Modules
Bearer auth
Identity bearer token login, refresh, and logout endpoints.
ASP.NET Core Identity bearer token sign-in (not JWT). Pair with Identity management.
When to choose bearer vs JWT
| Stack | Use when |
|---|---|
| Identity bearer | You want Identity's built-in access/refresh token format |
| JWT | You want JWT Bearer auth + HttpOnly refresh cookie with hashed storage and reuse detection |
DI
builder.Services.AddBearerAuthEndpoints(); // ReAuth schemes + rate limits
Map
app.MapGroup("/identity").MapBearerAuthEndpoints<AppUser>();
Routes
| Method | Path | Notes |
|---|---|---|
POST | /login | Issues Identity bearer tokens (AccessTokenResponse); rate-limited |
POST | /refresh | Refresh access token |
POST | /logout | Requires authorization |
Scheme selection on login
The shared Identity login handler also supports cookie selection query flags used by passkey flows (useCookies / useSessionCookies). For a pure bearer stack, omit those flags so Identity bearer tokens are issued.
Antiforgery
Bearer-authenticated requests typically skip CSRF when not using the application cookie. See Requirements.
Related
- JWT module for JWT
- Composable recipes