started\u002Ffaq","1.getting-started\u002F8.faq","i-lucide-circle-help",{"title":48,"path":49,"stem":50,"icon":51},"Stock Identity vs AuthEndpoints","\u002Fgetting-started\u002Fstock-identity-vs-authendpoints","1.getting-started\u002F9.stock-identity-vs-authendpoints","i-lucide-columns-2","i-lucide-rocket",{"title":54,"path":55,"stem":56,"children":57,"icon":59},"Examples","\u002Fexamples","2.examples\u002F1.index",[58,60,65,70,75,79],{"title":54,"path":55,"stem":56,"icon":59},"i-lucide-waypoints",{"title":61,"path":62,"stem":63,"icon":64},"Register a confirmed account","\u002Fexamples\u002Fregister-confirmed-account","2.examples\u002F2.register-confirmed-account","i-lucide-mail-check",{"title":66,"path":67,"stem":68,"icon":69},"Reset a forgotten password","\u002Fexamples\u002Freset-forgotten-password","2.examples\u002F3.reset-forgotten-password","i-lucide-key-round",{"title":71,"path":72,"stem":73,"icon":74},"Enable and disable two-factor authentication","\u002Fexamples\u002Ftwo-factor","2.examples\u002F4.two-factor","i-lucide-smartphone",{"title":76,"path":77,"stem":78,"icon":36},"Complete step-up (ReAuth)","\u002Fexamples\u002Freauth","2.examples\u002F5.reauth",{"title":80,"path":81,"stem":82,"icon":83},"Sign in with a passkey","\u002Fexamples\u002Fpasskey-sign-in","2.examples\u002F6.passkey-sign-in","i-lucide-fingerprint",{"title":85,"path":86,"stem":87,"children":88,"icon":102},"Composable Endpoints","\u002Fcomposables","3.composables\u002F1.index",[89,92,97],{"title":90,"path":86,"stem":87,"icon":91},"Overview","i-lucide-layout-grid",{"title":93,"path":94,"stem":95,"icon":96},"Requirements","\u002Fcomposables\u002Frequirements","3.composables\u002F2.requirements","i-lucide-list-checks",{"title":98,"path":99,"stem":100,"icon":101},"Recipes","\u002Fcomposables\u002Frecipes","3.composables\u002F3.recipes","i-lucide-book-marked","i-lucide-blocks",{"title":104,"icon":105,"path":106,"stem":107,"children":108,"page":143},"Modules","i-lucide-package","\u002Fmodules","4.modules",[109,114,119,124,128,133,138],{"title":110,"path":111,"stem":112,"icon":113},"Identity management","\u002Fmodules\u002Fidentity-management","4.modules\u002F1.identity-management","i-lucide-user-cog",{"title":115,"path":116,"stem":117,"icon":118},"Cookie auth","\u002Fmodules\u002Fcookie-auth","4.modules\u002F2.cookie-auth","i-lucide-cookie",{"title":120,"path":121,"stem":122,"icon":123},"Bearer auth","\u002Fmodules\u002Fbearer-auth","4.modules\u002F3.bearer-auth","i-lucide-key",{"title":125,"path":126,"stem":127,"icon":83},"JWT","\u002Fmodules\u002Fjwt","4.modules\u002F4.jwt",{"title":129,"path":130,"stem":131,"icon":132},"Passkeys","\u002Fmodules\u002Fpasskeys","4.modules\u002F5.passkeys","i-lucide-scan-face",{"title":134,"path":135,"stem":136,"icon":137},"ReAuth","\u002Fmodules\u002Freauth","4.modules\u002F6.reauth","i-lucide-shield-alert",{"title":139,"path":140,"stem":141,"icon":142},"External OAuth","\u002Fmodules\u002Fexternal-oauth","4.modules\u002F7.external-oauth","i-lucide-log-in",false,{"id":145,"title":48,"body":146,"description":1327,"extension":1328,"links":1329,"meta":1330,"navigation":1331,"path":49,"seo":1332,"stem":50,"__hash__":1333},"docs\u002F1.getting-started\u002F9.stock-identity-vs-authendpoints.md",{"type":147,"value":148,"toc":1314},"minimark",[149,181,201,222,242,251,256,264,397,400,404,583,592,613,617,783,788,792,951,965,969,1087,1092,1096,1252,1259,1263,1278,1282,1310],[150,151,152,153,157,158,162,163,166,167,170,171,162,174,162,177,180],"p",{},"Both stacks sit on ASP.NET Core Identity and your EF user store. ",[154,155,156],"strong",{},"Stock"," here means Microsoft's Identity API endpoints (",[159,160,161],"code",{},"AddIdentityApiEndpoints"," \u002F ",[159,164,165],{},"MapIdentityApi",") or the same routes written by hand. ",[154,168,169],{},"AuthEndpoints"," means the cookie facade: ",[159,172,173],{},"AddAuthEndpoints",[159,175,176],{},"UseAuthEndpoints",[159,178,179],{},"MapAuthEndpoints",".",[150,182,183,184,187,188,187,191,187,194,187,197,200],{},"Request bodies stay Identity-shaped (",[159,185,186],{},"RegisterRequest",", ",[159,189,190],{},"LoginRequest",[159,192,193],{},"ForgotPasswordRequest",[159,195,196],{},"ResetPasswordRequest",[159,198,199],{},"TwoFactorRequest","). AuthEndpoints maps the routes and adds cookie login, CSRF where required, rate limits, and ReAuth. It does not invent alternate DTOs.",[150,202,203,204,207,208,211,212,214,215,218,219,180],{},"AuthEndpoints tables use the facade default prefix ",[159,205,206],{},"\u002Fidentity"," (",[159,209,210],{},"IdentityPath","). Stock ",[159,213,165],{}," has ",[154,216,217],{},"no"," built-in prefix unless the host wraps it in ",[159,220,221],{},"MapGroup",[150,223,224,225,228,229,232,233,187,236,211,239,241],{},"AuthEndpoints-only on this surface: ",[159,226,227],{},"GET \u002Fidentity\u002FcsrfToken",", cookie ",[159,230,231],{},"POST \u002Fidentity\u002Flogout",", and ReAuth (",[159,234,235],{},"\u002Fmanage\u002FauthMethods",[159,237,238],{},"\u002FconfirmIdentity",[159,240,165],{}," does not map logout.",[150,243,244,245,248,249,180],{},"Client steps for these flows: ",[246,247,54],"a",{"href":55},". Product positioning against OpenIddict: ",[246,250,38],{"href":39},[252,253,255],"h2",{"id":254},"host-setup","Host setup",[257,258,260,261,263],"h3",{"id":259},"stock-mapidentityapi","Stock (",[159,262,165],{},")",[265,266,271],"pre",{"className":267,"code":268,"language":269,"meta":270,"style":270},"language-cs shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","builder.Services\n    .AddIdentityApiEndpoints\u003CAppUser>()\n    .AddEntityFrameworkStores\u003CAppDbContext>();\n\nvar app = builder.Build();\n\n\u002F\u002F Optional prefix — without MapGroup, routes are at the app root (\u002Fregister, \u002Flogin, …).\napp.MapGroup(\"\u002Fidentity\").MapIdentityApi\u003CAppUser>();\n","cs","",[159,272,273,288,307,323,330,353,358,365],{"__ignoreMap":270},[274,275,278,282,285],"span",{"class":276,"line":277},"line",1,[274,279,281],{"class":280},"sTEyZ","builder",[274,283,180],{"class":284},"sMK4o",[274,286,287],{"class":280},"Services\n",[274,289,291,294,297,300,304],{"class":276,"line":290},2,[274,292,293],{"class":284},"    .",[274,295,161],{"class":296},"s2Zo4",[274,298,299],{"class":284},"\u003C",[274,301,303],{"class":302},"sBMFI","AppUser",[274,305,306],{"class":284},">()\n",[274,308,310,312,315,317,320],{"class":276,"line":309},3,[274,311,293],{"class":284},[274,313,314],{"class":296},"AddEntityFrameworkStores",[274,316,299],{"class":284},[274,318,319],{"class":302},"AppDbContext",[274,321,322],{"class":284},">();\n",[274,324,326],{"class":276,"line":325},4,[274,327,329],{"emptyLinePlaceholder":328},true,"\n",[274,331,333,336,339,342,345,347,350],{"class":276,"line":332},5,[274,334,335],{"class":302},"var",[274,337,338],{"class":302}," app",[274,340,341],{"class":284}," =",[274,343,344],{"class":280}," builder",[274,346,180],{"class":284},[274,348,349],{"class":296},"Build",[274,351,352],{"class":284},"();\n",[274,354,356],{"class":276,"line":355},6,[274,357,329],{"emptyLinePlaceholder":328},[274,359,361],{"class":276,"line":360},7,[274,362,364],{"class":363},"sHwdD","\u002F\u002F Optional prefix — without MapGroup, routes are at the app root (\u002Fregister, \u002Flogin, …).\n",[274,366,368,371,373,375,378,381,384,386,389,391,393,395],{"class":276,"line":367},8,[274,369,370],{"class":280},"app",[274,372,180],{"class":284},[274,374,221],{"class":296},[274,376,377],{"class":284},"(",[274,379,380],{"class":284},"\"",[274,382,206],{"class":383},"sfazB",[274,385,380],{"class":284},[274,387,388],{"class":284},").",[274,390,165],{"class":296},[274,392,299],{"class":284},[274,394,303],{"class":302},[274,396,322],{"class":284},[150,398,399],{},"You still wire authentication, authorization, antiforgery, CORS, and rate limiting yourself. Login is bearer-first unless the client passes cookie query flags.",[257,401,403],{"id":402},"authendpoints-cookie-facade","AuthEndpoints (cookie facade)",[265,405,407],{"className":267,"code":406,"language":269,"meta":270,"style":270},"builder.Services.AddAuthEndpoints\u003CAppUser, AppDbContext>(o =>\n{\n    o.Passkeys.Enabled = false; \u002F\u002F thin cookie path; omit or set ServerDomain when passkeys stay on\n    o.Jwt.Enabled = false;\n});\nbuilder.Services.AddTransient\u003CIEmailSender\u003CAppUser>, MyEmailSender>();\n\nvar app = builder.Build();\n\napp.UseAuthEndpoints(); \u002F\u002F authentication, authorization, rate limiting, antiforgery\napp.MapAuthEndpoints\u003CAppUser>();\n",[159,408,409,441,446,473,493,498,528,532,548,553,568],{"__ignoreMap":270},[274,410,411,413,415,418,420,422,424,426,429,432,435,438],{"class":276,"line":277},[274,412,281],{"class":280},[274,414,180],{"class":284},[274,416,417],{"class":280},"Services",[274,419,180],{"class":284},[274,421,173],{"class":296},[274,423,299],{"class":284},[274,425,303],{"class":302},[274,427,428],{"class":284},",",[274,430,431],{"class":302}," AppDbContext",[274,433,434],{"class":284},">(",[274,436,437],{"class":302},"o",[274,439,440],{"class":284}," =>\n",[274,442,443],{"class":276,"line":290},[274,444,445],{"class":284},"{\n",[274,447,448,451,453,455,457,460,463,467,470],{"class":276,"line":309},[274,449,450],{"class":280},"    o",[274,452,180],{"class":284},[274,454,129],{"class":280},[274,456,180],{"class":284},[274,458,459],{"class":280},"Enabled ",[274,461,462],{"class":284},"=",[274,464,466],{"class":465},"sfNiH"," false",[274,468,469],{"class":284},";",[274,471,472],{"class":363}," \u002F\u002F thin cookie path; omit or set ServerDomain when passkeys stay on\n",[274,474,475,477,479,482,484,486,488,490],{"class":276,"line":325},[274,476,450],{"class":280},[274,478,180],{"class":284},[274,480,481],{"class":280},"Jwt",[274,483,180],{"class":284},[274,485,459],{"class":280},[274,487,462],{"class":284},[274,489,466],{"class":465},[274,491,492],{"class":284},";\n",[274,494,495],{"class":276,"line":332},[274,496,497],{"class":284},"});\n",[274,499,500,502,504,506,508,511,513,516,518,520,523,526],{"class":276,"line":355},[274,501,281],{"class":280},[274,503,180],{"class":284},[274,505,417],{"class":280},[274,507,180],{"class":284},[274,509,510],{"class":296},"AddTransient",[274,512,299],{"class":284},[274,514,515],{"class":302},"IEmailSender",[274,517,299],{"class":284},[274,519,303],{"class":302},[274,521,522],{"class":284},">,",[274,524,525],{"class":302}," MyEmailSender",[274,527,322],{"class":284},[274,529,530],{"class":276,"line":360},[274,531,329],{"emptyLinePlaceholder":328},[274,533,534,536,538,540,542,544,546],{"class":276,"line":367},[274,535,335],{"class":302},[274,537,338],{"class":302},[274,539,341],{"class":284},[274,541,344],{"class":280},[274,543,180],{"class":284},[274,545,349],{"class":296},[274,547,352],{"class":284},[274,549,551],{"class":276,"line":550},9,[274,552,329],{"emptyLinePlaceholder":328},[274,554,556,558,560,562,565],{"class":276,"line":555},10,[274,557,370],{"class":280},[274,559,180],{"class":284},[274,561,176],{"class":296},[274,563,564],{"class":284},"();",[274,566,567],{"class":363}," \u002F\u002F authentication, authorization, rate limiting, antiforgery\n",[274,569,571,573,575,577,579,581],{"class":276,"line":570},11,[274,572,370],{"class":280},[274,574,180],{"class":284},[274,576,179],{"class":296},[274,578,299],{"class":284},[274,580,303],{"class":302},[274,582,322],{"class":284},[150,584,585,586,589,590,180],{},"Passkeys and JWT are off. When you leave passkeys enabled (facade default), set ",[159,587,588],{},"Passkeys.ServerDomain"," in Production. See ",[246,591,23],{"href":24},[150,593,594,595,187,598,601,602,604,605,608,609,612],{},"CSRF on the AuthEndpoints cookie stack applies to cookie ",[154,596,597],{},"logout",[154,599,600],{},"manage"," POSTs, ",[154,603,134],{},", and authenticated ",[154,606,607],{},"resendConfirmationEmail",". It does ",[154,610,611],{},"not"," apply to register, login, forgotPassword, or resetPassword.",[252,614,616],{"id":615},"register","Register",[618,619,620,635],"table",{},[621,622,623],"thead",{},[624,625,626,629,632],"tr",{},[627,628],"th",{},[627,630,631],{},"Stock Identity API",[627,633,634],{},"AuthEndpoints facade",[636,637,638,660,677,695,710,727,743,772],"tbody",{},[624,639,640,644,656],{},[641,642,643],"td",{},"Route",[641,645,646,649,650,653,654,263],{},[159,647,648],{},"POST \u002Fregister"," (or ",[159,651,652],{},"POST \u002Fidentity\u002Fregister"," with ",[159,655,221],{},[641,657,658],{},[159,659,652],{},[624,661,662,665,674],{},[641,663,664],{},"Body",[641,666,667,668,187,671,263],{},"Identity register (",[159,669,670],{},"email",[159,672,673],{},"password",[641,675,676],{},"Same Identity body",[624,678,679,682,685],{},[641,680,681],{},"CSRF",[641,683,684],{},"Host policy (endpoint does not require antiforgery by default)",[641,686,687,690,691,694],{},[154,688,689],{},"Not"," required (",[159,692,693],{},"RequireAntiforgery"," is not on register)",[624,696,697,700,706],{},[641,698,699],{},"Duplicate email",[641,701,702,705],{},[159,703,704],{},"200"," (no enumeration)",[641,707,708,705],{},[159,709,704],{},[624,711,712,715,718],{},[641,713,714],{},"Confirmed-account policy",[641,716,717],{},"Host Identity options",[641,719,720,723,724],{},[159,721,722],{},"RequireConfirmedAccount"," default ",[159,725,726],{},"true",[624,728,729,734,737],{},[641,730,731,732],{},"After ",[159,733,704],{},[641,735,736],{},"Not signed in",[641,738,739,740,742],{},"Not signed in (",[159,741,704],{}," ≠ session)",[624,744,745,748,753],{},[641,746,747],{},"Confirm",[641,749,750],{},[159,751,752],{},"GET …\u002FconfirmEmail?userId&code",[641,754,755,758,759,762,763,653,766,162,769],{},[159,756,757],{},"GET \u002Fidentity\u002FconfirmEmail?userId&code",", then login. Optional ",[159,760,761],{},"ConfirmEmailRedirectUri"," → ",[159,764,765],{},"302",[159,767,768],{},"status",[159,770,771],{},"flow",[624,773,774,777,780],{},[641,775,776],{},"Rate limit",[641,778,779],{},"Host-owned",[641,781,782],{},"Built-in account rate limits",[150,784,785,786,180],{},"Client flow: register → check email → confirm → login. Steps: ",[246,787,61],{"href":62},[252,789,791],{"id":790},"login","Login",[618,793,794,804],{},[621,795,796],{},[624,797,798,800,802],{},[627,799],{},[627,801,631],{},[627,803,634],{},[636,805,806,823,838,854,875,903,913,928,940],{},[624,807,808,810,818],{},[641,809,643],{},[641,811,812,815,816,263],{},[159,813,814],{},"POST \u002Flogin"," (or under your ",[159,817,221],{},[641,819,820],{},[159,821,822],{},"POST \u002Fidentity\u002Flogin",[624,824,825,828,833],{},[641,826,827],{},"Handler",[641,829,830,831],{},"Identity ",[159,832,791],{},[641,834,835],{},[159,836,837],{},"LoginCookie",[624,839,840,842,846],{},[641,841,664],{},[641,843,830,844],{},[159,845,190],{},[641,847,848,849,187,851,853],{},"Same (",[159,850,670],{},[159,852,673],{},", optional 2FA fields)",[624,855,856,859,865],{},[641,857,858],{},"Default success",[641,860,861,862,263],{},"Identity bearer tokens (",[159,863,864],{},"AccessTokenResponse",[641,866,867,868,207,871,874],{},"Application cookie only (no bearer): empty body + ",[159,869,870],{},"Set-Cookie",[159,872,873],{},"TypedResults.Empty","). Session when the flag is omitted",[624,876,877,880,889],{},[641,878,879],{},"Cookie query flags",[641,881,882,162,885,888],{},[159,883,884],{},"useCookies",[159,886,887],{},"useSessionCookies"," select cookie vs bearer",[641,890,891,894,895,207,897,899,900],{},[154,892,893],{},"Only"," ",[159,896,887],{},[159,898,884],{}," ignored). Persistent: ",[159,901,902],{},"?useSessionCookies=false",[624,904,905,908,911],{},[641,906,907],{},"CSRF on login",[641,909,910],{},"Not required",[641,912,910],{},[624,914,915,918,923],{},[641,916,917],{},"Logout",[641,919,920,921],{},"Not in ",[159,922,165],{},[641,924,925,927],{},[159,926,231],{}," (auth + CSRF)",[624,929,930,933,935],{},[641,931,932],{},"CSRF helper",[641,934,779],{},[641,936,937,939],{},[159,938,227],{}," for logout, manage, ReAuth, resend",[624,941,942,945,948],{},[641,943,944],{},"Lockout",[641,946,947],{},"Identity lockout",[641,949,950],{},"Lockout + login rate limit",[150,952,953,954,956,957,960,961,964],{},"Full flag tables: ",[246,955,115],{"href":116},". Bearer-style Identity login stays available via compose (",[159,958,959],{},"MapBearerAuthEndpoints",") or ",[159,962,963],{},"SignIn = IdentityBearer",". It is not the cookie-facade default.",[252,966,968],{"id":967},"password-reset","Password reset",[618,970,971,981],{},[621,972,973],{},[624,974,975,977,979],{},[627,976],{},[627,978,631],{},[627,980,634],{},[636,982,983,1006,1015,1029,1043,1062,1071],{},[624,984,985,988,999],{},[641,986,987],{},"Forgot",[641,989,990,894,993,996,997],{},[159,991,992],{},"POST …\u002FforgotPassword",[159,994,995],{},"{ email }"," → always ",[159,998,704],{},[641,1000,1001,996,1004],{},[159,1002,1003],{},"POST \u002Fidentity\u002FforgotPassword",[159,1005,704],{},[624,1007,1008,1011,1013],{},[641,1009,1010],{},"CSRF \u002F session on forgot",[641,1012,910],{},[641,1014,910],{},[624,1016,1017,1020,1026],{},[641,1018,1019],{},"Mail",[641,1021,1022,1023],{},"Your ",[159,1024,1025],{},"IEmailSender\u003CTUser>",[641,1027,1028],{},"Same (Production rejects Identity's no-op sender)",[624,1030,1031,1034,1037],{},[641,1032,1033],{},"Reset code",[641,1035,1036],{},"From mail",[641,1038,1039,1040],{},"Base64Url token from the sender; send that value as ",[159,1041,1042],{},"resetCode",[624,1044,1045,1048,1056],{},[641,1046,1047],{},"Reset",[641,1049,1050,894,1053],{},[159,1051,1052],{},"POST …\u002FresetPassword",[159,1054,1055],{},"{ email, resetCode, newPassword }",[641,1057,1058,1059],{},"Same Identity body on ",[159,1060,1061],{},"\u002Fidentity\u002FresetPassword",[624,1063,1064,1067,1069],{},[641,1065,1066],{},"CSRF \u002F session on reset",[641,1068,910],{},[641,1070,910],{},[624,1072,1073,1076,1081],{},[641,1074,1075],{},"Then",[641,1077,1078],{},[159,1079,1080],{},"POST …\u002Flogin",[641,1082,1083,207,1085,263],{},[159,1084,822],{},[159,1086,837],{},[150,1088,1089,1090,180],{},"Client steps: ",[246,1091,66],{"href":67},[252,1093,1095],{"id":1094},"two-factor-authentication","Two-factor authentication",[618,1097,1098,1108],{},[621,1099,1100],{},[624,1101,1102,1104,1106],{},[627,1103],{},[627,1105,631],{},[627,1107,634],{},[636,1109,1110,1139,1160,1178,1197,1215,1231],{},[624,1111,1112,1115,1130],{},[641,1113,1114],{},"Status",[641,1116,1117,1121,1122,1125,1126,1129],{},[1118,1119,1120],"em",{},"No GET"," — use ",[159,1123,1124],{},"POST \u002Fidentity\u002Fmanage\u002F2fa"," (response includes ",[159,1127,1128],{},"sharedKey"," \u002F flags)",[641,1131,1132,762,1135,1138],{},[159,1133,1134],{},"GET \u002Fidentity\u002Fmanage\u002F2fa",[159,1136,1137],{},"isTwoFactorEnabled"," only",[624,1140,1141,1144,1150],{},[641,1142,1143],{},"Shared key",[641,1145,1146,1147,263],{},"On stock POST response (",[159,1148,1149],{},"TwoFactorResponse.sharedKey",[641,1151,1152,1153,1155,1156,1159],{},"Mint\u002Fread via ",[159,1154,1124],{}," + ",[159,1157,1158],{},"{}"," (not GET); CSRF + ReAuth",[624,1161,1162,1165,1173],{},[641,1163,1164],{},"Enable \u002F disable",[641,1166,1167,1168,207,1171,263],{},"Auth’d ",[159,1169,1170],{},"POST \u002Fmanage\u002F2fa",[159,1172,199],{},[641,1174,1167,1175,1177],{},[159,1176,1124],{}," (same Identity body); CSRF + ReAuth",[624,1179,1180,1186,1191],{},[641,1181,1182,1183],{},"CSRF on ",[159,1184,1185],{},"POST",[641,1187,1188,1189],{},"Not required by ",[159,1190,165],{},[641,1192,1193,1194,263],{},"Required (",[159,1195,1196],{},"RequestVerificationToken",[624,1198,1199,1202,1205],{},[641,1200,1201],{},"Step-up",[641,1203,1204],{},"Not built in",[641,1206,1207,1208,1211,1212,263],{},"ReAuth required (",[159,1209,1210],{},"confirmIdentity",", then cookie or ",[159,1213,1214],{},"X-AuthEndpoints-Reauth",[624,1216,1217,1225,1228],{},[641,1218,1219,1155,1222],{},[159,1220,1221],{},"enable",[159,1223,1224],{},"resetSharedKey",[641,1226,1227],{},"Avoid together",[641,1229,1230],{},"Do not send together (validation problem)",[624,1232,1233,1236,1247],{},[641,1234,1235],{},"Login with 2FA",[641,1237,1238,162,1241,1244,1245],{},[159,1239,1240],{},"twoFactorCode",[159,1242,1243],{},"twoFactorRecoveryCode"," on ",[159,1246,791],{},[641,1248,1249,1250],{},"Same fields on ",[159,1251,837],{},[150,1253,1089,1254,1256,1257,180],{},[246,1255,71],{"href":72}," and ",[246,1258,76],{"href":77},[252,1260,1262],{"id":1261},"after-these-four-flows","After these four flows",[150,1264,1265,1266,1268,1269,1272,1273,1256,1276,180],{},"AuthEndpoints also maps manage info, ReAuth routes, and optional passkeys\u002FJWT. Stock ",[159,1267,165],{}," does not include passkeys, ReAuth, cookie logout, or ",[159,1270,1271],{},"csrfToken",". Compose only the modules you need when the facade is too much. See ",[246,1274,1275],{"href":86},"Composable endpoints",[246,1277,104],{"href":111},[252,1279,1281],{"id":1280},"related","Related",[1283,1284,1285,1290,1294,1298,1302,1306],"ul",{},[1286,1287,1288],"li",{},[246,1289,38],{"href":39},[1286,1291,1292],{},[246,1293,23],{"href":24},[1286,1295,1296],{},[246,1297,54],{"href":55},[1286,1299,1300],{},[246,1301,61],{"href":62},[1286,1303,1304],{},[246,1305,66],{"href":67},[1286,1307,1308],{},[246,1309,71],{"href":72},[1311,1312,1313],"style",{},"html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}",{"title":270,"searchDepth":277,"depth":290,"links":1315},[1316,1321,1322,1323,1324,1325,1326],{"id":254,"depth":290,"text":255,"children":1317},[1318,1320],{"id":259,"depth":309,"text":1319},"Stock (MapIdentityApi)",{"id":402,"depth":309,"text":403},{"id":615,"depth":290,"text":616},{"id":790,"depth":290,"text":791},{"id":967,"depth":290,"text":968},{"id":1094,"depth":290,"text":1095},{"id":1261,"depth":290,"text":1262},{"id":1280,"depth":290,"text":1281},"Side-by-side register, login, password reset, and 2FA for MapIdentityApi and the AuthEndpoints facade.","md",null,{},{"icon":51},{"title":48,"description":1327},"9UReuD8A4HS18eNRNghMATSYTLw6-RqEoaaM9Sw8seE",[1335,1337],{"title":43,"path":44,"stem":45,"description":1336,"icon":46,"children":-1},"Does AuthEndpoints replace Identity? Cookie or JWT? Passkeys, 2FA, composing routes, and Sign in with Google as a provider.",{"title":54,"path":55,"stem":56,"description":1338,"icon":59,"children":-1},"Step-by-step request flows for AuthEndpoints facade defaults.",1789541099408]