Modules
Identity management
Account lifecycle endpoints — register, confirm, forgot/reset password, manage info and 2FA.
Maps account lifecycle endpoints. Pair with a sign-in module (cookie, bearer, or JWT).
DI
Registered by the facade (AddAuthEndpoints) or manually via Identity API endpoints + EF stores + token providers.
Map
app.MapGroup("/identity").MapIdentityManagementApi<AppUser>();
// Optional: unique confirm email name when mapping twice
// .MapIdentityManagementApi<AppUser>(confirmEmailEndpointName: "BearerConfirmEmail");
Routes
Relative to the group prefix (facade default /identity):
| Method | Path | Notes |
|---|---|---|
POST | /register | Creates user; duplicate email returns 200 OK (no enumeration). Rate-limited. |
GET | /confirmEmail | Confirms email via link token |
POST | /resendConfirmationEmail | Auth + CSRF + rate limit |
POST | /forgotPassword | Rate-limited |
POST | /resetPassword | Rate-limited |
GET | /manage/authMethods | ReAuth methods (see ReAuth) |
POST | /confirmIdentity | Step-up proof |
POST | /confirmIdentity/passkeyOptions | Passkey options for step-up |
GET | /manage/2fa | 2FA status |
POST | /manage/2fa | Enable/disable 2FA — CSRF + ReAuth |
GET | /manage/info | Current user info |
POST | /manage/info | Update info — CSRF + ReAuth |
Authorization
Management authorize attribute accepts registered schemes among: application cookie, Identity bearer, and JWT bearer.
Sensitive manage mutations require antiforgery and ReAuth.
Gotchas
- Map management once in production (see Requirements).
- Production requires a real
IEmailSender<TUser>for confirmation and reset emails. - Register alone does not sign the user in — use a sign-in module.