Bearer auth
ASP.NET Core Identity bearer token sign-in (not JWT). Pair with Identity management.
This module maps Identity Login. The cookie facade does not map these routes. Use AddAuthEndpoints with AuthEndpointsSignIn.IdentityBearer, or compose AddBearerAuthEndpoints and MapBearerAuthEndpoints.
When to choose bearer vs JWT
| Stack | Use when |
|---|---|
| Identity bearer | You want Identity's built-in access/refresh token format |
| JWT | You want JWT Bearer auth + HttpOnly refresh cookie with hashed storage and reuse detection |
DI
builder.Services.AddBearerAuthEndpoints(); // ReAuth schemes + rate limits
Map
app.MapGroup("/identity").MapBearerAuthEndpoints<AppUser>();
The Identity bearer facade maps this group under IdentityPath (default /identity).
Routes
| Method | Path | Notes |
|---|---|---|
POST | /login | Login; Identity bearer tokens (AccessTokenResponse) when both query flags are omitted; rate-limited |
POST | /refresh | Refresh access token |
POST | /logout | Requires authorization |
Login query string
Issues an application cookie when useCookies or useSessionCookies is true. Persistent when useCookies is true and useSessionCookies is not true. Neither flag → Identity bearer tokens (AccessTokenResponse).
| Query | Result |
|---|---|
| neither flag | Identity bearer tokens |
useCookies=true (and useSessionCookies not true) | persistent application cookie |
useSessionCookies=true | session application cookie |
These flags apply to Login and to the default passkey completer. They do not apply to cookie-facade / LoginCookie password login. See Cookie auth and Passkeys.
Logout
POST /logout requires authorization. It signs out cookies only and does not revoke Identity bearer tokens. Tokens remain valid until they expire.
Antiforgery
Bearer-authenticated requests typically skip CSRF when not using the application cookie. See Requirements.