ReAuth

ReAuth (step-up) confirms the user's identity before sensitive mutations. It is included when you map Identity management (with antiforgery in the management map).

Schemes and header

Routes

Mapped with management (facade under /identity):

ConfirmIdentity proof

Provide exactly one of:

• password
• twoFactorCode
• twoFactorRecoveryCode
• credentialJson (passkey assertion)

On success: ReAuth cookie for browser clients; reauthToken for API clients using the header. Cookie and token share the same lifetime.

Lifetime

Default is 5 minutes, non-persistent, no sliding expiration. Set AuthEndpointsOptions.ReAuth.Lifetime (a TimeSpan) on the facade, or IOptions<AuthEndpointsReAuthOptions> on a composable host. One value drives confirm ExpiresUtc, cookie ExpireTimeSpan, and reauthToken expiry.

Valid range: 1 minute through 60 minutes. Startup rejects zero, negative, over 60 minutes, and InfiniteTimeSpan.

builder.Services.AddAuthEndpoints<AppUser, AppDbContext>(o =>
{
    o.ReAuth.Lifetime = TimeSpan.FromMinutes(2);
});

Protecting host endpoints

builder.Services.AddCookieAuthEndpoints(); // or AddBearerAuthEndpoints — registers ReAuth schemes

app.MapPost("/billing/update", handler)
    .RequireAuthorization()
    .RequireReauth();

Typical client flow

1. GET /identity/manage/authMethods
2. Collect proof (password, 2FA, or passkey via /confirmIdentity/passkeyOptions)
3. POST /identity/confirmIdentity
4. Retry the sensitive action with ReAuth cookie and/or X-AuthEndpoints-Reauth

Where ReAuth is required

• Manage 2FA / info mutations
• Passkey add, rename, delete, and creation options
• Any host endpoint with .RequireReauth()

Related

• Identity management
• Passkeys
• Composable requirements