Modules
Passkeys
WebAuthn passwordless register/login and credential management endpoints.
Passkey (WebAuthn) endpoints for passwordless register/login and managing credentials on an existing account.
DI
builder.Services.AddPasskeyEndpoints();
Facade: passkeys are enabled by default; set Passkeys.ServerDomain (required in Production).
Map
app.MapGroup("/account").MapPasskeyEndpoints<AppUser>();
Routes are mapped under {prefix}/passkeys (facade default /account/passkeys).
Routes
| Method | Path | Auth / extras |
|---|---|---|
POST | /passkeys/creationOptions | Auth + ReAuth + CSRF + rate limit |
POST | /passkeys/requestOptions | CSRF + rate limit; optional ?username= |
POST | /passkeys/register/options | CSRF; body { email } |
POST | /passkeys/register | CSRF; passwordless create + sign-in |
POST | /passkeys/login | CSRF; scheme via useCookies / useSessionCookies |
POST | /passkeys/ | Add passkey (auth + ReAuth + CSRF) |
GET | /passkeys/ | List passkeys (auth) |
PATCH | /passkeys/ | Rename (auth + ReAuth + CSRF) |
DELETE | /passkeys/{credentialIdUrl} | Remove (auth + ReAuth + CSRF) |
Passwordless register flow
POST /account/passkeys/register/optionswith{ "email": "..." }- Browser
navigator.credentials.create(...) POST /account/passkeys/registerwith{ "email": "...", "credentialJson": "..." }
Sign-in scheme
After register/login:
?useCookies=true→ persistent application cookie?useSessionCookies=true→ session application cookie- neither → Identity bearer token (
AccessTokenResponse)
JWT is not issued — call JWT /create separately if your host uses JWT.
Constraints
- Passwordless register needs
IdentityUserwithstringorGuidkey. - CSRF is required for WebAuthn ceremonies.
- Sensitive credential mutations require ReAuth.