[{"data":1,"prerenderedAt":681},["ShallowReactive",2],{"navigation":3,"\u002Fgetting-started\u002Fcompatibility-facade":250,"\u002Fgetting-started\u002Fcompatibility-facade-surround":676},[4,43,120,143,219],{"title":5,"path":6,"stem":7,"children":8,"icon":42},"Get started","\u002Fgetting-started","1.getting-started\u002F1.index",[9,12,17,22,27,32,37],{"title":10,"path":6,"stem":7,"icon":11},"Introduction","i-lucide-house",{"title":13,"path":14,"stem":15,"icon":16},"Install AuthEndpoints","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F2.installation","i-lucide-download",{"title":18,"path":19,"stem":20,"icon":21},"Quick start","\u002Fgetting-started\u002Fquick-start","1.getting-started\u002F3.quick-start","i-lucide-play",{"title":23,"path":24,"stem":25,"icon":26},"Pick your setup","\u002Fgetting-started\u002Fchoose-a-sign-in-stack","1.getting-started\u002F4.choose-a-sign-in-stack","i-lucide-signpost",{"title":28,"path":29,"stem":30,"icon":31},"Use the AuthEndpoints skill with coding agents","\u002Fgetting-started\u002Fai-agents","1.getting-started\u002F5.ai-agents","i-lucide-bot",{"title":33,"path":34,"stem":35,"icon":36},"Password auth","\u002Fgetting-started\u002Fpassword-auth","1.getting-started\u002F6.password-auth","i-lucide-key-round",{"title":38,"path":39,"stem":40,"icon":41},"3.x facade","\u002Fgetting-started\u002Fcompatibility-facade","1.getting-started\u002F7.compatibility-facade","i-lucide-archive","i-lucide-rocket",{"title":44,"path":45,"stem":46,"children":47,"icon":119},"Guides","\u002Fguides","2.guides\u002F01.index",[48,50,55,60,65,70,74,79,84,89,94,99,104,109,114],{"title":44,"path":45,"stem":46,"icon":49},"i-lucide-list-checks",{"title":51,"path":52,"stem":53,"icon":54},"Register users","\u002Fguides\u002Fregistration","2.guides\u002F02.registration","i-lucide-user-plus",{"title":56,"path":57,"stem":58,"icon":59},"Sign users in","\u002Fguides\u002Fsign-in","2.guides\u002F03.sign-in","i-lucide-log-in",{"title":61,"path":62,"stem":63,"icon":64},"Sign users out","\u002Fguides\u002Fsign-out","2.guides\u002F04.sign-out","i-lucide-log-out",{"title":66,"path":67,"stem":68,"icon":69},"Turn on two-factor authentication","\u002Fguides\u002Ftwo-factor","2.guides\u002F05.two-factor","i-lucide-smartphone",{"title":71,"path":72,"stem":73,"icon":36},"Reset a forgotten password","\u002Fguides\u002Freset-password","2.guides\u002F06.reset-password",{"title":75,"path":76,"stem":77,"icon":78},"Change a user's email or password","\u002Fguides\u002Fmanage-account","2.guides\u002F07.manage-account","i-lucide-user-cog",{"title":80,"path":81,"stem":82,"icon":83},"Add, rename, and remove passkeys","\u002Fguides\u002Fmanage-passkeys","2.guides\u002F08.manage-passkeys","i-lucide-scan-face",{"title":85,"path":86,"stem":87,"icon":88},"Link and unlink GitHub or Google accounts","\u002Fguides\u002Flink-external-accounts","2.guides\u002F09.link-external-accounts","i-lucide-link",{"title":90,"path":91,"stem":92,"icon":93},"Require step-up before sensitive actions","\u002Fguides\u002Fstep-up","2.guides\u002F10.step-up","i-lucide-shield-check",{"title":95,"path":96,"stem":97,"icon":98},"Call the API from a browser","\u002Fguides\u002Fbrowser-clients","2.guides\u002F11.browser-clients","i-lucide-globe",{"title":100,"path":101,"stem":102,"icon":103},"Prepare for production","\u002Fguides\u002Fproduction","2.guides\u002F12.production","i-lucide-factory",{"title":105,"path":106,"stem":107,"icon":108},"Sign in with an emailed code","\u002Fguides\u002Femail-code","2.guides\u002F13.email-code","i-lucide-mail",{"title":110,"path":111,"stem":112,"icon":113},"Upgrade to 4.0","\u002Fguides\u002Fupgrading-to-4","2.guides\u002F14.upgrading-to-4","i-lucide-arrow-up-right",{"title":115,"path":116,"stem":117,"icon":118},"Run an app with no public sign-up","\u002Fguides\u002Finternal-app","2.guides\u002F15.internal-app","i-lucide-building-2","i-lucide-waypoints",{"title":121,"path":122,"stem":123,"children":124,"icon":142},"Composable endpoints","\u002Fcomposables","3.composables\u002F1.index",[125,128,132,137],{"title":126,"path":122,"stem":123,"icon":127},"How composition works","i-lucide-layout-grid",{"title":129,"path":130,"stem":131,"icon":49},"Composition requirements","\u002Fcomposables\u002Frequirements","3.composables\u002F2.requirements",{"title":133,"path":134,"stem":135,"icon":136},"Compose a custom auth stack","\u002Fcomposables\u002Frecipes","3.composables\u002F3.recipes","i-lucide-book-marked",{"title":138,"path":139,"stem":140,"icon":141},"Composition","\u002Fcomposables\u002Fcomposition","3.composables\u002F4.composition","i-lucide-table","i-lucide-blocks",{"title":144,"icon":145,"path":146,"stem":147,"children":148,"page":218},"Reference","i-lucide-book-open","\u002Fmodules","4.modules",[149,154,158,163,168,173,177,182,186,191,195,200,205,209,213],{"title":150,"path":151,"stem":152,"icon":153},"Endpoint reference","\u002Fmodules\u002Fendpoints","4.modules\u002F01.endpoints","i-lucide-route",{"title":155,"path":156,"stem":157,"icon":78},"Identity management module","\u002Fmodules\u002Fidentity-management","4.modules\u002F02.identity-management",{"title":159,"path":160,"stem":161,"icon":162},"Cookie sign-in module","\u002Fmodules\u002Fcookie-auth","4.modules\u002F03.cookie-auth","i-lucide-cookie",{"title":164,"path":165,"stem":166,"icon":167},"Identity bearer sign-in module","\u002Fmodules\u002Fbearer-auth","4.modules\u002F04.bearer-auth","i-lucide-key",{"title":169,"path":170,"stem":171,"icon":172},"JWT module","\u002Fmodules\u002Fjwt","4.modules\u002F05.jwt","i-lucide-fingerprint",{"title":174,"path":175,"stem":176,"icon":83},"Passkeys module","\u002Fmodules\u002Fpasskeys","4.modules\u002F06.passkeys",{"title":178,"path":179,"stem":180,"icon":181},"ReAuth module","\u002Fmodules\u002Freauth","4.modules\u002F07.reauth","i-lucide-shield-alert",{"title":183,"path":184,"stem":185,"icon":59},"External OAuth packages","\u002Fmodules\u002Fexternal-oauth","4.modules\u002F08.external-oauth",{"title":187,"path":188,"stem":189,"icon":190},"Configuration options","\u002Fmodules\u002Fconfiguration","4.modules\u002F09.configuration","i-lucide-settings",{"title":192,"path":193,"stem":194,"icon":93},"Antiforgery (CSRF) rules","\u002Fmodules\u002Fcsrf","4.modules\u002F10.csrf",{"title":196,"path":197,"stem":198,"icon":199},"Responses and errors","\u002Fmodules\u002Ferrors","4.modules\u002F11.errors","i-lucide-circle-alert",{"title":201,"path":202,"stem":203,"icon":204},"Rate-limit policies","\u002Fmodules\u002Frate-limits","4.modules\u002F12.rate-limits","i-lucide-gauge",{"title":206,"path":207,"stem":208,"icon":108},"Email-code module","\u002Fmodules\u002Femail-code","4.modules\u002F13.email-code",{"title":210,"path":211,"stem":212,"icon":59},"Sign-in completer","\u002Fmodules\u002Fsign-in-completer","4.modules\u002F14.sign-in-completer",{"title":214,"path":215,"stem":216,"icon":217},"Enumeration-safe responses","\u002Fmodules\u002Fenumeration","4.modules\u002F15.enumeration","i-lucide-eye-off",false,{"title":220,"icon":221,"path":222,"stem":223,"children":224,"page":218},"Concepts","i-lucide-lightbulb","\u002Fconcepts","5.concepts",[225,230,235,240,245],{"title":226,"path":227,"stem":228,"icon":229},"AuthEndpoints compared with other options","\u002Fconcepts\u002Fcompare","5.concepts\u002F1.compare","i-lucide-git-compare",{"title":231,"path":232,"stem":233,"icon":234},"Stock Identity endpoints vs AuthEndpoints","\u002Fconcepts\u002Fstock-identity-vs-authendpoints","5.concepts\u002F2.stock-identity-vs-authendpoints","i-lucide-columns-2",{"title":236,"path":237,"stem":238,"icon":239},"MapIdentityApi alternative","\u002Fconcepts\u002Fmapidentityapi-alternative","5.concepts\u002F3.mapidentityapi-alternative","i-lucide-arrow-left-right",{"title":241,"path":242,"stem":243,"icon":244},"Security model","\u002Fconcepts\u002Fsecurity-model","5.concepts\u002F4.security-model","i-lucide-shield",{"title":246,"path":247,"stem":248,"icon":249},"FAQ","\u002Fconcepts\u002Ffaq","5.concepts\u002F5.faq","i-lucide-circle-help",{"id":251,"title":252,"body":253,"description":669,"extension":670,"faq":218,"links":671,"meta":672,"navigation":673,"path":39,"seo":674,"stem":40,"__hash__":675},"docs\u002F1.getting-started\u002F7.compatibility-facade.md","3.x facade, kept for compatibility",{"type":254,"value":255,"toc":666},"minimark",[256,292,425,453,476,491,497,612,628,633,662],[257,258,259,263,264,267,268,271,272,275,276,271,279,282,283,286,287,291],"p",{},[260,261,262],"code",{},"AddAuthEndpoints"," and ",[260,265,266],{},"MapAuthEndpoints"," are the 3.x facade. They are not obsolete. Names, options, ",[260,269,270],{},"AuthEndpointsSignIn",", ",[260,273,274],{},"EmailCode.Enabled",", and the ",[260,277,278],{},"\u002Fidentity",[260,280,281],{},"\u002Faccount",", and ",[260,284,285],{},"\u002Fauth"," routes stay at 3.4.1. New hosts that want one password session use ",[288,289,33],"a",{"href":290},"\u002Fgetting-started\u002Fpassword-auth\u002F",". Do not call both facades in one host.",[293,294,299],"pre",{"className":295,"code":296,"language":297,"meta":298,"style":298},"language-cs shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","builder.Services.AddAuthEndpoints\u003CAppUser, AppDbContext>(options =>\n{\n    options.Passkeys.ServerDomain = \"example.com\";\n});\n\napp.UseAuthEndpoints();\napp.MapAuthEndpoints\u003CAppUser>();\n","cs","",[260,300,301,344,350,382,388,395,409],{"__ignoreMap":298},[302,303,306,310,314,317,319,322,325,329,332,335,338,341],"span",{"class":304,"line":305},"line",1,[302,307,309],{"class":308},"sTEyZ","builder",[302,311,313],{"class":312},"sMK4o",".",[302,315,316],{"class":308},"Services",[302,318,313],{"class":312},[302,320,262],{"class":321},"s2Zo4",[302,323,324],{"class":312},"\u003C",[302,326,328],{"class":327},"sBMFI","AppUser",[302,330,331],{"class":312},",",[302,333,334],{"class":327}," AppDbContext",[302,336,337],{"class":312},">(",[302,339,340],{"class":327},"options",[302,342,343],{"class":312}," =>\n",[302,345,347],{"class":304,"line":346},2,[302,348,349],{"class":312},"{\n",[302,351,353,356,358,361,363,366,369,372,376,379],{"class":304,"line":352},3,[302,354,355],{"class":308},"    options",[302,357,313],{"class":312},[302,359,360],{"class":308},"Passkeys",[302,362,313],{"class":312},[302,364,365],{"class":308},"ServerDomain ",[302,367,368],{"class":312},"=",[302,370,371],{"class":312}," \"",[302,373,375],{"class":374},"sfazB","example.com",[302,377,378],{"class":312},"\"",[302,380,381],{"class":312},";\n",[302,383,385],{"class":304,"line":384},4,[302,386,387],{"class":312},"});\n",[302,389,391],{"class":304,"line":390},5,[302,392,394],{"emptyLinePlaceholder":393},true,"\n",[302,396,398,401,403,406],{"class":304,"line":397},6,[302,399,400],{"class":308},"app",[302,402,313],{"class":312},[302,404,405],{"class":321},"UseAuthEndpoints",[302,407,408],{"class":312},"();\n",[302,410,412,414,416,418,420,422],{"class":304,"line":411},7,[302,413,400],{"class":308},[302,415,313],{"class":312},[302,417,266],{"class":321},[302,419,324],{"class":312},[302,421,328],{"class":327},[302,423,424],{"class":312},">();\n",[257,426,427,428,431,432,435,436,439,440,443,444,447,448,443,450,313],{},"Identity bearer is ",[260,429,430],{},"AddAuthEndpoints\u003CAppUser, AppDbContext>(AuthEndpointsSignIn.IdentityBearer, ...)",". JWT on this facade is ",[260,433,434],{},"options.Jwt.Enabled = true"," plus ",[260,437,438],{},"Jwt.Configure",". Passkeys are on until ",[260,441,442],{},"Passkeys.Enabled"," is ",[260,445,446],{},"false",". Email-code sign-in is off until ",[260,449,274],{},[260,451,452],{},"true",[257,454,455,456,459,460,463,464,467,468,471,472,475],{},"There is no role overload on ",[260,457,458],{},"AddPasswordAuth",". The three-type ",[260,461,462],{},"AddAuthEndpoints\u003CTUser, TRole, TContext>"," overload is unchanged. Your ",[260,465,466],{},"DbContext"," must be ",[260,469,470],{},"IdentityDbContext\u003CTUser, TRole, TKey>"," or equivalent. Do not chain ",[260,473,474],{},".AddRoles\u003CTRole>()"," after the two-type overload.",[257,477,478,479,482,483,486,487,490],{},"The changes that do apply to this facade are in ",[288,480,110],{"href":481},"\u002Fguides\u002Fupgrading-to-4\u002F#mapauthendpoints-exceptions",". Password login, JWT ",[260,484,485],{},"POST \u002Fcreate"," failure text, and email-code verify stay on the 3.4.1 handlers, apart from those exceptions. ",[260,488,489],{},"POST \u002Fmanage\u002Fpassword"," stays unmapped here. The password facade maps it.",[257,492,493,496],{},[260,494,495],{},"MapBearerAuthEndpoints"," maps no CSRF token route. Anonymous passkey ceremonies still need a token, because the WebAuthn challenge is stored in a cookie. Map a token endpoint in the host:",[293,498,500],{"className":295,"code":499,"language":297,"meta":298,"style":298},"using Microsoft.AspNetCore.Antiforgery;\n\napp.MapGet(\"\u002Fidentity\u002FcsrfToken\", (IAntiforgery antiforgery, HttpContext context) =>\n    Results.Ok(new { csrfToken = antiforgery.GetAndStoreTokens(context).RequestToken }));\n",[260,501,502,523,527,570],{"__ignoreMap":298},[302,503,504,508,511,513,516,518,521],{"class":304,"line":305},[302,505,507],{"class":506},"sbssI","using",[302,509,510],{"class":308}," Microsoft",[302,512,313],{"class":312},[302,514,515],{"class":308},"AspNetCore",[302,517,313],{"class":312},[302,519,520],{"class":308},"Antiforgery",[302,522,381],{"class":312},[302,524,525],{"class":304,"line":346},[302,526,394],{"emptyLinePlaceholder":393},[302,528,529,531,533,536,539,541,544,546,548,551,554,557,559,562,565,568],{"class":304,"line":352},[302,530,400],{"class":308},[302,532,313],{"class":312},[302,534,535],{"class":321},"MapGet",[302,537,538],{"class":312},"(",[302,540,378],{"class":312},[302,542,543],{"class":374},"\u002Fidentity\u002FcsrfToken",[302,545,378],{"class":312},[302,547,331],{"class":312},[302,549,550],{"class":312}," (",[302,552,553],{"class":327},"IAntiforgery",[302,555,556],{"class":327}," antiforgery",[302,558,331],{"class":312},[302,560,561],{"class":327}," HttpContext",[302,563,564],{"class":327}," context",[302,566,567],{"class":312},")",[302,569,343],{"class":312},[302,571,572,575,577,580,583,586,589,591,593,595,598,600,603,606,609],{"class":304,"line":384},[302,573,574],{"class":308},"    Results",[302,576,313],{"class":312},[302,578,579],{"class":321},"Ok",[302,581,582],{"class":312},"(new",[302,584,585],{"class":312}," {",[302,587,588],{"class":308}," csrfToken ",[302,590,368],{"class":312},[302,592,556],{"class":308},[302,594,313],{"class":312},[302,596,597],{"class":321},"GetAndStoreTokens",[302,599,538],{"class":312},[302,601,602],{"class":308},"context",[302,604,605],{"class":312},").",[302,607,608],{"class":308},"RequestToken ",[302,610,611],{"class":312},"}));\n",[257,613,614,615,618,619,621,622,624,625,313],{},"The client keeps the antiforgery cookie from that response and sends the token in the ",[260,616,617],{},"RequestVerificationToken"," header. If you do not use passkeys, set ",[260,620,442],{}," to ",[260,623,446],{}," instead. The skip rule is in ",[288,626,192],{"href":627},"\u002Fmodules\u002Fcsrf\u002F",[629,630,632],"h2",{"id":631},"related","Related",[634,635,636,642,646,651,656],"ul",{},[637,638,639],"li",{},[288,640,23],{"href":641},"\u002Fgetting-started\u002Fchoose-a-sign-in-stack\u002F",[637,643,644],{},[288,645,33],{"href":290},[637,647,648],{},[288,649,110],{"href":650},"\u002Fguides\u002Fupgrading-to-4\u002F",[637,652,653],{},[288,654,126],{"href":655},"\u002Fcomposables\u002F",[637,657,658],{},[288,659,661],{"href":660},"\u002Fmodules\u002Fbearer-auth\u002F","Bearer auth",[663,664,665],"style",{},"html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}",{"title":298,"searchDepth":305,"depth":346,"links":667},[668],{"id":631,"depth":346,"text":632},"AddAuthEndpoints and MapAuthEndpoints keep the 3.4.1 options, the AuthEndpointsSignIn values, and the \u002Fidentity, \u002Faccount, and \u002Fauth routes.","md",null,{},{"title":38,"icon":41},{"title":252,"description":669},"7NCjLm7PUxCm07o0rNfUX9l4FQYQ5BQ3KcaZBVwCnVg",[677,679],{"title":33,"path":34,"stem":35,"description":678,"icon":36,"children":-1},"What AddPasswordAuth and MapPasswordAuth register and map, and the building-block calls they expand to.",{"title":44,"path":45,"stem":46,"description":680,"icon":49,"children":-1},"Task list for registration, sign-in, account management, and production setup.",1792054254727]