Composition table
Each group is one Add* and one Map*. A per-session group finishes in a sign-in completer, so map it once for each session prefix. A shared group does not start a session, so map it once.
This table is the route list for the password facade, the 3.x composites, and a custom host. The password facade's expansion is on Password auth. The 3.x call is on 3.x facade. The upgrade guide links here instead of copying the table: Upgrade to 4.0.
Routes below are relative to the group you pass to Map*. Passkey maps add the /passkeys prefix themselves. The composite names in the last column are the route-table snapshots. MapPasswordAuthCookie is MapPasswordAuth with Session left at Cookie and no passkey domain. MapPasswordAuthCookiePasskeys is that call with Passkeys.ServerDomain set. The Jwt names are the same split with Session set to Jwt and cookie refresh transport. Body transport drops GET /csrfToken from MapJwtSessionEndpoints.
MapPasskeySignInEndpoints still maps register/options and register, and it ensures confirm-email when that endpoint name is new. MapPasskeyEndpoints includes those sign-in routes and passkey management, and it leaves confirm-email unmapped. MapPasskeySignUpEndpoints and MapPasskeyRegisterOptionsEndpoints are the split maps for hosts that do not want the whole sign-in bundle.
MapAccountManagementEndpoints maps POST /confirmIdentity/passkeyOptions when passkey services are registered. MapIdentityManagementApi always maps that route. POST /confirmIdentity/emailCode/send is mapped only when email-code services are registered. The AddAuthEndpoints / MapAuthEndpoints facade maps neither.
| Add | Map | Scope | Routes | Composites |
|---|---|---|---|---|
AddPasswordSignUpEndpoints | MapPasswordSignUpEndpoints | shared | POST /register | MapIdentityManagementApi, MapPasswordAuthCookie, MapPasswordAuthCookiePasskeys, MapPasswordAuthJwt, MapPasswordAuthJwtPasskeys |
AddPasswordSignInEndpoints | MapPasswordSignInEndpoints | per session | POST /login | MapCookieAuthEndpoints, MapBearerAuthEndpoints, MapPasswordAuthCookie, MapPasswordAuthCookiePasskeys |
AddPasswordRecoveryEndpoints | MapPasswordRecoveryEndpoints | shared | POST /forgotPassword, POST /resetPassword | MapIdentityManagementApi, MapPasswordAuthCookie, MapPasswordAuthCookiePasskeys, MapPasswordAuthJwt, MapPasswordAuthJwtPasskeys |
AddAccountAbuseRateLimiting | MapConfirmEmailEndpoints | shared | GET /confirmEmail, POST /resendConfirmationEmail | MapIdentityManagementApi, MapPasswordAuthCookie, MapPasswordAuthCookiePasskeys, MapPasswordAuthJwt, MapPasswordAuthJwtPasskeys |
AddAccountManagementEndpoints | MapAccountManagementEndpoints | shared | GET /manage/info, POST /manage/info, GET /manage/2fa, POST /manage/2fa, GET /manage/authMethods, POST /confirmIdentity, POST /manage/password | MapIdentityManagementApi, MapPasswordAuthCookie, MapPasswordAuthCookiePasskeys, MapPasswordAuthJwt, MapPasswordAuthJwtPasskeys |
AddAccountManagementEndpoints | MapAccountManagementEndpoints | shared | POST /confirmIdentity/passkeyOptions | MapIdentityManagementApi, MapPasswordAuthCookiePasskeys, MapPasswordAuthJwtPasskeys |
AddAccountManagementEndpoints | MapAccountManagementEndpoints | shared | POST /confirmIdentity/emailCode/send | none |
AddCookieSessionEndpoints | MapCookieSessionEndpoints | per session | POST /logout, GET /csrfToken | MapCookieAuthEndpoints, MapPasswordAuthCookie, MapPasswordAuthCookiePasskeys |
AddBearerSessionEndpoints | MapBearerSessionEndpoints | per session | POST /refresh, POST /logout | MapBearerAuthEndpoints |
AddJwtEndpoints | MapJwtPasswordEndpoints | per session | POST /create | MapJwtAuthEndpoints, MapPasswordAuthJwt, MapPasswordAuthJwtPasskeys |
AddJwtEndpoints | MapJwtSessionEndpoints | per session | POST /refresh, GET /verify, POST /logout, GET /csrfToken | MapJwtAuthEndpoints, MapPasswordAuthJwt, MapPasswordAuthJwtPasskeys |
AddPasskeySignInEndpoints | MapPasskeySignInEndpoints | per session | POST /passkeys/requestOptions, POST /passkeys/login, POST /passkeys/register/options, POST /passkeys/register | MapPasskeyEndpoints, MapPasswordAuthCookiePasskeys, MapPasswordAuthJwtPasskeys |
AddPasskeySignUpEndpoints | MapPasskeySignUpEndpoints | per session | POST /passkeys/register | none |
AddPasskeyRegisterOptionsEndpoints | MapPasskeyRegisterOptionsEndpoints | shared | POST /passkeys/register/options | none |
AddPasskeyManagementEndpoints | MapPasskeyManagementEndpoints | shared | GET /passkeys/, POST /passkeys/, POST /passkeys/creationOptions, PATCH /passkeys/, DELETE /passkeys/{credentialIdUrl} | MapPasskeyEndpoints, MapPasswordAuthCookiePasskeys, MapPasswordAuthJwtPasskeys |
AddEmailCodeSendEndpoints | MapEmailCodeSendEndpoints | shared | POST /emailCode/send | none |
AddEmailCodeSignInEndpoints | MapEmailCodeSignInEndpoints | per session | POST /emailCode/verify | none |
AddExternalAuthEndpoints | MapExternalAuthEndpoints | per session | GET /login/github, GET /login/github/callback | none |
AddExternalAuthEndpoints | MapExternalAccountEndpoints | shared | GET /logins, DELETE /logins/{loginProvider}/{providerKey}, GET /link/{scheme}, GET /link/{scheme}/callback | none |
MapExternalAuthEndpoints for Google uses GET /login/google and GET /login/google/callback. Those paths are the same shape as the GitHub row. They are not in a composite snapshot.
MapSignInEndpoints<TUser>(AuthEndpointsSession) maps the per-session rows whose Add* is registered, plus that session's session row. Password login on a JWT session is MapJwtPasswordEndpoints, not POST /login. MapSharedAuthEndpoints<TUser>(sharedPath) maps the shared rows whose Add* is registered. Null sharedPath uses the builder you call it on.
MapPasswordEndpoints is sign-up, sign-in, and recovery. MapCookieAuthEndpoints is cookie POST /login on the 3.x handler, then MapCookieSessionEndpoints. MapBearerAuthEndpoints is Identity bearer POST /login, then MapBearerSessionEndpoints. MapJwtAuthEndpoints is MapJwtPasswordEndpoints and MapJwtSessionEndpoints. MapIdentityManagementApi is MapPasswordEndpoints with PasswordLoginMode.None, MapConfirmEmailEndpoints, and MapAccountManagementEndpoints. MapPasskeyEndpoints is passkey sign-in and management on one /passkeys group.
Two session prefixes can both map POST /logout. Put them on different groups. MapPasswordEndpoints in cookie mode and MapCookieAuthEndpoints both map POST /login. MapPasskeyEndpoints already includes sign-in, so do not add MapPasskeySignInEndpoints on that same prefix.
Confirm-email keeps one endpoint name. Map it with the shared routes, not under every session prefix. MapPasswordSignUpEndpoints and MapAccountManagementEndpoints ensure that route when the name is new. A later map with the same name leaves the first route in place.