Identity management
Maps account lifecycle endpoints. Pair with a sign-in module (cookie, bearer, or JWT).
DI
Registered by the facade (AddAuthEndpoints) or manually via Identity API endpoints + EF stores + token providers.
Map
app.MapGroup("/identity").MapIdentityManagementApi<AppUser>();
// Optional: unique confirm email name when mapping twice
// .MapIdentityManagementApi<AppUser>(confirmEmailEndpointName: "BearerConfirmEmail");
Routes
Relative to the group prefix (facade default /identity):
| Method | Path | Notes |
|---|---|---|
POST | /register | Creates user; duplicate email returns 200 OK (no enumeration). Rate-limited. |
GET | /confirmEmail | Query userId, code, optional changedEmail |
POST | /resendConfirmationEmail | Auth + CSRF + rate limit. Signed-in user only; body email is ignored. |
POST | /forgotPassword | Rate-limited |
POST | /resetPassword | Rate-limited |
GET | /manage/authMethods | ReAuth methods (see ReAuth) |
POST | /confirmIdentity | Step-up proof |
POST | /confirmIdentity/passkeyOptions | Passkey options for step-up |
GET | /manage/2fa | 2FA status |
POST | /manage/2fa | Enable/disable 2FA — CSRF + ReAuth |
GET | /manage/info | Current user info |
POST | /manage/info | Update info — CSRF + ReAuth |
confirmEmail
Query string on GET /confirmEmail:
| Query | Required | Notes |
|---|---|---|
userId | yes | Identity user id |
code | yes | Confirmation (or change-email) token from the emailed link |
changedEmail | no | When set, confirms a change to that email and updates the user name |
When AuthEndpointsOptions.EmailConfirmation.ConfirmEmailRedirectUri is set, success and failure return 302 to that URI with status and flow instead of the thank-you body or 401. The account mutation still runs first. Leave the option unset for callers that expect 200 or 401. See Configuration.
resendConfirmationEmail
Requires a signed-in user (RequireAuthorization + CSRF). The request body email (ResendConfirmationEmailRequest) is ignored; the handler resends to the signed-in user's email.
Authorization
Management authorize attribute accepts registered schemes among: application cookie, Identity bearer, and JWT bearer.
Sensitive manage mutations require antiforgery and ReAuth.
Gotchas
- Map management once in production (see Requirements).
- Production requires a real
IEmailSender<TUser>for confirmation and reset emails. - Register alone does not sign the user in — use a sign-in module.