AuthEndpoints 3.0 RC: a composable auth endpoints library for ASP.NET Core

Today I'm releasing AuthEndpoints 3.0 RC: an auth library for ASP.NET Core that turns auth setup from a project phase into a setup step.

If you build ASP.NET Core backends or web APIs, you may have written this before. Register, login, email confirmation, password reset, 2FA, session management. Same code in every project, different user model each time. AuthEndpoints packages that work into a library on top of ASP.NET Core Identity, so a secure auth layer takes minutes to stand up instead of a week of copy-paste.

Why it's good for developer productivity

Two design decisions drive most of the value.

Opinionated options.

Auth comes with a lot of decisions, and most of them have one right answer for a web frontend backed by a single API. AuthEndpoints bakes those in: rate limiting, antiforgery, lockout-aware login, and hashed refresh tokens with reuse detection are on by default. The hardened path is the default path, so you don't have to know the pitfalls to avoid them.

Composable endpoints.

AuthEndpoints is organized as endpoints and modules you can compose manually. Need email/password with JWT? Cookie sessions with passkeys? 2FA on top of that? You pick the pieces, and the routes and validation stay consistent across the whole setup.

The quick start

Three extension methods and a few lines:

builder.Services.AddDbContext<AppDbContext>(/* your provider */);

builder.Services.AddAuthEndpoints<AppUser, AppDbContext>(o =>
{
    o.Passkeys.ServerDomain = "example.com"; // required in Production
});

builder.Services.AddTransient<IEmailSender<AppUser>, MyEmailSender>();

var app = builder.Build();

app.UseAuthEndpoints();
app.MapAuthEndpoints<AppUser>();

app.Run();

That maps the whole account lifecycle: register, confirm email, forgot and reset password, manage info and 2FA, plus step-up re-authentication for sensitive actions. You bring the DbContext and an email sender. The library handles the rest, including your choice of cookie sessions, Identity bearer tokens, or Simple JWT, and passkeys (WebAuthn) for passwordless sign-in.

What's in 3.0

• Sign-in stacks you pick: cookie sessions, Identity bearer tokens, or Simple JWT. The endpoints stay the same; the token strategy is configuration.
• Passkeys (WebAuthn) for passwordless register and login, working alongside email/password rather than replacing it.
• Hardening on by default: the opinionated defaults, enabled without extra setup.
• GitHub and Google OAuth through an optional separate package, AuthEndpoints.External.OAuth.

Help shape the final API

3.0 is a rewrite, and the API isn't frozen yet. An RC is the last moment to change things cheaply; once 3.0 ships stable, breaking changes cost everyone who adopted it. If you try it and something feels off, please open an issue. Your feedback decides what the API looks like when it ships.

In particular, I'd love to hear:

• Do naming or composition feel awkward for your app?
• Are the defaults too strict or too loose?
• Is a module missing that you'd need in a real project?

Mention which stack you used (cookies, JWT, passkeys) and what you were trying to do. No template required.

Try it

dotnet add package AuthEndpoints --version 3.0.0-rc.3

Install the package, or open the demo and click through the flows. If something feels awkward, breaks, or is missing, open an issue — that's how 3.0 stable gets shaped.

• Demo app: madeyoga/AuthEndpointsDemo, an ASP.NET Core API plus a Nuxt 4 / Nuxt UI playground, so you can click through the flows without writing a frontend first.
• Feedback: open an issue on madeyoga/AuthEndpoints.
• Docs: madeyoga.github.io/AuthEndpoints with configuration, composable modules, route tables, and production guidance.
• Repository: AuthEndpoints (MIT).