[{"data":1,"prerenderedAt":1415},["ShallowReactive",2],{"navigation":3,"\u002Fconcepts\u002Fstock-identity-vs-authendpoints":203,"\u002Fconcepts\u002Fstock-identity-vs-authendpoints-surround":1410},[4,33,96,114,177],{"title":5,"path":6,"stem":7,"children":8,"icon":32},"Get started","\u002Fgetting-started","1.getting-started\u002F1.index",[9,12,17,22,27],{"title":10,"path":6,"stem":7,"icon":11},"Introduction","i-lucide-house",{"title":13,"path":14,"stem":15,"icon":16},"Install AuthEndpoints","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F2.installation","i-lucide-download",{"title":18,"path":19,"stem":20,"icon":21},"Quick start","\u002Fgetting-started\u002Fquick-start","1.getting-started\u002F3.quick-start","i-lucide-play",{"title":23,"path":24,"stem":25,"icon":26},"Choose a sign-in stack","\u002Fgetting-started\u002Fchoose-a-sign-in-stack","1.getting-started\u002F4.choose-a-sign-in-stack","i-lucide-signpost",{"title":28,"path":29,"stem":30,"icon":31},"Use the AuthEndpoints skill with coding agents","\u002Fgetting-started\u002Fai-agents","1.getting-started\u002F5.ai-agents","i-lucide-bot","i-lucide-rocket",{"title":34,"path":35,"stem":36,"children":37,"icon":95},"Guides","\u002Fguides","2.guides\u002F01.index",[38,40,45,50,55,60,65,70,75,80,85,90],{"title":34,"path":35,"stem":36,"icon":39},"i-lucide-list-checks",{"title":41,"path":42,"stem":43,"icon":44},"Register users","\u002Fguides\u002Fregistration","2.guides\u002F02.registration","i-lucide-user-plus",{"title":46,"path":47,"stem":48,"icon":49},"Sign users in","\u002Fguides\u002Fsign-in","2.guides\u002F03.sign-in","i-lucide-log-in",{"title":51,"path":52,"stem":53,"icon":54},"Sign users out","\u002Fguides\u002Fsign-out","2.guides\u002F04.sign-out","i-lucide-log-out",{"title":56,"path":57,"stem":58,"icon":59},"Turn on two-factor authentication","\u002Fguides\u002Ftwo-factor","2.guides\u002F05.two-factor","i-lucide-smartphone",{"title":61,"path":62,"stem":63,"icon":64},"Reset a forgotten password","\u002Fguides\u002Freset-password","2.guides\u002F06.reset-password","i-lucide-key-round",{"title":66,"path":67,"stem":68,"icon":69},"Change a user's email or password","\u002Fguides\u002Fmanage-account","2.guides\u002F07.manage-account","i-lucide-user-cog",{"title":71,"path":72,"stem":73,"icon":74},"Add, rename, and remove passkeys","\u002Fguides\u002Fmanage-passkeys","2.guides\u002F08.manage-passkeys","i-lucide-scan-face",{"title":76,"path":77,"stem":78,"icon":79},"Link and unlink GitHub or Google accounts","\u002Fguides\u002Flink-external-accounts","2.guides\u002F09.link-external-accounts","i-lucide-link",{"title":81,"path":82,"stem":83,"icon":84},"Require step-up before sensitive actions","\u002Fguides\u002Fstep-up","2.guides\u002F10.step-up","i-lucide-shield-check",{"title":86,"path":87,"stem":88,"icon":89},"Call the API from a browser","\u002Fguides\u002Fbrowser-clients","2.guides\u002F11.browser-clients","i-lucide-globe",{"title":91,"path":92,"stem":93,"icon":94},"Prepare for production","\u002Fguides\u002Fproduction","2.guides\u002F12.production","i-lucide-factory","i-lucide-waypoints",{"title":97,"path":98,"stem":99,"children":100,"icon":113},"Composable endpoints","\u002Fcomposables","3.composables\u002F1.index",[101,104,108],{"title":102,"path":98,"stem":99,"icon":103},"How composition works","i-lucide-layout-grid",{"title":105,"path":106,"stem":107,"icon":39},"Composition requirements","\u002Fcomposables\u002Frequirements","3.composables\u002F2.requirements",{"title":109,"path":110,"stem":111,"icon":112},"Compose a custom auth stack","\u002Fcomposables\u002Frecipes","3.composables\u002F3.recipes","i-lucide-book-marked","i-lucide-blocks",{"title":115,"icon":116,"path":117,"stem":118,"children":119,"page":176},"Reference","i-lucide-book-open","\u002Fmodules","4.modules",[120,125,129,134,139,144,148,153,157,162,166,171],{"title":121,"path":122,"stem":123,"icon":124},"Endpoint reference","\u002Fmodules\u002Fendpoints","4.modules\u002F01.endpoints","i-lucide-route",{"title":126,"path":127,"stem":128,"icon":69},"Identity management module","\u002Fmodules\u002Fidentity-management","4.modules\u002F02.identity-management",{"title":130,"path":131,"stem":132,"icon":133},"Cookie sign-in module","\u002Fmodules\u002Fcookie-auth","4.modules\u002F03.cookie-auth","i-lucide-cookie",{"title":135,"path":136,"stem":137,"icon":138},"Identity bearer sign-in module","\u002Fmodules\u002Fbearer-auth","4.modules\u002F04.bearer-auth","i-lucide-key",{"title":140,"path":141,"stem":142,"icon":143},"JWT module","\u002Fmodules\u002Fjwt","4.modules\u002F05.jwt","i-lucide-fingerprint",{"title":145,"path":146,"stem":147,"icon":74},"Passkeys module","\u002Fmodules\u002Fpasskeys","4.modules\u002F06.passkeys",{"title":149,"path":150,"stem":151,"icon":152},"ReAuth module","\u002Fmodules\u002Freauth","4.modules\u002F07.reauth","i-lucide-shield-alert",{"title":154,"path":155,"stem":156,"icon":49},"External OAuth packages","\u002Fmodules\u002Fexternal-oauth","4.modules\u002F08.external-oauth",{"title":158,"path":159,"stem":160,"icon":161},"Configuration options","\u002Fmodules\u002Fconfiguration","4.modules\u002F09.configuration","i-lucide-settings",{"title":163,"path":164,"stem":165,"icon":84},"Antiforgery (CSRF) rules","\u002Fmodules\u002Fcsrf","4.modules\u002F10.csrf",{"title":167,"path":168,"stem":169,"icon":170},"Responses and errors","\u002Fmodules\u002Ferrors","4.modules\u002F11.errors","i-lucide-circle-alert",{"title":172,"path":173,"stem":174,"icon":175},"Rate-limit policies","\u002Fmodules\u002Frate-limits","4.modules\u002F12.rate-limits","i-lucide-gauge",false,{"title":178,"icon":179,"path":180,"stem":181,"children":182,"page":176},"Concepts","i-lucide-lightbulb","\u002Fconcepts","5.concepts",[183,188,193,198],{"title":184,"path":185,"stem":186,"icon":187},"AuthEndpoints compared with other options","\u002Fconcepts\u002Fcompare","5.concepts\u002F1.compare","i-lucide-git-compare",{"title":189,"path":190,"stem":191,"icon":192},"Stock Identity endpoints vs AuthEndpoints","\u002Fconcepts\u002Fstock-identity-vs-authendpoints","5.concepts\u002F2.stock-identity-vs-authendpoints","i-lucide-columns-2",{"title":194,"path":195,"stem":196,"icon":197},"Security model","\u002Fconcepts\u002Fsecurity-model","5.concepts\u002F3.security-model","i-lucide-shield",{"title":199,"path":200,"stem":201,"icon":202},"FAQ","\u002Fconcepts\u002Ffaq","5.concepts\u002F4.faq","i-lucide-circle-help",{"id":204,"title":189,"body":205,"description":1403,"extension":1404,"links":1405,"meta":1406,"navigation":1407,"path":190,"seo":1408,"stem":191,"__hash__":1409},"docs\u002F5.concepts\u002F2.stock-identity-vs-authendpoints.md",{"type":206,"value":207,"toc":1390},"minimark",[208,240,260,281,301,313,318,326,459,462,466,646,656,681,685,851,857,861,1020,1036,1040,1158,1164,1168,1324,1333,1337,1354,1358,1386],[209,210,211,212,216,217,221,222,225,226,229,230,221,233,221,236,239],"p",{},"Both stacks sit on ASP.NET Core Identity and your EF user store. ",[213,214,215],"strong",{},"Stock"," here means Microsoft's Identity API endpoints (",[218,219,220],"code",{},"AddIdentityApiEndpoints"," \u002F ",[218,223,224],{},"MapIdentityApi",") or the same routes written by hand. ",[213,227,228],{},"AuthEndpoints"," means the cookie facade: ",[218,231,232],{},"AddAuthEndpoints",[218,234,235],{},"UseAuthEndpoints",[218,237,238],{},"MapAuthEndpoints",".",[209,241,242,243,246,247,246,250,246,253,246,256,259],{},"Request bodies stay Identity-shaped (",[218,244,245],{},"RegisterRequest",", ",[218,248,249],{},"LoginRequest",[218,251,252],{},"ForgotPasswordRequest",[218,254,255],{},"ResetPasswordRequest",[218,257,258],{},"TwoFactorRequest","). AuthEndpoints maps the routes and adds cookie login, CSRF where required, rate limits, and ReAuth. It does not invent alternate DTOs.",[209,261,262,263,266,267,270,271,273,274,277,278,239],{},"AuthEndpoints tables use the facade default prefix ",[218,264,265],{},"\u002Fidentity"," (",[218,268,269],{},"IdentityPath","). Stock ",[218,272,224],{}," has ",[213,275,276],{},"no"," built-in prefix unless the host wraps it in ",[218,279,280],{},"MapGroup",[209,282,283,284,287,288,291,292,246,295,270,298,300],{},"AuthEndpoints-only on this surface: ",[218,285,286],{},"GET \u002Fidentity\u002FcsrfToken",", cookie ",[218,289,290],{},"POST \u002Fidentity\u002Flogout",", and ReAuth (",[218,293,294],{},"\u002Fmanage\u002FauthMethods",[218,296,297],{},"\u002FconfirmIdentity",[218,299,224],{}," does not map logout.",[209,302,303,304,308,309,239],{},"Client steps for these flows: ",[305,306,34],"a",{"href":307},"\u002Fguides\u002F",". Product positioning against OpenIddict: ",[305,310,312],{"href":311},"\u002Fconcepts\u002Fcompare\u002F","Compare",[314,315,317],"h2",{"id":316},"host-setup","Host setup",[319,320,322,323,325],"h3",{"id":321},"stock-mapidentityapi","Stock (",[218,324,224],{},")",[327,328,333],"pre",{"className":329,"code":330,"language":331,"meta":332,"style":332},"language-cs shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","builder.Services\n    .AddIdentityApiEndpoints\u003CAppUser>()\n    .AddEntityFrameworkStores\u003CAppDbContext>();\n\nvar app = builder.Build();\n\n\u002F\u002F Optional prefix — without MapGroup, routes are at the app root (\u002Fregister, \u002Flogin, …).\napp.MapGroup(\"\u002Fidentity\").MapIdentityApi\u003CAppUser>();\n","cs","",[218,334,335,350,369,385,392,415,420,427],{"__ignoreMap":332},[336,337,340,344,347],"span",{"class":338,"line":339},"line",1,[336,341,343],{"class":342},"sTEyZ","builder",[336,345,239],{"class":346},"sMK4o",[336,348,349],{"class":342},"Services\n",[336,351,353,356,359,362,366],{"class":338,"line":352},2,[336,354,355],{"class":346},"    .",[336,357,220],{"class":358},"s2Zo4",[336,360,361],{"class":346},"\u003C",[336,363,365],{"class":364},"sBMFI","AppUser",[336,367,368],{"class":346},">()\n",[336,370,372,374,377,379,382],{"class":338,"line":371},3,[336,373,355],{"class":346},[336,375,376],{"class":358},"AddEntityFrameworkStores",[336,378,361],{"class":346},[336,380,381],{"class":364},"AppDbContext",[336,383,384],{"class":346},">();\n",[336,386,388],{"class":338,"line":387},4,[336,389,391],{"emptyLinePlaceholder":390},true,"\n",[336,393,395,398,401,404,407,409,412],{"class":338,"line":394},5,[336,396,397],{"class":364},"var",[336,399,400],{"class":364}," app",[336,402,403],{"class":346}," =",[336,405,406],{"class":342}," builder",[336,408,239],{"class":346},[336,410,411],{"class":358},"Build",[336,413,414],{"class":346},"();\n",[336,416,418],{"class":338,"line":417},6,[336,419,391],{"emptyLinePlaceholder":390},[336,421,423],{"class":338,"line":422},7,[336,424,426],{"class":425},"sHwdD","\u002F\u002F Optional prefix — without MapGroup, routes are at the app root (\u002Fregister, \u002Flogin, …).\n",[336,428,430,433,435,437,440,443,446,448,451,453,455,457],{"class":338,"line":429},8,[336,431,432],{"class":342},"app",[336,434,239],{"class":346},[336,436,280],{"class":358},[336,438,439],{"class":346},"(",[336,441,442],{"class":346},"\"",[336,444,265],{"class":445},"sfazB",[336,447,442],{"class":346},[336,449,450],{"class":346},").",[336,452,224],{"class":358},[336,454,361],{"class":346},[336,456,365],{"class":364},[336,458,384],{"class":346},[209,460,461],{},"You still wire authentication, authorization, antiforgery, CORS, and rate limiting yourself. Login is bearer-first unless the client passes cookie query flags.",[319,463,465],{"id":464},"authendpoints-cookie-facade","AuthEndpoints (cookie facade)",[327,467,469],{"className":329,"code":468,"language":331,"meta":332,"style":332},"builder.Services.AddAuthEndpoints\u003CAppUser, AppDbContext>(o =>\n{\n    o.Passkeys.Enabled = false; \u002F\u002F thin cookie path; omit or set ServerDomain when passkeys stay on\n    o.Jwt.Enabled = false;\n});\nbuilder.Services.AddTransient\u003CIEmailSender\u003CAppUser>, MyEmailSender>();\n\nvar app = builder.Build();\n\napp.UseAuthEndpoints(); \u002F\u002F authentication, authorization, rate limiting, antiforgery\napp.MapAuthEndpoints\u003CAppUser>();\n",[218,470,471,503,508,536,556,561,591,595,611,616,631],{"__ignoreMap":332},[336,472,473,475,477,480,482,484,486,488,491,494,497,500],{"class":338,"line":339},[336,474,343],{"class":342},[336,476,239],{"class":346},[336,478,479],{"class":342},"Services",[336,481,239],{"class":346},[336,483,232],{"class":358},[336,485,361],{"class":346},[336,487,365],{"class":364},[336,489,490],{"class":346},",",[336,492,493],{"class":364}," AppDbContext",[336,495,496],{"class":346},">(",[336,498,499],{"class":364},"o",[336,501,502],{"class":346}," =>\n",[336,504,505],{"class":338,"line":352},[336,506,507],{"class":346},"{\n",[336,509,510,513,515,518,520,523,526,530,533],{"class":338,"line":371},[336,511,512],{"class":342},"    o",[336,514,239],{"class":346},[336,516,517],{"class":342},"Passkeys",[336,519,239],{"class":346},[336,521,522],{"class":342},"Enabled ",[336,524,525],{"class":346},"=",[336,527,529],{"class":528},"sfNiH"," false",[336,531,532],{"class":346},";",[336,534,535],{"class":425}," \u002F\u002F thin cookie path; omit or set ServerDomain when passkeys stay on\n",[336,537,538,540,542,545,547,549,551,553],{"class":338,"line":387},[336,539,512],{"class":342},[336,541,239],{"class":346},[336,543,544],{"class":342},"Jwt",[336,546,239],{"class":346},[336,548,522],{"class":342},[336,550,525],{"class":346},[336,552,529],{"class":528},[336,554,555],{"class":346},";\n",[336,557,558],{"class":338,"line":394},[336,559,560],{"class":346},"});\n",[336,562,563,565,567,569,571,574,576,579,581,583,586,589],{"class":338,"line":417},[336,564,343],{"class":342},[336,566,239],{"class":346},[336,568,479],{"class":342},[336,570,239],{"class":346},[336,572,573],{"class":358},"AddTransient",[336,575,361],{"class":346},[336,577,578],{"class":364},"IEmailSender",[336,580,361],{"class":346},[336,582,365],{"class":364},[336,584,585],{"class":346},">,",[336,587,588],{"class":364}," MyEmailSender",[336,590,384],{"class":346},[336,592,593],{"class":338,"line":422},[336,594,391],{"emptyLinePlaceholder":390},[336,596,597,599,601,603,605,607,609],{"class":338,"line":429},[336,598,397],{"class":364},[336,600,400],{"class":364},[336,602,403],{"class":346},[336,604,406],{"class":342},[336,606,239],{"class":346},[336,608,411],{"class":358},[336,610,414],{"class":346},[336,612,614],{"class":338,"line":613},9,[336,615,391],{"emptyLinePlaceholder":390},[336,617,619,621,623,625,628],{"class":338,"line":618},10,[336,620,432],{"class":342},[336,622,239],{"class":346},[336,624,235],{"class":358},[336,626,627],{"class":346},"();",[336,629,630],{"class":425}," \u002F\u002F authentication, authorization, rate limiting, antiforgery\n",[336,632,634,636,638,640,642,644],{"class":338,"line":633},11,[336,635,432],{"class":342},[336,637,239],{"class":346},[336,639,238],{"class":358},[336,641,361],{"class":346},[336,643,365],{"class":364},[336,645,384],{"class":346},[209,647,648,649,652,653,239],{},"Passkeys and JWT are off. When you leave passkeys enabled (facade default), set ",[218,650,651],{},"Passkeys.ServerDomain"," in Production. See ",[305,654,18],{"href":655},"\u002Fgetting-started\u002Fquick-start\u002F",[209,657,658,659,246,662,665,666,669,670,673,674,677,678,239],{},"CSRF on the AuthEndpoints cookie stack applies to cookie ",[213,660,661],{},"logout",[213,663,664],{},"manage"," POSTs, ",[213,667,668],{},"ReAuth",", authenticated ",[213,671,672],{},"resendConfirmationEmail",", and every passkey route except the list. It does ",[213,675,676],{},"not"," apply to register, login, forgotPassword, or resetPassword. See ",[305,679,163],{"href":680},"\u002Fmodules\u002Fcsrf\u002F",[314,682,684],{"id":683},"register","Register",[686,687,688,703],"table",{},[689,690,691],"thead",{},[692,693,694,697,700],"tr",{},[695,696],"th",{},[695,698,699],{},"Stock Identity API",[695,701,702],{},"AuthEndpoints facade",[704,705,706,728,745,763,778,795,811,840],"tbody",{},[692,707,708,712,724],{},[709,710,711],"td",{},"Route",[709,713,714,717,718,721,722,325],{},[218,715,716],{},"POST \u002Fregister"," (or ",[218,719,720],{},"POST \u002Fidentity\u002Fregister"," with ",[218,723,280],{},[709,725,726],{},[218,727,720],{},[692,729,730,733,742],{},[709,731,732],{},"Body",[709,734,735,736,246,739,325],{},"Identity register (",[218,737,738],{},"email",[218,740,741],{},"password",[709,743,744],{},"Same Identity body",[692,746,747,750,753],{},[709,748,749],{},"CSRF",[709,751,752],{},"Host policy (endpoint does not require antiforgery by default)",[709,754,755,758,759,762],{},[213,756,757],{},"Not"," required (",[218,760,761],{},"RequireAntiforgery"," is not on register)",[692,764,765,768,774],{},[709,766,767],{},"Duplicate email",[709,769,770,773],{},[218,771,772],{},"200"," (no enumeration)",[709,775,776,773],{},[218,777,772],{},[692,779,780,783,786],{},[709,781,782],{},"Confirmed-account policy",[709,784,785],{},"Host Identity options",[709,787,788,791,792],{},[218,789,790],{},"RequireConfirmedAccount"," default ",[218,793,794],{},"true",[692,796,797,802,805],{},[709,798,799,800],{},"After ",[218,801,772],{},[709,803,804],{},"Not signed in",[709,806,807,808,810],{},"Not signed in (",[218,809,772],{}," ≠ session)",[692,812,813,816,821],{},[709,814,815],{},"Confirm",[709,817,818],{},[218,819,820],{},"GET …\u002FconfirmEmail?userId&code",[709,822,823,826,827,830,831,721,834,221,837],{},[218,824,825],{},"GET \u002Fidentity\u002FconfirmEmail?userId&code",", then login. Optional ",[218,828,829],{},"ConfirmEmailRedirectUri"," → ",[218,832,833],{},"302",[218,835,836],{},"status",[218,838,839],{},"flow",[692,841,842,845,848],{},[709,843,844],{},"Rate limit",[709,846,847],{},"Host-owned",[709,849,850],{},"Built-in account rate limits",[209,852,853,854,239],{},"Client flow: register → check email → confirm → login. Steps: ",[305,855,41],{"href":856},"\u002Fguides\u002Fregistration\u002F",[314,858,860],{"id":859},"login","Login",[686,862,863,873],{},[689,864,865],{},[692,866,867,869,871],{},[695,868],{},[695,870,699],{},[695,872,702],{},[704,874,875,892,907,923,944,972,982,997,1009],{},[692,876,877,879,887],{},[709,878,711],{},[709,880,881,884,885,325],{},[218,882,883],{},"POST \u002Flogin"," (or under your ",[218,886,280],{},[709,888,889],{},[218,890,891],{},"POST \u002Fidentity\u002Flogin",[692,893,894,897,902],{},[709,895,896],{},"Handler",[709,898,899,900],{},"Identity ",[218,901,860],{},[709,903,904],{},[218,905,906],{},"LoginCookie",[692,908,909,911,915],{},[709,910,732],{},[709,912,899,913],{},[218,914,249],{},[709,916,917,918,246,920,922],{},"Same (",[218,919,738],{},[218,921,741],{},", optional 2FA fields)",[692,924,925,928,934],{},[709,926,927],{},"Default success",[709,929,930,931,325],{},"Identity bearer tokens (",[218,932,933],{},"AccessTokenResponse",[709,935,936,937,266,940,943],{},"Application cookie only (no bearer): empty body + ",[218,938,939],{},"Set-Cookie",[218,941,942],{},"TypedResults.Empty","). Session when the flag is omitted",[692,945,946,949,958],{},[709,947,948],{},"Cookie query flags",[709,950,951,221,954,957],{},[218,952,953],{},"useCookies",[218,955,956],{},"useSessionCookies"," select cookie vs bearer",[709,959,960,963,964,266,966,968,969],{},[213,961,962],{},"Only"," ",[218,965,956],{},[218,967,953],{}," ignored). Persistent: ",[218,970,971],{},"?useSessionCookies=false",[692,973,974,977,980],{},[709,975,976],{},"CSRF on login",[709,978,979],{},"Not required",[709,981,979],{},[692,983,984,987,992],{},[709,985,986],{},"Logout",[709,988,989,990],{},"Not in ",[218,991,224],{},[709,993,994,996],{},[218,995,290],{}," (auth + CSRF)",[692,998,999,1002,1004],{},[709,1000,1001],{},"CSRF helper",[709,1003,847],{},[709,1005,1006,1008],{},[218,1007,286],{}," for logout, manage, ReAuth, resend",[692,1010,1011,1014,1017],{},[709,1012,1013],{},"Lockout",[709,1015,1016],{},"Identity lockout",[709,1018,1019],{},"Lockout + login rate limit",[209,1021,1022,1023,1027,1028,1031,1032,1035],{},"Full flag tables: ",[305,1024,1026],{"href":1025},"\u002Fmodules\u002Fcookie-auth\u002F","Cookie auth",". Bearer-style Identity login stays available via compose (",[218,1029,1030],{},"MapBearerAuthEndpoints",") or ",[218,1033,1034],{},"SignIn = IdentityBearer",". It is not the cookie-facade default.",[314,1037,1039],{"id":1038},"password-reset","Password reset",[686,1041,1042,1052],{},[689,1043,1044],{},[692,1045,1046,1048,1050],{},[695,1047],{},[695,1049,699],{},[695,1051,702],{},[704,1053,1054,1077,1086,1100,1114,1133,1142],{},[692,1055,1056,1059,1070],{},[709,1057,1058],{},"Forgot",[709,1060,1061,963,1064,1067,1068],{},[218,1062,1063],{},"POST …\u002FforgotPassword",[218,1065,1066],{},"{ email }"," → always ",[218,1069,772],{},[709,1071,1072,1067,1075],{},[218,1073,1074],{},"POST \u002Fidentity\u002FforgotPassword",[218,1076,772],{},[692,1078,1079,1082,1084],{},[709,1080,1081],{},"CSRF \u002F session on forgot",[709,1083,979],{},[709,1085,979],{},[692,1087,1088,1091,1097],{},[709,1089,1090],{},"Mail",[709,1092,1093,1094],{},"Your ",[218,1095,1096],{},"IEmailSender\u003CTUser>",[709,1098,1099],{},"Same (Production rejects Identity's no-op sender)",[692,1101,1102,1105,1108],{},[709,1103,1104],{},"Reset code",[709,1106,1107],{},"From mail",[709,1109,1110,1111],{},"Base64Url token from the sender; send that value as ",[218,1112,1113],{},"resetCode",[692,1115,1116,1119,1127],{},[709,1117,1118],{},"Reset",[709,1120,1121,963,1124],{},[218,1122,1123],{},"POST …\u002FresetPassword",[218,1125,1126],{},"{ email, resetCode, newPassword }",[709,1128,1129,1130],{},"Same Identity body on ",[218,1131,1132],{},"\u002Fidentity\u002FresetPassword",[692,1134,1135,1138,1140],{},[709,1136,1137],{},"CSRF \u002F session on reset",[709,1139,979],{},[709,1141,979],{},[692,1143,1144,1147,1152],{},[709,1145,1146],{},"Then",[709,1148,1149],{},[218,1150,1151],{},"POST …\u002Flogin",[709,1153,1154,266,1156,325],{},[218,1155,891],{},[218,1157,906],{},[209,1159,1160,1161,239],{},"Client steps: ",[305,1162,61],{"href":1163},"\u002Fguides\u002Freset-password\u002F",[314,1165,1167],{"id":1166},"two-factor-authentication","Two-factor authentication",[686,1169,1170,1180],{},[689,1171,1172],{},[692,1173,1174,1176,1178],{},[695,1175],{},[695,1177,699],{},[695,1179,702],{},[704,1181,1182,1211,1232,1250,1269,1287,1303],{},[692,1183,1184,1187,1202],{},[709,1185,1186],{},"Status",[709,1188,1189,1193,1194,1197,1198,1201],{},[1190,1191,1192],"em",{},"No GET"," — use ",[218,1195,1196],{},"POST \u002Fidentity\u002Fmanage\u002F2fa"," (response includes ",[218,1199,1200],{},"sharedKey"," \u002F flags)",[709,1203,1204,830,1207,1210],{},[218,1205,1206],{},"GET \u002Fidentity\u002Fmanage\u002F2fa",[218,1208,1209],{},"isTwoFactorEnabled"," only",[692,1212,1213,1216,1222],{},[709,1214,1215],{},"Shared key",[709,1217,1218,1219,325],{},"On stock POST response (",[218,1220,1221],{},"TwoFactorResponse.sharedKey",[709,1223,1224,1225,1227,1228,1231],{},"Mint\u002Fread via ",[218,1226,1196],{}," + ",[218,1229,1230],{},"{}"," (not GET); CSRF + ReAuth",[692,1233,1234,1237,1245],{},[709,1235,1236],{},"Enable \u002F disable",[709,1238,1239,1240,266,1243,325],{},"Auth’d ",[218,1241,1242],{},"POST \u002Fmanage\u002F2fa",[218,1244,258],{},[709,1246,1239,1247,1249],{},[218,1248,1196],{}," (same Identity body); CSRF + ReAuth",[692,1251,1252,1258,1263],{},[709,1253,1254,1255],{},"CSRF on ",[218,1256,1257],{},"POST",[709,1259,1260,1261],{},"Not required by ",[218,1262,224],{},[709,1264,1265,1266,325],{},"Required (",[218,1267,1268],{},"RequestVerificationToken",[692,1270,1271,1274,1277],{},[709,1272,1273],{},"Step-up",[709,1275,1276],{},"Not built in",[709,1278,1279,1280,1283,1284,325],{},"ReAuth required (",[218,1281,1282],{},"confirmIdentity",", then cookie or ",[218,1285,1286],{},"X-AuthEndpoints-Reauth",[692,1288,1289,1297,1300],{},[709,1290,1291,1227,1294],{},[218,1292,1293],{},"enable",[218,1295,1296],{},"resetSharedKey",[709,1298,1299],{},"Avoid together",[709,1301,1302],{},"Do not send together (validation problem)",[692,1304,1305,1308,1319],{},[709,1306,1307],{},"Login with 2FA",[709,1309,1310,221,1313,1316,1317],{},[218,1311,1312],{},"twoFactorCode",[218,1314,1315],{},"twoFactorRecoveryCode"," on ",[218,1318,860],{},[709,1320,1321,1322],{},"Same fields on ",[218,1323,906],{},[209,1325,1160,1326,1329,1330,239],{},[305,1327,56],{"href":1328},"\u002Fguides\u002Ftwo-factor\u002F"," and ",[305,1331,81],{"href":1332},"\u002Fguides\u002Fstep-up\u002F",[314,1334,1336],{"id":1335},"after-these-four-flows","After these four flows",[209,1338,1339,1340,1342,1343,1346,1347,1329,1350,239],{},"AuthEndpoints also maps manage info, ReAuth routes, and optional passkeys\u002FJWT. Stock ",[218,1341,224],{}," does not include passkeys, ReAuth, cookie logout, or ",[218,1344,1345],{},"csrfToken",". Compose only the modules you need when the facade is too much. See ",[305,1348,97],{"href":1349},"\u002Fcomposables\u002F",[305,1351,1353],{"href":1352},"\u002Fmodules\u002Fidentity-management\u002F","Modules",[314,1355,1357],{"id":1356},"related","Related",[1359,1360,1361,1366,1370,1374,1378,1382],"ul",{},[1362,1363,1364],"li",{},[305,1365,312],{"href":311},[1362,1367,1368],{},[305,1369,18],{"href":655},[1362,1371,1372],{},[305,1373,34],{"href":307},[1362,1375,1376],{},[305,1377,41],{"href":856},[1362,1379,1380],{},[305,1381,61],{"href":1163},[1362,1383,1384],{},[305,1385,56],{"href":1328},[1387,1388,1389],"style",{},"html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}",{"title":332,"searchDepth":339,"depth":352,"links":1391},[1392,1397,1398,1399,1400,1401,1402],{"id":316,"depth":352,"text":317,"children":1393},[1394,1396],{"id":321,"depth":371,"text":1395},"Stock (MapIdentityApi)",{"id":464,"depth":371,"text":465},{"id":683,"depth":352,"text":684},{"id":859,"depth":352,"text":860},{"id":1038,"depth":352,"text":1039},{"id":1166,"depth":352,"text":1167},{"id":1335,"depth":352,"text":1336},{"id":1356,"depth":352,"text":1357},"Side-by-side register, login, password reset, and 2FA for MapIdentityApi and the AuthEndpoints facade.","md",null,{},{"icon":192},{"title":189,"description":1403},"wpmJU3HHMI_WEWmTNfn5J8ALbuWzh6BmdqpkWd6q_5k",[1411,1413],{"title":184,"path":185,"stem":186,"description":1412,"icon":187,"children":-1},"How AuthEndpoints differs from wiring ASP.NET Core Identity yourself, from OpenIddict, and from Identity API endpoints.",{"title":194,"path":195,"stem":196,"description":1414,"icon":197,"children":-1},"How AuthEndpoints protects sign-in and account changes, and which trade-offs it leaves to the host.",1791123629589]