[{"data":1,"prerenderedAt":1458},["ShallowReactive",2],{"navigation":3,"\u002Fmodules\u002Fexternal-oauth":94,"\u002Fmodules\u002Fexternal-oauth-surround":1455},[4,33,52],{"title":5,"path":6,"stem":7,"children":8,"icon":32},"Getting Started","\u002Fgetting-started","1.getting-started\u002F1.index",[9,12,17,22,27],{"title":10,"path":6,"stem":7,"icon":11},"Introduction","i-lucide-house",{"title":13,"path":14,"stem":15,"icon":16},"Installation","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F2.installation","i-lucide-download",{"title":18,"path":19,"stem":20,"icon":21},"Quick start","\u002Fgetting-started\u002Fquick-start","1.getting-started\u002F3.quick-start","i-lucide-play",{"title":23,"path":24,"stem":25,"icon":26},"Configuration","\u002Fgetting-started\u002Fconfiguration","1.getting-started\u002F4.configuration","i-lucide-settings",{"title":28,"path":29,"stem":30,"icon":31},"Production","\u002Fgetting-started\u002Fproduction","1.getting-started\u002F5.production","i-lucide-shield-check","i-lucide-rocket",{"title":34,"path":35,"stem":36,"children":37,"icon":51},"Composable Endpoints","\u002Fcomposables","2.composables\u002F1.index",[38,41,46],{"title":39,"path":35,"stem":36,"icon":40},"Overview","i-lucide-layout-grid",{"title":42,"path":43,"stem":44,"icon":45},"Requirements","\u002Fcomposables\u002Frequirements","2.composables\u002F2.requirements","i-lucide-list-checks",{"title":47,"path":48,"stem":49,"icon":50},"Recipes","\u002Fcomposables\u002Frecipes","2.composables\u002F3.recipes","i-lucide-book-marked","i-lucide-blocks",{"title":53,"icon":54,"path":55,"stem":56,"children":57,"page":93},"Modules","i-lucide-package","\u002Fmodules","3.modules",[58,63,68,73,78,83,88],{"title":59,"path":60,"stem":61,"icon":62},"Identity management","\u002Fmodules\u002Fidentity-management","3.modules\u002F1.identity-management","i-lucide-user-cog",{"title":64,"path":65,"stem":66,"icon":67},"Cookie auth","\u002Fmodules\u002Fcookie-auth","3.modules\u002F2.cookie-auth","i-lucide-cookie",{"title":69,"path":70,"stem":71,"icon":72},"Bearer auth","\u002Fmodules\u002Fbearer-auth","3.modules\u002F3.bearer-auth","i-lucide-key",{"title":74,"path":75,"stem":76,"icon":77},"JWT","\u002Fmodules\u002Fjwt","3.modules\u002F4.jwt","i-lucide-fingerprint",{"title":79,"path":80,"stem":81,"icon":82},"Passkeys","\u002Fmodules\u002Fpasskeys","3.modules\u002F5.passkeys","i-lucide-scan-face",{"title":84,"path":85,"stem":86,"icon":87},"ReAuth","\u002Fmodules\u002Freauth","3.modules\u002F6.reauth","i-lucide-shield-alert",{"title":89,"path":90,"stem":91,"icon":92},"External OAuth","\u002Fmodules\u002Fexternal-oauth","3.modules\u002F7.external-oauth","i-lucide-log-in",false,{"id":95,"title":89,"body":96,"description":1448,"extension":1449,"links":1450,"meta":1451,"navigation":1452,"path":90,"seo":1453,"stem":91,"__hash__":1454},"docs\u002F3.modules\u002F7.external-oauth.md",{"type":97,"value":98,"toc":1432},"minimark",[99,117,138,143,194,212,229,244,248,639,642,648,686,691,701,759,766,770,870,873,906,910,915,1077,1081,1113,1117,1183,1187,1300,1303,1331,1341,1345,1382,1386,1405,1409,1428],[100,101,102,103,107,108,112,113,116],"p",{},"External OAuth (GitHub, Google) ships as a ",[104,105,106],"strong",{},"separate NuGet package",": ",[109,110,111],"code",{},"AuthEndpoints.External.OAuth",". It is compose-only (not wired into the ",[109,114,115],{},"AddAuthEndpoints"," facade). Default completion issues an Identity application cookie; replace the completer for JWT.",[118,119,122],"callout",{"color":120,"icon":121},"warning","i-lucide-flask-conical",[100,123,124,127,128,131,132,137],{},[104,125,126],{},"Preview."," Independent versioning from the core ",[109,129,130],{},"AuthEndpoints"," package — see the ",[133,134,136],"a",{"href":135},"\u002Fchangelog","changelog",". This package always references both GitHub and Google OAuth handler packages; per-provider NuGet splits may come later.",[139,140,142],"h2",{"id":141},"install","Install",[144,145,150],"pre",{"className":146,"code":147,"language":148,"meta":149,"style":149},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","dotnet add package AuthEndpoints --version 3.0.0-rc.3\ndotnet add package AuthEndpoints.External.OAuth --version 3.0.0-preview.2\n","bash","",[109,151,152,177],{"__ignoreMap":149},[153,154,157,161,165,168,171,174],"span",{"class":155,"line":156},"line",1,[153,158,160],{"class":159},"sBMFI","dotnet",[153,162,164],{"class":163},"sfazB"," add",[153,166,167],{"class":163}," package",[153,169,170],{"class":163}," AuthEndpoints",[153,172,173],{"class":163}," --version",[153,175,176],{"class":163}," 3.0.0-rc.3\n",[153,178,180,182,184,186,189,191],{"class":155,"line":179},2,[153,181,160],{"class":159},[153,183,164],{"class":163},[153,185,167],{"class":163},[153,187,188],{"class":163}," AuthEndpoints.External.OAuth",[153,190,173],{"class":163},[153,192,193],{"class":163}," 3.0.0-preview.2\n",[100,195,196,197,200,201,204,205,207,208,211],{},"Requires ASP.NET Core Identity (",[109,198,199],{},"UserManager"," \u002F ",[109,202,203],{},"SignInManager",") already configured — typically via ",[133,206,115],{"href":19},". It does ",[104,209,210],{},"not"," call Identity management HTTP APIs; those remain optional alongside External.",[100,213,214,216,217,220,221,224,225,228],{},[109,215,111],{}," ",[104,218,219],{},"3.0.0-preview.2+"," requires ",[104,222,223],{},"AuthEndpoints 3.0.0-rc.3+"," (public ",[109,226,227],{},"AddLoginRateLimiting"," used by OAuth DI).",[100,230,231,232,235,236,239,240,243],{},"Hosts must call ",[109,233,234],{},"UseRateLimiter()"," (included in ",[109,237,238],{},"UseAuthEndpoints","). ",[109,241,242],{},"AddExternalAuthEndpoints"," registers the login rate-limit policy.",[139,245,247],{"id":246},"di","DI",[144,249,253],{"className":250,"code":251,"language":252,"meta":149,"style":149},"language-cs shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","using AuthEndpoints.External.OAuth;\nusing AuthEndpoints.External.OAuth.GitHub;\nusing AuthEndpoints.External.OAuth.Google;\n\nbuilder.Services.AddExternalAuthEndpoints\u003CAppUser>(o =>\n{\n    o.RequireVerifiedEmail = true;   \u002F\u002F default\n    o.AutoLinkByEmail = true;        \u002F\u002F default; only when email is verified\n    o.DefaultReturnUrl = \"\u002F\";        \u002F\u002F must be relative\n    o.ErrorPath = \"\u002Fauth\u002Fexternal\u002Ferror\";\n    \u002F\u002F o.AllowedReturnUrlOrigins.Add(\"https:\u002F\u002Fapp.example.com\"); \u002F\u002F optional absolute allowlist\n})\n.AddGitHub(o =>\n{\n    o.ClientId = builder.Configuration[\"Authentication:GitHub:ClientId\"]!;\n    o.ClientSecret = builder.Configuration[\"Authentication:GitHub:ClientSecret\"]!;\n})\n.AddGoogle(o =>\n{\n    o.ClientId = builder.Configuration[\"Authentication:Google:ClientId\"]!;\n    o.ClientSecret = builder.Configuration[\"Authentication:Google:ClientSecret\"]!;\n});\n","cs",[109,254,255,279,300,322,329,360,366,391,410,436,457,466,472,487,492,524,553,558,572,577,605,633],{"__ignoreMap":149},[153,256,257,261,264,268,271,273,276],{"class":155,"line":156},[153,258,260],{"class":259},"sbssI","using",[153,262,170],{"class":263},"sTEyZ",[153,265,267],{"class":266},"sMK4o",".",[153,269,270],{"class":263},"External",[153,272,267],{"class":266},[153,274,275],{"class":263},"OAuth",[153,277,278],{"class":266},";\n",[153,280,281,283,285,287,289,291,293,295,298],{"class":155,"line":179},[153,282,260],{"class":259},[153,284,170],{"class":263},[153,286,267],{"class":266},[153,288,270],{"class":263},[153,290,267],{"class":266},[153,292,275],{"class":263},[153,294,267],{"class":266},[153,296,297],{"class":263},"GitHub",[153,299,278],{"class":266},[153,301,303,305,307,309,311,313,315,317,320],{"class":155,"line":302},3,[153,304,260],{"class":259},[153,306,170],{"class":263},[153,308,267],{"class":266},[153,310,270],{"class":263},[153,312,267],{"class":266},[153,314,275],{"class":263},[153,316,267],{"class":266},[153,318,319],{"class":263},"Google",[153,321,278],{"class":266},[153,323,325],{"class":155,"line":324},4,[153,326,328],{"emptyLinePlaceholder":327},true,"\n",[153,330,332,335,337,340,342,345,348,351,354,357],{"class":155,"line":331},5,[153,333,334],{"class":263},"builder",[153,336,267],{"class":266},[153,338,339],{"class":263},"Services",[153,341,267],{"class":266},[153,343,242],{"class":344},"s2Zo4",[153,346,347],{"class":266},"\u003C",[153,349,350],{"class":159},"AppUser",[153,352,353],{"class":266},">(",[153,355,356],{"class":159},"o",[153,358,359],{"class":266}," =>\n",[153,361,363],{"class":155,"line":362},6,[153,364,365],{"class":266},"{\n",[153,367,369,372,374,377,380,384,387],{"class":155,"line":368},7,[153,370,371],{"class":263},"    o",[153,373,267],{"class":266},[153,375,376],{"class":263},"RequireVerifiedEmail ",[153,378,379],{"class":266},"=",[153,381,383],{"class":382},"sfNiH"," true",[153,385,386],{"class":266},";",[153,388,390],{"class":389},"sHwdD","   \u002F\u002F default\n",[153,392,394,396,398,401,403,405,407],{"class":155,"line":393},8,[153,395,371],{"class":263},[153,397,267],{"class":266},[153,399,400],{"class":263},"AutoLinkByEmail ",[153,402,379],{"class":266},[153,404,383],{"class":382},[153,406,386],{"class":266},[153,408,409],{"class":389},"        \u002F\u002F default; only when email is verified\n",[153,411,413,415,417,420,422,425,428,431,433],{"class":155,"line":412},9,[153,414,371],{"class":263},[153,416,267],{"class":266},[153,418,419],{"class":263},"DefaultReturnUrl ",[153,421,379],{"class":266},[153,423,424],{"class":266}," \"",[153,426,427],{"class":163},"\u002F",[153,429,430],{"class":266},"\"",[153,432,386],{"class":266},[153,434,435],{"class":389},"        \u002F\u002F must be relative\n",[153,437,439,441,443,446,448,450,453,455],{"class":155,"line":438},10,[153,440,371],{"class":263},[153,442,267],{"class":266},[153,444,445],{"class":263},"ErrorPath ",[153,447,379],{"class":266},[153,449,424],{"class":266},[153,451,452],{"class":163},"\u002Fauth\u002Fexternal\u002Ferror",[153,454,430],{"class":266},[153,456,278],{"class":266},[153,458,460,463],{"class":155,"line":459},11,[153,461,462],{"class":389},"    \u002F\u002F o.AllowedReturnUrlOrigins.Add(\"https:\u002F\u002Fapp.example.com\");",[153,464,465],{"class":389}," \u002F\u002F optional absolute allowlist\n",[153,467,469],{"class":155,"line":468},12,[153,470,471],{"class":266},"})\n",[153,473,475,477,480,483,485],{"class":155,"line":474},13,[153,476,267],{"class":266},[153,478,479],{"class":344},"AddGitHub",[153,481,482],{"class":266},"(",[153,484,356],{"class":159},[153,486,359],{"class":266},[153,488,490],{"class":155,"line":489},14,[153,491,365],{"class":266},[153,493,495,497,499,502,504,507,509,511,514,516,519,521],{"class":155,"line":494},15,[153,496,371],{"class":263},[153,498,267],{"class":266},[153,500,501],{"class":263},"ClientId ",[153,503,379],{"class":266},[153,505,506],{"class":263}," builder",[153,508,267],{"class":266},[153,510,23],{"class":263},[153,512,513],{"class":266},"[",[153,515,430],{"class":266},[153,517,518],{"class":163},"Authentication:GitHub:ClientId",[153,520,430],{"class":266},[153,522,523],{"class":266},"]!;\n",[153,525,527,529,531,534,536,538,540,542,544,546,549,551],{"class":155,"line":526},16,[153,528,371],{"class":263},[153,530,267],{"class":266},[153,532,533],{"class":263},"ClientSecret ",[153,535,379],{"class":266},[153,537,506],{"class":263},[153,539,267],{"class":266},[153,541,23],{"class":263},[153,543,513],{"class":266},[153,545,430],{"class":266},[153,547,548],{"class":163},"Authentication:GitHub:ClientSecret",[153,550,430],{"class":266},[153,552,523],{"class":266},[153,554,556],{"class":155,"line":555},17,[153,557,471],{"class":266},[153,559,561,563,566,568,570],{"class":155,"line":560},18,[153,562,267],{"class":266},[153,564,565],{"class":344},"AddGoogle",[153,567,482],{"class":266},[153,569,356],{"class":159},[153,571,359],{"class":266},[153,573,575],{"class":155,"line":574},19,[153,576,365],{"class":266},[153,578,580,582,584,586,588,590,592,594,596,598,601,603],{"class":155,"line":579},20,[153,581,371],{"class":263},[153,583,267],{"class":266},[153,585,501],{"class":263},[153,587,379],{"class":266},[153,589,506],{"class":263},[153,591,267],{"class":266},[153,593,23],{"class":263},[153,595,513],{"class":266},[153,597,430],{"class":266},[153,599,600],{"class":163},"Authentication:Google:ClientId",[153,602,430],{"class":266},[153,604,523],{"class":266},[153,606,608,610,612,614,616,618,620,622,624,626,629,631],{"class":155,"line":607},21,[153,609,371],{"class":263},[153,611,267],{"class":266},[153,613,533],{"class":263},[153,615,379],{"class":266},[153,617,506],{"class":263},[153,619,267],{"class":266},[153,621,23],{"class":263},[153,623,513],{"class":266},[153,625,430],{"class":266},[153,627,628],{"class":163},"Authentication:Google:ClientSecret",[153,630,430],{"class":266},[153,632,523],{"class":266},[153,634,636],{"class":155,"line":635},22,[153,637,638],{"class":266},"});\n",[100,640,641],{},"ClientId\u002FSecret are validated on startup. Missing values fail fast.",[100,643,644,647],{},[109,645,646],{},"AddExternalAuthBuilder"," methods:",[649,650,651,663,673],"ul",{},[652,653,654,200,656,658,659,662],"li",{},[109,655,479],{},[109,657,565],{}," — OAuth handlers (",[109,660,661],{},"SignInScheme = Identity.External",") + provider metadata",[652,664,665,668,669,672],{},[109,666,667],{},"AddCompleter\u003CT>"," — replace cookie completion (e.g. ",[109,670,671],{},"JwtExternalLoginCompleter\u003CAppUser>",")",[652,674,675,200,678,681,682,672],{},[109,676,677],{},"AddProvider",[109,679,680],{},"AddProvider\u003CT>"," — custom providers (see ",[133,683,685],{"href":684},"#custom-providers","Custom providers",[687,688,690],"h3",{"id":689},"jwt-completion","JWT completion",[100,692,693,694,696,697,700],{},"Requires ",[133,695,74],{"href":75}," services registered (",[109,698,699],{},"AddJwtEndpoints","):",[144,702,704],{"className":250,"code":703,"language":252,"meta":149,"style":149},"builder.Services.AddExternalAuthEndpoints\u003CAppUser>()\n    .AddCompleter\u003CJwtExternalLoginCompleter\u003CAppUser>>()\n    .AddGitHub(...);\n",[109,705,706,725,745],{"__ignoreMap":149},[153,707,708,710,712,714,716,718,720,722],{"class":155,"line":156},[153,709,334],{"class":263},[153,711,267],{"class":266},[153,713,339],{"class":263},[153,715,267],{"class":266},[153,717,242],{"class":344},[153,719,347],{"class":266},[153,721,350],{"class":159},[153,723,724],{"class":266},">()\n",[153,726,727,730,733,735,738,740,742],{"class":155,"line":179},[153,728,729],{"class":266},"    .",[153,731,732],{"class":344},"AddCompleter",[153,734,347],{"class":266},[153,736,737],{"class":159},"JwtExternalLoginCompleter",[153,739,347],{"class":266},[153,741,350],{"class":159},[153,743,744],{"class":266},">>()\n",[153,746,747,749,751,754,756],{"class":155,"line":302},[153,748,729],{"class":266},[153,750,479],{"class":344},[153,752,753],{"class":266},"(..",[153,755,267],{"class":263},[153,757,758],{"class":266},");\n",[100,760,761,762,765],{},"After OAuth, a refresh cookie is written and the browser redirects to ",[109,763,764],{},"returnUrl",". The SPA should obtain an access token via the JWT refresh flow (CSRF + refresh cookie) — the access token is not placed in the redirect URL.",[139,767,769],{"id":768},"map","Map",[144,771,773],{"className":250,"code":772,"language":252,"meta":149,"style":149},"var external = app.MapGroup(\"\u002Fauth\u002Fexternal\").WithTags(\"External\");\nexternal.MapGitHubAuthEndpoints\u003CAppUser>();\nexternal.MapGoogleAuthEndpoints\u003CAppUser>();\nexternal.MapExternalAccountEndpoints\u003CAppUser>(); \u002F\u002F link \u002F unlink while signed in\n",[109,774,775,819,836,851],{"__ignoreMap":149},[153,776,777,780,783,786,789,791,794,796,798,801,803,806,809,811,813,815,817],{"class":155,"line":156},[153,778,779],{"class":159},"var",[153,781,782],{"class":159}," external",[153,784,785],{"class":266}," =",[153,787,788],{"class":263}," app",[153,790,267],{"class":266},[153,792,793],{"class":344},"MapGroup",[153,795,482],{"class":266},[153,797,430],{"class":266},[153,799,800],{"class":163},"\u002Fauth\u002Fexternal",[153,802,430],{"class":266},[153,804,805],{"class":266},").",[153,807,808],{"class":344},"WithTags",[153,810,482],{"class":266},[153,812,430],{"class":266},[153,814,270],{"class":163},[153,816,430],{"class":266},[153,818,758],{"class":266},[153,820,821,824,826,829,831,833],{"class":155,"line":179},[153,822,823],{"class":263},"external",[153,825,267],{"class":266},[153,827,828],{"class":344},"MapGitHubAuthEndpoints",[153,830,347],{"class":266},[153,832,350],{"class":159},[153,834,835],{"class":266},">();\n",[153,837,838,840,842,845,847,849],{"class":155,"line":302},[153,839,823],{"class":263},[153,841,267],{"class":266},[153,843,844],{"class":344},"MapGoogleAuthEndpoints",[153,846,347],{"class":266},[153,848,350],{"class":159},[153,850,835],{"class":266},[153,852,853,855,857,860,862,864,867],{"class":155,"line":324},[153,854,823],{"class":263},[153,856,267],{"class":266},[153,858,859],{"class":344},"MapExternalAccountEndpoints",[153,861,347],{"class":266},[153,863,350],{"class":159},[153,865,866],{"class":266},">();",[153,868,869],{"class":389}," \u002F\u002F link \u002F unlink while signed in\n",[100,871,872],{},"Or map every registered sign-in provider:",[144,874,876],{"className":250,"code":875,"language":252,"meta":149,"style":149},"app.MapGroup(\"\u002Fauth\u002Fexternal\").MapExternalAuthEndpoints\u003CAppUser>();\n",[109,877,878],{"__ignoreMap":149},[153,879,880,883,885,887,889,891,893,895,897,900,902,904],{"class":155,"line":156},[153,881,882],{"class":263},"app",[153,884,267],{"class":266},[153,886,793],{"class":344},[153,888,482],{"class":266},[153,890,430],{"class":266},[153,892,800],{"class":163},[153,894,430],{"class":266},[153,896,805],{"class":266},[153,898,899],{"class":344},"MapExternalAuthEndpoints",[153,901,347],{"class":266},[153,903,350],{"class":159},[153,905,835],{"class":266},[139,907,909],{"id":908},"routes","Routes",[100,911,912,913,700],{},"Relative to the group prefix (example ",[109,914,800],{},[916,917,918,937],"table",{},[919,920,921],"thead",{},[922,923,924,928,931,934],"tr",{},[925,926,927],"th",{},"Method",[925,929,930],{},"Path",[925,932,933],{},"Auth",[925,935,936],{},"Notes",[938,939,940,960,979,995,1011,1028,1045,1061],"tbody",{},[922,941,942,948,953,955],{},[943,944,945],"td",{},[109,946,947],{},"GET",[943,949,950],{},[109,951,952],{},"\u002Flogin\u002Fgithub",[943,954],{},[943,956,957,958],{},"Challenge; rate-limited; ",[109,959,764],{},[922,961,962,966,971,973],{},[943,963,964],{},[109,965,947],{},[943,967,968],{},[109,969,970],{},"\u002Flogin\u002Fgithub\u002Fcallback",[943,972],{},[943,974,975,976],{},"Provision + completer; errors redirect to ",[109,977,978],{},"ErrorPath",[922,980,981,985,990,992],{},[943,982,983],{},[109,984,947],{},[943,986,987],{},[109,988,989],{},"\u002Flogin\u002Fgoogle",[943,991],{},[943,993,994],{},"Challenge; rate-limited",[922,996,997,1001,1006,1008],{},[943,998,999],{},[109,1000,947],{},[943,1002,1003],{},[109,1004,1005],{},"\u002Flogin\u002Fgoogle\u002Fcallback",[943,1007],{},[943,1009,1010],{},"Provision + completer",[922,1012,1013,1017,1022,1025],{},[943,1014,1015],{},[109,1016,947],{},[943,1018,1019],{},[109,1020,1021],{},"\u002Flogins",[943,1023,1024],{},"yes",[943,1026,1027],{},"List linked external logins",[922,1029,1030,1035,1040,1042],{},[943,1031,1032],{},[109,1033,1034],{},"DELETE",[943,1036,1037],{},[109,1038,1039],{},"\u002Flogins\u002F{loginProvider}\u002F{providerKey}",[943,1041,1024],{},[943,1043,1044],{},"Unlink",[922,1046,1047,1051,1056,1058],{},[943,1048,1049],{},[109,1050,947],{},[943,1052,1053],{},[109,1054,1055],{},"\u002Flink\u002F{scheme}",[943,1057,1024],{},[943,1059,1060],{},"Start link challenge",[922,1062,1063,1067,1072,1074],{},[943,1064,1065],{},[109,1066,947],{},[943,1068,1069],{},[109,1070,1071],{},"\u002Flink\u002F{scheme}\u002Fcallback",[943,1073,1024],{},[943,1075,1076],{},"Complete link",[687,1078,1080],{"id":1079},"idp-callback-paths","IdP callback paths",[916,1082,1083,1093],{},[919,1084,1085],{},[922,1086,1087,1090],{},[925,1088,1089],{},"Provider",[925,1091,1092],{},"Middleware path",[938,1094,1095,1104],{},[922,1096,1097,1099],{},[943,1098,297],{},[943,1100,1101],{},[109,1102,1103],{},"\u002Fsignin-github",[922,1105,1106,1108],{},[943,1107,319],{},[943,1109,1110],{},[109,1111,1112],{},"\u002Fsignin-google",[139,1114,1116],{"id":1115},"security-behavior","Security behavior",[649,1118,1119,1133,1142,1148,1154,1165],{},[652,1120,1121,1124,1125,1128,1129,1132],{},[104,1122,1123],{},"Verified email (default):"," create\u002Flink requires ",[109,1126,1127],{},"email_verified=true"," (Google\u002FOIDC). GitHub marks email verified when the handler surfaces an email via ",[109,1130,1131],{},"user:email"," (verified primary).",[652,1134,1135,1138,1139,267],{},[104,1136,1137],{},"Auto-link by email (default on):"," only when the email is verified; disable with ",[109,1140,1141],{},"AutoLinkByEmail = false",[652,1143,1144,1147],{},[104,1145,1146],{},"EmailConfirmed"," on new users matches whether the provider email was verified.",[652,1149,1150,1153],{},[104,1151,1152],{},"External cookie"," is signed out after successful app sign-in \u002F link.",[652,1155,1156,1161,1162,267],{},[104,1157,1158,1160],{},[109,1159,764],{},":"," relative local paths only by default; absolute URLs need ",[109,1163,1164],{},"AllowedReturnUrlOrigins",[652,1166,1167,1170,1171,1174,1175,1178,1179,1182],{},[104,1168,1169],{},"Errors \u002F cancel:"," browser redirects to ",[109,1172,1173],{},"ErrorPath?error=&error_description=","; clients that prefer ",[109,1176,1177],{},"application\u002Fjson"," over ",[109,1180,1181],{},"text\u002Fhtml"," get Problem details instead.",[139,1184,1186],{"id":1185},"options","Options",[916,1188,1189,1201],{},[919,1190,1191],{},[922,1192,1193,1196,1199],{},[925,1194,1195],{},"Property",[925,1197,1198],{},"Default",[925,1200,936],{},[938,1202,1203,1218,1233,1247,1261,1275,1287],{},[922,1204,1205,1210,1215],{},[943,1206,1207],{},[109,1208,1209],{},"SignInScheme",[943,1211,1212],{},[109,1213,1214],{},"null",[943,1216,1217],{},"Cookie completer scheme override",[922,1219,1220,1225,1230],{},[943,1221,1222],{},[109,1223,1224],{},"IsPersistent",[943,1226,1227],{},[109,1228,1229],{},"true",[943,1231,1232],{},"Application cookie persistence",[922,1234,1235,1240,1244],{},[943,1236,1237],{},[109,1238,1239],{},"DefaultReturnUrl",[943,1241,1242],{},[109,1243,427],{},[943,1245,1246],{},"Relative local path",[922,1248,1249,1254,1258],{},[943,1250,1251],{},[109,1252,1253],{},"RequireVerifiedEmail",[943,1255,1256],{},[109,1257,1229],{},[943,1259,1260],{},"Block unverified provider emails",[922,1262,1263,1268,1272],{},[943,1264,1265],{},[109,1266,1267],{},"AutoLinkByEmail",[943,1269,1270],{},[109,1271,1229],{},[943,1273,1274],{},"Link existing user by verified email",[922,1276,1277,1281,1284],{},[943,1278,1279],{},[109,1280,1164],{},[943,1282,1283],{},"empty",[943,1285,1286],{},"Absolute http(s) origins allowlist",[922,1288,1289,1293,1297],{},[943,1290,1291],{},[109,1292,978],{},[943,1294,1295],{},[109,1296,452],{},[943,1298,1299],{},"Relative path for error redirects",[139,1301,685],{"id":1302},"custom-providers",[1304,1305,1306,1312,1319],"ol",{},[652,1307,1308,1309,267],{},"Register an OAuth handler with ",[109,1310,1311],{},"SignInScheme = IdentityConstants.ExternalScheme",[652,1313,1314,1315,1318],{},"Implement ",[109,1316,1317],{},"IExternalAuthProvider"," (scheme + login\u002Fcallback paths + endpoint name).",[652,1320,1321,1324,1325,1328,1329,267],{},[109,1322,1323],{},"builder.AddProvider\u003CMyProvider>()"," then ",[109,1326,1327],{},"MapExternalAuthProvider\u003CTUser>(\"MyScheme\")"," or ",[109,1330,899],{},[100,1332,1333,1334,1337,1338,1340],{},"Ensure the provider principal includes email + ",[109,1335,1336],{},"email_verified"," when ",[109,1339,1253],{}," is true.",[139,1342,1344],{"id":1343},"configuration-demo","Configuration (Demo)",[916,1346,1347,1356],{},[919,1348,1349],{},[922,1350,1351,1354],{},[925,1352,1353],{},"Variable",[925,1355,1089],{},[938,1357,1358,1370],{},[922,1359,1360,1368],{},[943,1361,1362,200,1365],{},[109,1363,1364],{},"GITHUB_CLIENT_ID",[109,1366,1367],{},"GITHUB_CLIENT_SECRET",[943,1369,297],{},[922,1371,1372,1380],{},[943,1373,1374,200,1377],{},[109,1375,1376],{},"GOOGLE_CLIENT_ID",[109,1378,1379],{},"GOOGLE_CLIENT_SECRET",[943,1381,319],{},[139,1383,1385],{"id":1384},"gotchas","Gotchas",[649,1387,1388,1396,1402],{},[652,1389,1390,1391,1393,1394,805],{},"Pipeline: authentication + ",[109,1392,234],{}," (via ",[109,1395,238],{},[652,1397,1398,1399,1401],{},"Host an error page at ",[109,1400,978],{}," (or change the option).",[652,1403,1404],{},"Package split for GitHub-only \u002F Google-only NuGets is deferred; both handler packages ship with this preview.",[139,1406,1408],{"id":1407},"related","Related",[649,1410,1411,1415,1419,1424],{},[652,1412,1413],{},[133,1414,64],{"href":65},[652,1416,1417],{},[133,1418,74],{"href":75},[652,1420,1421],{},[133,1422,1423],{"href":35},"Composable endpoints",[652,1425,1426],{},[133,1427,13],{"href":14},[1429,1430,1431],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}",{"title":149,"searchDepth":156,"depth":179,"links":1433},[1434,1435,1438,1439,1442,1443,1444,1445,1446,1447],{"id":141,"depth":179,"text":142},{"id":246,"depth":179,"text":247,"children":1436},[1437],{"id":689,"depth":302,"text":690},{"id":768,"depth":179,"text":769},{"id":908,"depth":179,"text":909,"children":1440},[1441],{"id":1079,"depth":302,"text":1080},{"id":1115,"depth":179,"text":1116},{"id":1185,"depth":179,"text":1186},{"id":1302,"depth":179,"text":685},{"id":1343,"depth":179,"text":1344},{"id":1384,"depth":179,"text":1385},{"id":1407,"depth":179,"text":1408},"Separate preview package for GitHub and Google OAuth login with Identity cookie or JWT completion.","md",null,{},{"icon":92},{"title":89,"description":1448},"zV882KwCF8syZoqPM46UlHGbDpLm2-GOsxYh62Rgy8o",[1456,1450],{"title":84,"path":85,"stem":86,"description":1457,"icon":87,"children":-1},"Step-up reauthentication for sensitive manage and passkey actions.",1785399440326]