Modules

ReAuth

Step-up reauthentication for sensitive manage and passkey actions.

ReAuth (step-up) confirms the user's identity before sensitive mutations. It is included when you map Identity management (with antiforgery in the management map).

Schemes and header

Piece	Value
Cookie scheme	`AuthEndpoints.ReAuth` (5 minutes)
Bearer scheme	`AuthEndpoints.ReAuth.Bearer`
Header	`X-AuthEndpoints-Reauth` with `reauthToken`
Policy	`ReAuthPolicy` (claim `Reauth=true`)

Routes

Mapped with management (facade under /identity):

Method	Path	Notes
`GET`	`/manage/authMethods`	Available step-up methods
`POST`	`/confirmIdentity`	Exactly one proof; CSRF when mapped via management
`POST`	`/confirmIdentity/passkeyOptions`	WebAuthn options for passkey step-up

ConfirmIdentity proof

Provide exactly one of:

password
twoFactorCode
twoFactorRecoveryCode
credentialJson (passkey assertion)

On success: ReAuth cookie for browser clients; reauthToken for API clients using the header.

Protecting host endpoints

builder.Services.AddCookieAuthEndpoints(); // or AddBearerAuthEndpoints — registers ReAuth schemes

app.MapPost("/billing/update", handler)
    .RequireAuthorization()
    .RequireReauth();

Typical client flow

GET /identity/manage/authMethods
Collect proof (password, 2FA, or passkey via /confirmIdentity/passkeyOptions)
POST /identity/confirmIdentity
Retry the sensitive action with ReAuth cookie and/or X-AuthEndpoints-Reauth

Where ReAuth is required

Manage 2FA / info mutations
Passkey add, rename, delete, and creation options
Any host endpoint with .RequireReauth()

Passkeys

WebAuthn passwordless register/login and credential management endpoints.

External OAuth

Separate preview package for GitHub and Google OAuth login with Identity cookie or JWT completion.