[{"data":1,"prerenderedAt":1362},["ShallowReactive",2],{"navigation":3,"\u002Fcomposables\u002Frecipes":203,"\u002Fcomposables\u002Frecipes-surround":1357},[4,33,96,114,177],{"title":5,"path":6,"stem":7,"children":8,"icon":32},"Get started","\u002Fgetting-started","1.getting-started\u002F1.index",[9,12,17,22,27],{"title":10,"path":6,"stem":7,"icon":11},"Introduction","i-lucide-house",{"title":13,"path":14,"stem":15,"icon":16},"Install AuthEndpoints","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F2.installation","i-lucide-download",{"title":18,"path":19,"stem":20,"icon":21},"Quick start","\u002Fgetting-started\u002Fquick-start","1.getting-started\u002F3.quick-start","i-lucide-play",{"title":23,"path":24,"stem":25,"icon":26},"Choose a sign-in stack","\u002Fgetting-started\u002Fchoose-a-sign-in-stack","1.getting-started\u002F4.choose-a-sign-in-stack","i-lucide-signpost",{"title":28,"path":29,"stem":30,"icon":31},"Use the AuthEndpoints skill with coding agents","\u002Fgetting-started\u002Fai-agents","1.getting-started\u002F5.ai-agents","i-lucide-bot","i-lucide-rocket",{"title":34,"path":35,"stem":36,"children":37,"icon":95},"Guides","\u002Fguides","2.guides\u002F01.index",[38,40,45,50,55,60,65,70,75,80,85,90],{"title":34,"path":35,"stem":36,"icon":39},"i-lucide-list-checks",{"title":41,"path":42,"stem":43,"icon":44},"Register users","\u002Fguides\u002Fregistration","2.guides\u002F02.registration","i-lucide-user-plus",{"title":46,"path":47,"stem":48,"icon":49},"Sign users in","\u002Fguides\u002Fsign-in","2.guides\u002F03.sign-in","i-lucide-log-in",{"title":51,"path":52,"stem":53,"icon":54},"Sign users out","\u002Fguides\u002Fsign-out","2.guides\u002F04.sign-out","i-lucide-log-out",{"title":56,"path":57,"stem":58,"icon":59},"Turn on two-factor authentication","\u002Fguides\u002Ftwo-factor","2.guides\u002F05.two-factor","i-lucide-smartphone",{"title":61,"path":62,"stem":63,"icon":64},"Reset a forgotten password","\u002Fguides\u002Freset-password","2.guides\u002F06.reset-password","i-lucide-key-round",{"title":66,"path":67,"stem":68,"icon":69},"Change a user's email or password","\u002Fguides\u002Fmanage-account","2.guides\u002F07.manage-account","i-lucide-user-cog",{"title":71,"path":72,"stem":73,"icon":74},"Add, rename, and remove passkeys","\u002Fguides\u002Fmanage-passkeys","2.guides\u002F08.manage-passkeys","i-lucide-scan-face",{"title":76,"path":77,"stem":78,"icon":79},"Link and unlink GitHub or Google accounts","\u002Fguides\u002Flink-external-accounts","2.guides\u002F09.link-external-accounts","i-lucide-link",{"title":81,"path":82,"stem":83,"icon":84},"Require step-up before sensitive actions","\u002Fguides\u002Fstep-up","2.guides\u002F10.step-up","i-lucide-shield-check",{"title":86,"path":87,"stem":88,"icon":89},"Call the API from a browser","\u002Fguides\u002Fbrowser-clients","2.guides\u002F11.browser-clients","i-lucide-globe",{"title":91,"path":92,"stem":93,"icon":94},"Prepare for production","\u002Fguides\u002Fproduction","2.guides\u002F12.production","i-lucide-factory","i-lucide-waypoints",{"title":97,"path":98,"stem":99,"children":100,"icon":113},"Composable endpoints","\u002Fcomposables","3.composables\u002F1.index",[101,104,108],{"title":102,"path":98,"stem":99,"icon":103},"How composition works","i-lucide-layout-grid",{"title":105,"path":106,"stem":107,"icon":39},"Composition requirements","\u002Fcomposables\u002Frequirements","3.composables\u002F2.requirements",{"title":109,"path":110,"stem":111,"icon":112},"Compose a custom auth stack","\u002Fcomposables\u002Frecipes","3.composables\u002F3.recipes","i-lucide-book-marked","i-lucide-blocks",{"title":115,"icon":116,"path":117,"stem":118,"children":119,"page":176},"Reference","i-lucide-book-open","\u002Fmodules","4.modules",[120,125,129,134,139,144,148,153,157,162,166,171],{"title":121,"path":122,"stem":123,"icon":124},"Endpoint reference","\u002Fmodules\u002Fendpoints","4.modules\u002F01.endpoints","i-lucide-route",{"title":126,"path":127,"stem":128,"icon":69},"Identity management module","\u002Fmodules\u002Fidentity-management","4.modules\u002F02.identity-management",{"title":130,"path":131,"stem":132,"icon":133},"Cookie sign-in module","\u002Fmodules\u002Fcookie-auth","4.modules\u002F03.cookie-auth","i-lucide-cookie",{"title":135,"path":136,"stem":137,"icon":138},"Identity bearer sign-in module","\u002Fmodules\u002Fbearer-auth","4.modules\u002F04.bearer-auth","i-lucide-key",{"title":140,"path":141,"stem":142,"icon":143},"JWT module","\u002Fmodules\u002Fjwt","4.modules\u002F05.jwt","i-lucide-fingerprint",{"title":145,"path":146,"stem":147,"icon":74},"Passkeys module","\u002Fmodules\u002Fpasskeys","4.modules\u002F06.passkeys",{"title":149,"path":150,"stem":151,"icon":152},"ReAuth module","\u002Fmodules\u002Freauth","4.modules\u002F07.reauth","i-lucide-shield-alert",{"title":154,"path":155,"stem":156,"icon":49},"External OAuth packages","\u002Fmodules\u002Fexternal-oauth","4.modules\u002F08.external-oauth",{"title":158,"path":159,"stem":160,"icon":161},"Configuration options","\u002Fmodules\u002Fconfiguration","4.modules\u002F09.configuration","i-lucide-settings",{"title":163,"path":164,"stem":165,"icon":84},"Antiforgery (CSRF) rules","\u002Fmodules\u002Fcsrf","4.modules\u002F10.csrf",{"title":167,"path":168,"stem":169,"icon":170},"Responses and errors","\u002Fmodules\u002Ferrors","4.modules\u002F11.errors","i-lucide-circle-alert",{"title":172,"path":173,"stem":174,"icon":175},"Rate-limit policies","\u002Fmodules\u002Frate-limits","4.modules\u002F12.rate-limits","i-lucide-gauge",false,{"title":178,"icon":179,"path":180,"stem":181,"children":182,"page":176},"Concepts","i-lucide-lightbulb","\u002Fconcepts","5.concepts",[183,188,193,198],{"title":184,"path":185,"stem":186,"icon":187},"AuthEndpoints compared with other options","\u002Fconcepts\u002Fcompare","5.concepts\u002F1.compare","i-lucide-git-compare",{"title":189,"path":190,"stem":191,"icon":192},"Stock Identity endpoints vs AuthEndpoints","\u002Fconcepts\u002Fstock-identity-vs-authendpoints","5.concepts\u002F2.stock-identity-vs-authendpoints","i-lucide-columns-2",{"title":194,"path":195,"stem":196,"icon":197},"Security model","\u002Fconcepts\u002Fsecurity-model","5.concepts\u002F3.security-model","i-lucide-shield",{"title":199,"path":200,"stem":201,"icon":202},"FAQ","\u002Fconcepts\u002Ffaq","5.concepts\u002F4.faq","i-lucide-circle-help",{"id":204,"title":109,"body":205,"description":1350,"extension":1351,"links":1352,"meta":1353,"navigation":1354,"path":110,"seo":1355,"stem":111,"__hash__":1356},"docs\u002F3.composables\u002F3.recipes.md",{"type":206,"value":207,"toc":1340},"minimark",[208,213,310,314,323,351,399,403,410,973,977,980,997,1000,1003,1103,1122,1125,1128,1160,1163,1178,1292,1303,1307,1336],[209,210,212],"h2",{"id":211},"recipe-matrix","Recipe matrix",[214,215,216,235],"table",{},[217,218,219],"thead",{},[220,221,222,226,229,232],"tr",{},[223,224,225],"th",{},"Recipe",[223,227,228],{},"Management group",[223,230,231],{},"Sign-in group",[223,233,234],{},"Passkeys",[236,237,238,260,278,297],"tbody",{},[220,239,240,244,250,255],{},[241,242,243],"td",{},"Cookie web client (cookie facade)",[241,245,246],{},[247,248,249],"code",{},"\u002Fidentity",[241,251,252,253],{},"cookie ",[247,254,249],{},[241,256,257],{},[247,258,259],{},"\u002Faccount",[220,261,262,265,269,274],{},[241,263,264],{},"Identity bearer (bearer facade)",[241,266,267],{},[247,268,249],{},[241,270,271,272],{},"bearer ",[247,273,249],{},[241,275,276],{},[247,277,259],{},[220,279,280,283,288,294],{},[241,281,282],{},"JWT-only",[241,284,285,286],{},"e.g. ",[247,287,259],{},[241,289,290,291],{},"JWT ",[247,292,293],{},"\u002Fauth",[241,295,296],{},"optional",[220,298,299,302,305,308],{},[241,300,301],{},"Custom paths",[241,303,304],{},"any prefix",[241,306,307],{},"matching DI",[241,309,304],{},[209,311,313],{"id":312},"which-recipe-for-which-client","Which recipe for which client?",[315,316,317,318,322],"p",{},"See ",[319,320,23],"a",{"href":321},"\u002Fgetting-started\u002Fchoose-a-sign-in-stack\u002F",". In short: cookie for browser apps, JWT for browser apps that need a bearer token, and Identity bearer for native apps.",[315,324,325,326,330,331,334,335,338,339,342,343,346,347,350],{},"Passkeys are WebAuthn-oriented (browsers and platform passkey APIs). With the default Identity completer, register\u002Flogin issue an ",[327,328,329],"strong",{},"Identity bearer"," token, or an application cookie when ",[247,332,333],{},"?useCookies=true"," \u002F ",[247,336,337],{},"?useSessionCookies=true",". For Simple JWT after passkey, register ",[247,340,341],{},"JwtPasskeySignInCompleter"," (see ",[319,344,234],{"href":345},"\u002Fmodules\u002Fpasskeys\u002F#simple-jwt",") — do not call password JWT ",[247,348,349],{},"\u002Fcreate"," after a successful passkey.",[352,353,356],"callout",{"color":354,"icon":355},"warning","i-lucide-triangle-alert",[315,357,358,361,362,365,366,369,370,373,374,377,378,381,382,385,386,389,390,393,394,398],{},[247,359,360],{},"POST \u002Fidentity\u002Flogin?useCookies=true"," does ",[327,363,364],{},"nothing"," under the cookie facade. Cookie facade password login maps ",[247,367,368],{},"LoginCookie",", which ignores ",[247,371,372],{},"useCookies",". That query only affects bearer ",[247,375,376],{},"Login"," (",[247,379,380],{},"MapAuthEndpoints"," with ",[247,383,384],{},"SignIn = IdentityBearer",", or ",[247,387,388],{},"MapBearerAuthEndpoints",") and the default passkey completer. Persistent cookie on cookie-facade password login: ",[247,391,392],{},"?useSessionCookies=false",". See ",[319,395,397],{"href":396},"\u002Fmodules\u002Fcookie-auth\u002F","Cookie auth",".",[209,400,402],{"id":401},"advanced-composition","Advanced composition",[315,404,405,406,409],{},"Compose modules yourself when you need custom paths or JWT-only. Map management ",[327,407,408],{},"once"," in production hosts.",[411,412,417],"pre",{"className":413,"code":414,"language":415,"meta":416,"style":416},"language-cs shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","builder.Services\n    .AddIdentityApiEndpoints\u003CAppUser>(o =>\n    {\n        o.Stores.SchemaVersion = IdentitySchemaVersions.Version3;\n    })\n    .AddEntityFrameworkStores\u003CAppDbContext>()\n    .AddDefaultTokenProviders();\n\nbuilder.Services.AddAntiforgery();\nbuilder.Services.AddCookieAuthEndpoints(); \u002F\u002F rate limits + ReAuth schemes\nbuilder.Services.AddPasskeyEndpoints\u003CAppUser>();\nbuilder.Services.AddJwtEndpoints\u003CAppUser, AppDbContext>(o =>\n{\n    o.Issuer = \"https:\u002F\u002Fexample.com\";\n    o.Audience = \"https:\u002F\u002Fexample.com\";\n    o.SigningOptions.SymmetricKey = builder.Configuration[\"Jwt:SymmetricKey\"];\n});\n\u002F\u002F Optional: Simple JWT after passkey register\u002Flogin\n\u002F\u002F builder.Services.AddPasskeySignInCompleter\u003CAppUser, JwtPasskeySignInCompleter\u003CAppUser>>();\n\n\u002F\u002F In AppDbContext.OnModelCreating:\n\u002F\u002F   builder.UseRefreshToken();\n\nvar app = builder.Build();\napp.UseAuthentication();\napp.UseAuthorization();\napp.UseRateLimiter();\napp.UseAntiforgery();\n\n\u002F\u002F Cookie web client\napp.MapGroup(\"\u002Fidentity\").MapIdentityManagementApi\u003CAppUser>();\napp.MapGroup(\"\u002Fidentity\").MapCookieAuthEndpoints\u003CAppUser>();\n\n\u002F\u002F Or Identity bearer\n\u002F\u002F app.MapGroup(\"\u002Fidentity\").MapIdentityManagementApi\u003CAppUser>();\n\u002F\u002F app.MapGroup(\"\u002Fidentity\").MapBearerAuthEndpoints\u003CAppUser>();\n\n\u002F\u002F Or JWT-only (no cookie login)\n\u002F\u002F app.MapGroup(\"\u002Faccount\").MapIdentityManagementApi\u003CAppUser>();\n\u002F\u002F app.MapGroup(\"\u002Fauth\").MapJwtAuthEndpoints\u003CAppUser>();\n\napp.MapGroup(\"\u002Faccount\").MapPasskeyEndpoints\u003CAppUser>();\n","cs","",[247,418,419,434,460,466,496,502,518,529,536,553,574,595,625,631,656,676,714,720,726,732,737,743,749,754,775,788,800,812,824,829,835,866,894,899,905,911,917,922,928,934,940,945],{"__ignoreMap":416},[420,421,424,428,431],"span",{"class":422,"line":423},"line",1,[420,425,427],{"class":426},"sTEyZ","builder",[420,429,398],{"class":430},"sMK4o",[420,432,433],{"class":426},"Services\n",[420,435,437,440,444,447,451,454,457],{"class":422,"line":436},2,[420,438,439],{"class":430},"    .",[420,441,443],{"class":442},"s2Zo4","AddIdentityApiEndpoints",[420,445,446],{"class":430},"\u003C",[420,448,450],{"class":449},"sBMFI","AppUser",[420,452,453],{"class":430},">(",[420,455,456],{"class":449},"o",[420,458,459],{"class":430}," =>\n",[420,461,463],{"class":422,"line":462},3,[420,464,465],{"class":430},"    {\n",[420,467,469,472,474,477,479,482,485,488,490,493],{"class":422,"line":468},4,[420,470,471],{"class":426},"        o",[420,473,398],{"class":430},[420,475,476],{"class":426},"Stores",[420,478,398],{"class":430},[420,480,481],{"class":426},"SchemaVersion ",[420,483,484],{"class":430},"=",[420,486,487],{"class":426}," IdentitySchemaVersions",[420,489,398],{"class":430},[420,491,492],{"class":426},"Version3",[420,494,495],{"class":430},";\n",[420,497,499],{"class":422,"line":498},5,[420,500,501],{"class":430},"    })\n",[420,503,505,507,510,512,515],{"class":422,"line":504},6,[420,506,439],{"class":430},[420,508,509],{"class":442},"AddEntityFrameworkStores",[420,511,446],{"class":430},[420,513,514],{"class":449},"AppDbContext",[420,516,517],{"class":430},">()\n",[420,519,521,523,526],{"class":422,"line":520},7,[420,522,439],{"class":430},[420,524,525],{"class":442},"AddDefaultTokenProviders",[420,527,528],{"class":430},"();\n",[420,530,532],{"class":422,"line":531},8,[420,533,535],{"emptyLinePlaceholder":534},true,"\n",[420,537,539,541,543,546,548,551],{"class":422,"line":538},9,[420,540,427],{"class":426},[420,542,398],{"class":430},[420,544,545],{"class":426},"Services",[420,547,398],{"class":430},[420,549,550],{"class":442},"AddAntiforgery",[420,552,528],{"class":430},[420,554,556,558,560,562,564,567,570],{"class":422,"line":555},10,[420,557,427],{"class":426},[420,559,398],{"class":430},[420,561,545],{"class":426},[420,563,398],{"class":430},[420,565,566],{"class":442},"AddCookieAuthEndpoints",[420,568,569],{"class":430},"();",[420,571,573],{"class":572},"sHwdD"," \u002F\u002F rate limits + ReAuth schemes\n",[420,575,577,579,581,583,585,588,590,592],{"class":422,"line":576},11,[420,578,427],{"class":426},[420,580,398],{"class":430},[420,582,545],{"class":426},[420,584,398],{"class":430},[420,586,587],{"class":442},"AddPasskeyEndpoints",[420,589,446],{"class":430},[420,591,450],{"class":449},[420,593,594],{"class":430},">();\n",[420,596,598,600,602,604,606,609,611,613,616,619,621,623],{"class":422,"line":597},12,[420,599,427],{"class":426},[420,601,398],{"class":430},[420,603,545],{"class":426},[420,605,398],{"class":430},[420,607,608],{"class":442},"AddJwtEndpoints",[420,610,446],{"class":430},[420,612,450],{"class":449},[420,614,615],{"class":430},",",[420,617,618],{"class":449}," AppDbContext",[420,620,453],{"class":430},[420,622,456],{"class":449},[420,624,459],{"class":430},[420,626,628],{"class":422,"line":627},13,[420,629,630],{"class":430},"{\n",[420,632,634,637,639,642,644,647,651,654],{"class":422,"line":633},14,[420,635,636],{"class":426},"    o",[420,638,398],{"class":430},[420,640,641],{"class":426},"Issuer ",[420,643,484],{"class":430},[420,645,646],{"class":430}," \"",[420,648,650],{"class":649},"sfazB","https:\u002F\u002Fexample.com",[420,652,653],{"class":430},"\"",[420,655,495],{"class":430},[420,657,659,661,663,666,668,670,672,674],{"class":422,"line":658},15,[420,660,636],{"class":426},[420,662,398],{"class":430},[420,664,665],{"class":426},"Audience ",[420,667,484],{"class":430},[420,669,646],{"class":430},[420,671,650],{"class":649},[420,673,653],{"class":430},[420,675,495],{"class":430},[420,677,679,681,683,686,688,691,693,696,698,701,704,706,709,711],{"class":422,"line":678},16,[420,680,636],{"class":426},[420,682,398],{"class":430},[420,684,685],{"class":426},"SigningOptions",[420,687,398],{"class":430},[420,689,690],{"class":426},"SymmetricKey ",[420,692,484],{"class":430},[420,694,695],{"class":426}," builder",[420,697,398],{"class":430},[420,699,700],{"class":426},"Configuration",[420,702,703],{"class":430},"[",[420,705,653],{"class":430},[420,707,708],{"class":649},"Jwt:SymmetricKey",[420,710,653],{"class":430},[420,712,713],{"class":430},"];\n",[420,715,717],{"class":422,"line":716},17,[420,718,719],{"class":430},"});\n",[420,721,723],{"class":422,"line":722},18,[420,724,725],{"class":572},"\u002F\u002F Optional: Simple JWT after passkey register\u002Flogin\n",[420,727,729],{"class":422,"line":728},19,[420,730,731],{"class":572},"\u002F\u002F builder.Services.AddPasskeySignInCompleter\u003CAppUser, JwtPasskeySignInCompleter\u003CAppUser>>();\n",[420,733,735],{"class":422,"line":734},20,[420,736,535],{"emptyLinePlaceholder":534},[420,738,740],{"class":422,"line":739},21,[420,741,742],{"class":572},"\u002F\u002F In AppDbContext.OnModelCreating:\n",[420,744,746],{"class":422,"line":745},22,[420,747,748],{"class":572},"\u002F\u002F   builder.UseRefreshToken();\n",[420,750,752],{"class":422,"line":751},23,[420,753,535],{"emptyLinePlaceholder":534},[420,755,757,760,763,766,768,770,773],{"class":422,"line":756},24,[420,758,759],{"class":449},"var",[420,761,762],{"class":449}," app",[420,764,765],{"class":430}," =",[420,767,695],{"class":426},[420,769,398],{"class":430},[420,771,772],{"class":442},"Build",[420,774,528],{"class":430},[420,776,778,781,783,786],{"class":422,"line":777},25,[420,779,780],{"class":426},"app",[420,782,398],{"class":430},[420,784,785],{"class":442},"UseAuthentication",[420,787,528],{"class":430},[420,789,791,793,795,798],{"class":422,"line":790},26,[420,792,780],{"class":426},[420,794,398],{"class":430},[420,796,797],{"class":442},"UseAuthorization",[420,799,528],{"class":430},[420,801,803,805,807,810],{"class":422,"line":802},27,[420,804,780],{"class":426},[420,806,398],{"class":430},[420,808,809],{"class":442},"UseRateLimiter",[420,811,528],{"class":430},[420,813,815,817,819,822],{"class":422,"line":814},28,[420,816,780],{"class":426},[420,818,398],{"class":430},[420,820,821],{"class":442},"UseAntiforgery",[420,823,528],{"class":430},[420,825,827],{"class":422,"line":826},29,[420,828,535],{"emptyLinePlaceholder":534},[420,830,832],{"class":422,"line":831},30,[420,833,834],{"class":572},"\u002F\u002F Cookie web client\n",[420,836,838,840,842,845,848,850,852,854,857,860,862,864],{"class":422,"line":837},31,[420,839,780],{"class":426},[420,841,398],{"class":430},[420,843,844],{"class":442},"MapGroup",[420,846,847],{"class":430},"(",[420,849,653],{"class":430},[420,851,249],{"class":649},[420,853,653],{"class":430},[420,855,856],{"class":430},").",[420,858,859],{"class":442},"MapIdentityManagementApi",[420,861,446],{"class":430},[420,863,450],{"class":449},[420,865,594],{"class":430},[420,867,869,871,873,875,877,879,881,883,885,888,890,892],{"class":422,"line":868},32,[420,870,780],{"class":426},[420,872,398],{"class":430},[420,874,844],{"class":442},[420,876,847],{"class":430},[420,878,653],{"class":430},[420,880,249],{"class":649},[420,882,653],{"class":430},[420,884,856],{"class":430},[420,886,887],{"class":442},"MapCookieAuthEndpoints",[420,889,446],{"class":430},[420,891,450],{"class":449},[420,893,594],{"class":430},[420,895,897],{"class":422,"line":896},33,[420,898,535],{"emptyLinePlaceholder":534},[420,900,902],{"class":422,"line":901},34,[420,903,904],{"class":572},"\u002F\u002F Or Identity bearer\n",[420,906,908],{"class":422,"line":907},35,[420,909,910],{"class":572},"\u002F\u002F app.MapGroup(\"\u002Fidentity\").MapIdentityManagementApi\u003CAppUser>();\n",[420,912,914],{"class":422,"line":913},36,[420,915,916],{"class":572},"\u002F\u002F app.MapGroup(\"\u002Fidentity\").MapBearerAuthEndpoints\u003CAppUser>();\n",[420,918,920],{"class":422,"line":919},37,[420,921,535],{"emptyLinePlaceholder":534},[420,923,925],{"class":422,"line":924},38,[420,926,927],{"class":572},"\u002F\u002F Or JWT-only (no cookie login)\n",[420,929,931],{"class":422,"line":930},39,[420,932,933],{"class":572},"\u002F\u002F app.MapGroup(\"\u002Faccount\").MapIdentityManagementApi\u003CAppUser>();\n",[420,935,937],{"class":422,"line":936},40,[420,938,939],{"class":572},"\u002F\u002F app.MapGroup(\"\u002Fauth\").MapJwtAuthEndpoints\u003CAppUser>();\n",[420,941,943],{"class":422,"line":942},41,[420,944,535],{"emptyLinePlaceholder":534},[420,946,948,950,952,954,956,958,960,962,964,967,969,971],{"class":422,"line":947},42,[420,949,780],{"class":426},[420,951,398],{"class":430},[420,953,844],{"class":442},[420,955,847],{"class":430},[420,957,653],{"class":430},[420,959,259],{"class":649},[420,961,653],{"class":430},[420,963,856],{"class":430},[420,965,966],{"class":442},"MapPasskeyEndpoints",[420,968,446],{"class":430},[420,970,450],{"class":449},[420,972,594],{"class":430},[209,974,976],{"id":975},"cookie-web-client","Cookie web client",[315,978,979],{},"Best default for a first-party web app on the same site (or carefully configured CORS + credentials).",[981,982,983,989,994],"ul",{},[984,985,986,987],"li",{},"Management + cookie on ",[247,988,249],{},[984,990,991,992],{},"Passkeys on ",[247,993,259],{},[984,995,996],{},"Client uses credentials + CSRF token",[209,998,329],{"id":999},"identity-bearer",[315,1001,1002],{},"Best default for native and mobile clients. Use the bearer facade when the client stores Identity bearer tokens (ASP.NET Core Identity API token format) instead of cookies.",[411,1004,1006],{"className":413,"code":1005,"language":415,"meta":416,"style":416},"builder.Services.AddAuthEndpoints\u003CAppUser, AppDbContext>(AuthEndpointsSignIn.IdentityBearer, o =>\n{\n    o.Passkeys.ServerDomain = \"example.com\";\n});\napp.UseAuthEndpoints();\napp.MapAuthEndpoints\u003CAppUser>();\n",[247,1007,1008,1046,1050,1074,1078,1089],{"__ignoreMap":416},[420,1009,1010,1012,1014,1016,1018,1021,1023,1025,1027,1029,1031,1034,1036,1039,1041,1044],{"class":422,"line":423},[420,1011,427],{"class":426},[420,1013,398],{"class":430},[420,1015,545],{"class":426},[420,1017,398],{"class":430},[420,1019,1020],{"class":442},"AddAuthEndpoints",[420,1022,446],{"class":430},[420,1024,450],{"class":449},[420,1026,615],{"class":430},[420,1028,618],{"class":449},[420,1030,453],{"class":430},[420,1032,1033],{"class":426},"AuthEndpointsSignIn",[420,1035,398],{"class":430},[420,1037,1038],{"class":426},"IdentityBearer",[420,1040,615],{"class":430},[420,1042,1043],{"class":449}," o",[420,1045,459],{"class":430},[420,1047,1048],{"class":422,"line":436},[420,1049,630],{"class":430},[420,1051,1052,1054,1056,1058,1060,1063,1065,1067,1070,1072],{"class":422,"line":462},[420,1053,636],{"class":426},[420,1055,398],{"class":430},[420,1057,234],{"class":426},[420,1059,398],{"class":430},[420,1061,1062],{"class":426},"ServerDomain ",[420,1064,484],{"class":430},[420,1066,646],{"class":430},[420,1068,1069],{"class":649},"example.com",[420,1071,653],{"class":430},[420,1073,495],{"class":430},[420,1075,1076],{"class":422,"line":468},[420,1077,719],{"class":430},[420,1079,1080,1082,1084,1087],{"class":422,"line":498},[420,1081,780],{"class":426},[420,1083,398],{"class":430},[420,1085,1086],{"class":442},"UseAuthEndpoints",[420,1088,528],{"class":430},[420,1090,1091,1093,1095,1097,1099,1101],{"class":422,"line":504},[420,1092,780],{"class":426},[420,1094,398],{"class":430},[420,1096,380],{"class":442},[420,1098,446],{"class":430},[420,1100,450],{"class":449},[420,1102,594],{"class":430},[981,1104,1105,1111,1119],{},[984,1106,1107,1108,1110],{},"Maps ",[247,1109,388],{}," instead of cookie",[984,1112,1113,1114,1118],{},"CSRF is skipped for bearer-authenticated unsafe methods (see ",[319,1115,1117],{"href":1116},"\u002Fcomposables\u002Frequirements\u002F","Requirements",")",[984,1120,1121],{},"Compose the same modules by hand if you need a custom prefix",[209,1123,282],{"id":1124},"jwt-only",[315,1126,1127],{},"Best for browser clients that want a Bearer access token with an HttpOnly refresh cookie (not a pure token refresh flow for native apps).",[981,1129,1130,1135,1144,1151],{},[984,1131,1132,1133,1118],{},"Management on one prefix (e.g. ",[247,1134,259],{},[984,1136,1137,1140,1141,1143],{},[247,1138,1139],{},"MapJwtAuthEndpoints"," on ",[247,1142,293],{}," (or your choice)",[984,1145,1146,1147,1150],{},"Still call ",[247,1148,1149],{},"UseRefreshToken()"," and migrate",[984,1152,1153,1154,1156,1157,1159],{},"For passwordless + Simple JWT, register ",[247,1155,341],{}," (not password ",[247,1158,349],{}," after passkey)",[209,1161,301],{"id":1162},"custom-paths",[315,1164,1165,1166,1169,1170,1173,1174,1177],{},"Prefixes are arbitrary as long as DI and middleware match. Set facade ",[247,1167,1168],{},"IdentityPath",", ",[247,1171,1172],{},"PasskeyPath",", and ",[247,1175,1176],{},"Jwt.Path",":",[411,1179,1181],{"className":413,"code":1180,"language":415,"meta":416,"style":416},"builder.Services.AddAuthEndpoints\u003CAppUser, AppDbContext>(o =>\n{\n    o.IdentityPath = \"\u002Fauth\u002Fcookie\";  \u002F\u002F management + cookie login\n    o.PasskeyPath = \"\u002Fauth\u002Fpasskey\";  \u002F\u002F maps \u002Fauth\u002Fpasskey\u002Fpasskeys\n    o.Jwt.Path = \"\u002Fauth\u002Fjwt\";         \u002F\u002F used when o.Jwt.Enabled = true\n});\n",[247,1182,1183,1209,1213,1237,1260,1288],{"__ignoreMap":416},[420,1184,1185,1187,1189,1191,1193,1195,1197,1199,1201,1203,1205,1207],{"class":422,"line":423},[420,1186,427],{"class":426},[420,1188,398],{"class":430},[420,1190,545],{"class":426},[420,1192,398],{"class":430},[420,1194,1020],{"class":442},[420,1196,446],{"class":430},[420,1198,450],{"class":449},[420,1200,615],{"class":430},[420,1202,618],{"class":449},[420,1204,453],{"class":430},[420,1206,456],{"class":449},[420,1208,459],{"class":430},[420,1210,1211],{"class":422,"line":436},[420,1212,630],{"class":430},[420,1214,1215,1217,1219,1222,1224,1226,1229,1231,1234],{"class":422,"line":462},[420,1216,636],{"class":426},[420,1218,398],{"class":430},[420,1220,1221],{"class":426},"IdentityPath ",[420,1223,484],{"class":430},[420,1225,646],{"class":430},[420,1227,1228],{"class":649},"\u002Fauth\u002Fcookie",[420,1230,653],{"class":430},[420,1232,1233],{"class":430},";",[420,1235,1236],{"class":572},"  \u002F\u002F management + cookie login\n",[420,1238,1239,1241,1243,1246,1248,1250,1253,1255,1257],{"class":422,"line":468},[420,1240,636],{"class":426},[420,1242,398],{"class":430},[420,1244,1245],{"class":426},"PasskeyPath ",[420,1247,484],{"class":430},[420,1249,646],{"class":430},[420,1251,1252],{"class":649},"\u002Fauth\u002Fpasskey",[420,1254,653],{"class":430},[420,1256,1233],{"class":430},[420,1258,1259],{"class":572},"  \u002F\u002F maps \u002Fauth\u002Fpasskey\u002Fpasskeys\n",[420,1261,1262,1264,1266,1269,1271,1274,1276,1278,1281,1283,1285],{"class":422,"line":498},[420,1263,636],{"class":426},[420,1265,398],{"class":430},[420,1267,1268],{"class":426},"Jwt",[420,1270,398],{"class":430},[420,1272,1273],{"class":426},"Path ",[420,1275,484],{"class":430},[420,1277,646],{"class":430},[420,1279,1280],{"class":649},"\u002Fauth\u002Fjwt",[420,1282,653],{"class":430},[420,1284,1233],{"class":430},[420,1286,1287],{"class":572},"         \u002F\u002F used when o.Jwt.Enabled = true\n",[420,1289,1290],{"class":422,"line":504},[420,1291,719],{"class":430},[315,1293,1294,1295,1298,1299,1302],{},"For compose hosts, use ",[247,1296,1297],{},"MapGroup(\"\u002Fyour-prefix\")"," with the matching ",[247,1300,1301],{},"Map*"," methods.",[209,1304,1306],{"id":1305},"related-modules","Related modules",[981,1308,1309,1315,1319,1325,1331],{},[984,1310,1311],{},[319,1312,1314],{"href":1313},"\u002Fmodules\u002Fidentity-management\u002F","Identity management",[984,1316,1317],{},[319,1318,397],{"href":396},[984,1320,1321],{},[319,1322,1324],{"href":1323},"\u002Fmodules\u002Fbearer-auth\u002F","Bearer auth",[984,1326,1327],{},[319,1328,1330],{"href":1329},"\u002Fmodules\u002Fjwt\u002F","JWT",[984,1332,1333],{},[319,1334,234],{"href":1335},"\u002Fmodules\u002Fpasskeys\u002F",[1337,1338,1339],"style",{},"html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":416,"searchDepth":423,"depth":436,"links":1341},[1342,1343,1344,1345,1346,1347,1348,1349],{"id":211,"depth":436,"text":212},{"id":312,"depth":436,"text":313},{"id":401,"depth":436,"text":402},{"id":975,"depth":436,"text":976},{"id":999,"depth":436,"text":329},{"id":1124,"depth":436,"text":282},{"id":1162,"depth":436,"text":301},{"id":1305,"depth":436,"text":1306},"Common composition patterns for cookie web clients, Identity bearer, JWT-only, and custom paths.","md",null,{},{"icon":112},{"title":109,"description":1350},"IOum6ETydJWLzlJ26z7KrOb_oEnOu2nNImEhzq-UG0I",[1358,1360],{"title":105,"path":106,"stem":107,"description":1359,"icon":39,"children":-1},"Hard prerequisites for composing AuthEndpoints modules correctly.",{"title":121,"path":122,"stem":123,"description":1361,"icon":124,"children":-1},"Every route that AuthEndpoints maps, with its auth, CSRF, ReAuth, and rate-limit requirements.",1791123627775]