[{"data":1,"prerenderedAt":1442},["ShallowReactive",2],{"navigation":3,"\u002Fgetting-started\u002Fpassword-auth":250,"\u002Fgetting-started\u002Fpassword-auth-surround":1437},[4,43,120,143,219],{"title":5,"path":6,"stem":7,"children":8,"icon":42},"Get started","\u002Fgetting-started","1.getting-started\u002F1.index",[9,12,17,22,27,32,37],{"title":10,"path":6,"stem":7,"icon":11},"Introduction","i-lucide-house",{"title":13,"path":14,"stem":15,"icon":16},"Install AuthEndpoints","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F2.installation","i-lucide-download",{"title":18,"path":19,"stem":20,"icon":21},"Quick start","\u002Fgetting-started\u002Fquick-start","1.getting-started\u002F3.quick-start","i-lucide-play",{"title":23,"path":24,"stem":25,"icon":26},"Pick your setup","\u002Fgetting-started\u002Fchoose-a-sign-in-stack","1.getting-started\u002F4.choose-a-sign-in-stack","i-lucide-signpost",{"title":28,"path":29,"stem":30,"icon":31},"Use the AuthEndpoints skill with coding agents","\u002Fgetting-started\u002Fai-agents","1.getting-started\u002F5.ai-agents","i-lucide-bot",{"title":33,"path":34,"stem":35,"icon":36},"Password auth","\u002Fgetting-started\u002Fpassword-auth","1.getting-started\u002F6.password-auth","i-lucide-key-round",{"title":38,"path":39,"stem":40,"icon":41},"3.x facade","\u002Fgetting-started\u002Fcompatibility-facade","1.getting-started\u002F7.compatibility-facade","i-lucide-archive","i-lucide-rocket",{"title":44,"path":45,"stem":46,"children":47,"icon":119},"Guides","\u002Fguides","2.guides\u002F01.index",[48,50,55,60,65,70,74,79,84,89,94,99,104,109,114],{"title":44,"path":45,"stem":46,"icon":49},"i-lucide-list-checks",{"title":51,"path":52,"stem":53,"icon":54},"Register users","\u002Fguides\u002Fregistration","2.guides\u002F02.registration","i-lucide-user-plus",{"title":56,"path":57,"stem":58,"icon":59},"Sign users in","\u002Fguides\u002Fsign-in","2.guides\u002F03.sign-in","i-lucide-log-in",{"title":61,"path":62,"stem":63,"icon":64},"Sign users out","\u002Fguides\u002Fsign-out","2.guides\u002F04.sign-out","i-lucide-log-out",{"title":66,"path":67,"stem":68,"icon":69},"Turn on two-factor authentication","\u002Fguides\u002Ftwo-factor","2.guides\u002F05.two-factor","i-lucide-smartphone",{"title":71,"path":72,"stem":73,"icon":36},"Reset a forgotten password","\u002Fguides\u002Freset-password","2.guides\u002F06.reset-password",{"title":75,"path":76,"stem":77,"icon":78},"Change a user's email or password","\u002Fguides\u002Fmanage-account","2.guides\u002F07.manage-account","i-lucide-user-cog",{"title":80,"path":81,"stem":82,"icon":83},"Add, rename, and remove passkeys","\u002Fguides\u002Fmanage-passkeys","2.guides\u002F08.manage-passkeys","i-lucide-scan-face",{"title":85,"path":86,"stem":87,"icon":88},"Link and unlink GitHub or Google accounts","\u002Fguides\u002Flink-external-accounts","2.guides\u002F09.link-external-accounts","i-lucide-link",{"title":90,"path":91,"stem":92,"icon":93},"Require step-up before sensitive actions","\u002Fguides\u002Fstep-up","2.guides\u002F10.step-up","i-lucide-shield-check",{"title":95,"path":96,"stem":97,"icon":98},"Call the API from a browser","\u002Fguides\u002Fbrowser-clients","2.guides\u002F11.browser-clients","i-lucide-globe",{"title":100,"path":101,"stem":102,"icon":103},"Prepare for production","\u002Fguides\u002Fproduction","2.guides\u002F12.production","i-lucide-factory",{"title":105,"path":106,"stem":107,"icon":108},"Sign in with an emailed code","\u002Fguides\u002Femail-code","2.guides\u002F13.email-code","i-lucide-mail",{"title":110,"path":111,"stem":112,"icon":113},"Upgrade to 4.0","\u002Fguides\u002Fupgrading-to-4","2.guides\u002F14.upgrading-to-4","i-lucide-arrow-up-right",{"title":115,"path":116,"stem":117,"icon":118},"Run an app with no public sign-up","\u002Fguides\u002Finternal-app","2.guides\u002F15.internal-app","i-lucide-building-2","i-lucide-waypoints",{"title":121,"path":122,"stem":123,"children":124,"icon":142},"Composable endpoints","\u002Fcomposables","3.composables\u002F1.index",[125,128,132,137],{"title":126,"path":122,"stem":123,"icon":127},"How composition works","i-lucide-layout-grid",{"title":129,"path":130,"stem":131,"icon":49},"Composition requirements","\u002Fcomposables\u002Frequirements","3.composables\u002F2.requirements",{"title":133,"path":134,"stem":135,"icon":136},"Compose a custom auth stack","\u002Fcomposables\u002Frecipes","3.composables\u002F3.recipes","i-lucide-book-marked",{"title":138,"path":139,"stem":140,"icon":141},"Composition","\u002Fcomposables\u002Fcomposition","3.composables\u002F4.composition","i-lucide-table","i-lucide-blocks",{"title":144,"icon":145,"path":146,"stem":147,"children":148,"page":218},"Reference","i-lucide-book-open","\u002Fmodules","4.modules",[149,154,158,163,168,173,177,182,186,191,195,200,205,209,213],{"title":150,"path":151,"stem":152,"icon":153},"Endpoint reference","\u002Fmodules\u002Fendpoints","4.modules\u002F01.endpoints","i-lucide-route",{"title":155,"path":156,"stem":157,"icon":78},"Identity management module","\u002Fmodules\u002Fidentity-management","4.modules\u002F02.identity-management",{"title":159,"path":160,"stem":161,"icon":162},"Cookie sign-in module","\u002Fmodules\u002Fcookie-auth","4.modules\u002F03.cookie-auth","i-lucide-cookie",{"title":164,"path":165,"stem":166,"icon":167},"Identity bearer sign-in module","\u002Fmodules\u002Fbearer-auth","4.modules\u002F04.bearer-auth","i-lucide-key",{"title":169,"path":170,"stem":171,"icon":172},"JWT module","\u002Fmodules\u002Fjwt","4.modules\u002F05.jwt","i-lucide-fingerprint",{"title":174,"path":175,"stem":176,"icon":83},"Passkeys module","\u002Fmodules\u002Fpasskeys","4.modules\u002F06.passkeys",{"title":178,"path":179,"stem":180,"icon":181},"ReAuth module","\u002Fmodules\u002Freauth","4.modules\u002F07.reauth","i-lucide-shield-alert",{"title":183,"path":184,"stem":185,"icon":59},"External OAuth packages","\u002Fmodules\u002Fexternal-oauth","4.modules\u002F08.external-oauth",{"title":187,"path":188,"stem":189,"icon":190},"Configuration options","\u002Fmodules\u002Fconfiguration","4.modules\u002F09.configuration","i-lucide-settings",{"title":192,"path":193,"stem":194,"icon":93},"Antiforgery (CSRF) rules","\u002Fmodules\u002Fcsrf","4.modules\u002F10.csrf",{"title":196,"path":197,"stem":198,"icon":199},"Responses and errors","\u002Fmodules\u002Ferrors","4.modules\u002F11.errors","i-lucide-circle-alert",{"title":201,"path":202,"stem":203,"icon":204},"Rate-limit policies","\u002Fmodules\u002Frate-limits","4.modules\u002F12.rate-limits","i-lucide-gauge",{"title":206,"path":207,"stem":208,"icon":108},"Email-code module","\u002Fmodules\u002Femail-code","4.modules\u002F13.email-code",{"title":210,"path":211,"stem":212,"icon":59},"Sign-in completer","\u002Fmodules\u002Fsign-in-completer","4.modules\u002F14.sign-in-completer",{"title":214,"path":215,"stem":216,"icon":217},"Enumeration-safe responses","\u002Fmodules\u002Fenumeration","4.modules\u002F15.enumeration","i-lucide-eye-off",false,{"title":220,"icon":221,"path":222,"stem":223,"children":224,"page":218},"Concepts","i-lucide-lightbulb","\u002Fconcepts","5.concepts",[225,230,235,240,245],{"title":226,"path":227,"stem":228,"icon":229},"AuthEndpoints compared with other options","\u002Fconcepts\u002Fcompare","5.concepts\u002F1.compare","i-lucide-git-compare",{"title":231,"path":232,"stem":233,"icon":234},"Stock Identity endpoints vs AuthEndpoints","\u002Fconcepts\u002Fstock-identity-vs-authendpoints","5.concepts\u002F2.stock-identity-vs-authendpoints","i-lucide-columns-2",{"title":236,"path":237,"stem":238,"icon":239},"MapIdentityApi alternative","\u002Fconcepts\u002Fmapidentityapi-alternative","5.concepts\u002F3.mapidentityapi-alternative","i-lucide-arrow-left-right",{"title":241,"path":242,"stem":243,"icon":244},"Security model","\u002Fconcepts\u002Fsecurity-model","5.concepts\u002F4.security-model","i-lucide-shield",{"title":246,"path":247,"stem":248,"icon":249},"FAQ","\u002Fconcepts\u002Ffaq","5.concepts\u002F5.faq","i-lucide-circle-help",{"id":251,"title":252,"body":253,"description":1430,"extension":1431,"faq":218,"links":1432,"meta":1433,"navigation":1434,"path":34,"seo":1435,"stem":35,"__hash__":1436},"docs\u002F1.getting-started\u002F6.password-auth.md","Password auth: one session under \u002Fauth",{"type":254,"value":255,"toc":1423},"minimark",[256,268,309,332,337,418,452,459,463,478,641,663,672,676,704,727,745,768,772,779,1155,1158,1278,1281,1316,1319,1359,1384,1388,1419],[257,258,259,263,264,267],"p",{},[260,261,262],"code",{},"AddPasswordAuth\u003CTUser, TContext>"," and ",[260,265,266],{},"MapPasswordAuth\u003CTUser>"," are the password facade. One call registers Identity, password sign-up, sign-in, and recovery, account management, and one session. Cookie is the default. JWT is the other session. The facade adds no routes of its own. It expands to the building-block calls on this page.",[257,269,270,273,274,277,278,273,281,284,285,289,290,293,294,297,298,300,301,304,305,308],{},[260,271,272],{},"TUser"," is a ",[260,275,276],{},"class"," with a public parameterless constructor. ",[260,279,280],{},"TContext",[260,282,283],{},"DbContext",". There is no role overload. Identity bearer stays on the ",[286,287,38],"a",{"href":288},"\u002Fgetting-started\u002Fcompatibility-facade\u002F",". Do not call both facades in one host. Calling ",[260,291,292],{},"AddPasswordAuth"," twice throws. ",[260,295,296],{},"MapPasswordAuth"," without ",[260,299,292],{}," throws ",[260,302,303],{},"InvalidOperationException",". The message is in ",[286,306,126],{"href":307},"\u002Fcomposables\u002F#what-you-compose",".",[257,310,311,312,316,317,320,321,263,324,327,328,308],{},"The tutorial is the ",[286,313,315],{"href":314},"\u002Fgetting-started\u002Fquick-start\u002F","quick start",". Options are in ",[286,318,187],{"href":319},"\u002Fmodules\u002Fconfiguration\u002F#passwordauthoptions",". Routes for each ",[260,322,323],{},"Add*",[260,325,326],{},"Map*"," pair are in the ",[286,329,331],{"href":330},"\u002Fcomposables\u002Fcomposition\u002F","composition table",[333,334,336],"h2",{"id":335},"cookie-session","Cookie session",[338,339,344],"pre",{"className":340,"code":341,"language":342,"meta":343,"style":343},"language-cs shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","builder.Services.AddPasswordAuth\u003CAppUser, AppDbContext>();\n\napp.UseAuthEndpoints();\napp.MapPasswordAuth\u003CAppUser>();\n","cs","",[260,345,346,382,389,403],{"__ignoreMap":343},[347,348,351,355,358,361,363,366,369,373,376,379],"span",{"class":349,"line":350},"line",1,[347,352,354],{"class":353},"sTEyZ","builder",[347,356,308],{"class":357},"sMK4o",[347,359,360],{"class":353},"Services",[347,362,308],{"class":357},[347,364,292],{"class":365},"s2Zo4",[347,367,368],{"class":357},"\u003C",[347,370,372],{"class":371},"sBMFI","AppUser",[347,374,375],{"class":357},",",[347,377,378],{"class":371}," AppDbContext",[347,380,381],{"class":357},">();\n",[347,383,385],{"class":349,"line":384},2,[347,386,388],{"emptyLinePlaceholder":387},true,"\n",[347,390,392,395,397,400],{"class":349,"line":391},3,[347,393,394],{"class":353},"app",[347,396,308],{"class":357},[347,398,399],{"class":365},"UseAuthEndpoints",[347,401,402],{"class":357},"();\n",[347,404,406,408,410,412,414,416],{"class":349,"line":405},4,[347,407,394],{"class":353},[347,409,308],{"class":357},[347,411,296],{"class":365},[347,413,368],{"class":357},[347,415,372],{"class":371},[347,417,381],{"class":357},[257,419,420,421,424,425,428,429,432,433,436,437,440,441,444,445,448,449,308],{},"Every route is under ",[260,422,423],{},"\u002Fauth"," (",[260,426,427],{},"PasswordAuthOptions.Path","). Password sign-in is ",[260,430,431],{},"POST \u002Fauth\u002Flogin",". It does not use antiforgery. ",[260,434,435],{},"GET \u002Fauth\u002FcsrfToken"," issues the token for logout, manage ",[260,438,439],{},"POST"," routes, and step-up. ",[260,442,443],{},"RequireConfirmedAccount"," defaults to ",[260,446,447],{},"true",", so login before confirm is ",[260,450,451],{},"401",[257,453,454,455,458],{},"Passkeys stay off until ",[260,456,457],{},"Passkeys.ServerDomain"," is set. Email-code sign-in and external sign-in are not mapped.",[333,460,462],{"id":461},"jwt-session","JWT session",[257,464,465,466,469,470,473,474,477],{},"Set ",[260,467,468],{},"Session"," to ",[260,471,472],{},"AuthEndpointsSession.Jwt"," and pass ",[260,475,476],{},"Jwt",". The callback is required. A missing signing key fails while the host is being built.",[338,479,481],{"className":340,"code":480,"language":342,"meta":343,"style":343},"builder.Services.AddPasswordAuth\u003CAppUser, AppDbContext>(o =>\n{\n    o.Session = AuthEndpointsSession.Jwt;\n    o.Jwt = jwt =>\n    {\n        jwt.Issuer = \"https:\u002F\u002Fexample.com\";\n        jwt.Audience = \"https:\u002F\u002Fexample.com\";\n        jwt.SigningOptions.SymmetricKey = key;\n    };\n});\n",[260,482,483,512,517,540,556,562,587,607,629,635],{"__ignoreMap":343},[347,484,485,487,489,491,493,495,497,499,501,503,506,509],{"class":349,"line":350},[347,486,354],{"class":353},[347,488,308],{"class":357},[347,490,360],{"class":353},[347,492,308],{"class":357},[347,494,292],{"class":365},[347,496,368],{"class":357},[347,498,372],{"class":371},[347,500,375],{"class":357},[347,502,378],{"class":371},[347,504,505],{"class":357},">(",[347,507,508],{"class":371},"o",[347,510,511],{"class":357}," =>\n",[347,513,514],{"class":349,"line":384},[347,515,516],{"class":357},"{\n",[347,518,519,522,524,527,530,533,535,537],{"class":349,"line":391},[347,520,521],{"class":353},"    o",[347,523,308],{"class":357},[347,525,526],{"class":353},"Session ",[347,528,529],{"class":357},"=",[347,531,532],{"class":353}," AuthEndpointsSession",[347,534,308],{"class":357},[347,536,476],{"class":353},[347,538,539],{"class":357},";\n",[347,541,542,544,546,549,551,554],{"class":349,"line":405},[347,543,521],{"class":353},[347,545,308],{"class":357},[347,547,548],{"class":353},"Jwt ",[347,550,529],{"class":357},[347,552,553],{"class":371}," jwt",[347,555,511],{"class":357},[347,557,559],{"class":349,"line":558},5,[347,560,561],{"class":357},"    {\n",[347,563,565,568,570,573,575,578,582,585],{"class":349,"line":564},6,[347,566,567],{"class":353},"        jwt",[347,569,308],{"class":357},[347,571,572],{"class":353},"Issuer ",[347,574,529],{"class":357},[347,576,577],{"class":357}," \"",[347,579,581],{"class":580},"sfazB","https:\u002F\u002Fexample.com",[347,583,584],{"class":357},"\"",[347,586,539],{"class":357},[347,588,590,592,594,597,599,601,603,605],{"class":349,"line":589},7,[347,591,567],{"class":353},[347,593,308],{"class":357},[347,595,596],{"class":353},"Audience ",[347,598,529],{"class":357},[347,600,577],{"class":357},[347,602,581],{"class":580},[347,604,584],{"class":357},[347,606,539],{"class":357},[347,608,610,612,614,617,619,622,624,627],{"class":349,"line":609},8,[347,611,567],{"class":353},[347,613,308],{"class":357},[347,615,616],{"class":353},"SigningOptions",[347,618,308],{"class":357},[347,620,621],{"class":353},"SymmetricKey ",[347,623,529],{"class":357},[347,625,626],{"class":353}," key",[347,628,539],{"class":357},[347,630,632],{"class":349,"line":631},9,[347,633,634],{"class":357},"    };\n",[347,636,638],{"class":349,"line":637},10,[347,639,640],{"class":357},"});\n",[257,642,643,644,647,648,650,651,655,656,658,659,662],{},"Password sign-in is ",[260,645,646],{},"POST \u002Fauth\u002Fcreate",", not ",[260,649,431],{},". Refresh transport, the refresh cookie, and body transport are in ",[286,652,654],{"href":653},"\u002Fmodules\u002Fjwt\u002F#options","JWT",". The ",[260,657,283],{}," calls ",[260,660,661],{},"UseRefreshToken()",", and you add a migration before production.",[257,664,665,667,668,671],{},[260,666,468],{}," ",[260,669,670],{},"IdentityBearer"," fails startup validation.",[333,673,675],{"id":674},"what-the-map-includes","What the map includes",[257,677,678,679,682,683,686,687,690,691,690,694,690,697,690,700,703],{},"Cookie session maps register, ",[260,680,681],{},"POST \u002Flogin",", forgot-password, reset-password, logout, ",[260,684,685],{},"GET \u002FcsrfToken",", confirm-email, resend, and account management (",[260,688,689],{},"\u002Fmanage\u002Finfo",", ",[260,692,693],{},"\u002Fmanage\u002F2fa",[260,695,696],{},"\u002Fmanage\u002FauthMethods",[260,698,699],{},"\u002Fmanage\u002Fpassword",[260,701,702],{},"\u002FconfirmIdentity",").",[257,705,706,707,690,710,690,713,716,717,720,721,723,724,726],{},"JWT session uses the same management, recovery, and confirm-email routes. It maps ",[260,708,709],{},"POST \u002Fcreate",[260,711,712],{},"POST \u002Frefresh",[260,714,715],{},"GET \u002Fverify",", and ",[260,718,719],{},"POST \u002Flogout"," instead of ",[260,722,681],{},". Cookie refresh also maps ",[260,725,685],{},". Body refresh omits that route.",[257,728,729,730,732,733,736,737,740,741,308],{},"When ",[260,731,457],{}," is set, the same prefix also maps passkey sign-in and passkey management, plus ",[260,734,735],{},"POST \u002FconfirmIdentity\u002FpasskeyOptions",". Passkey sign-in includes ",[260,738,739],{},"POST \u002Fpasskeys\u002Fregister",". See ",[286,742,744],{"href":743},"\u002Fmodules\u002Fpasskeys\u002F#map","Passkeys",[257,746,747,690,749,716,752,754,755,757,758,761,762,765,766,308],{},[260,748,468],{},[260,750,751],{},"Path",[260,753,457],{}," are fixed by the ",[260,756,292],{}," callback. A later ",[260,759,760],{},"Configure\u003CPasswordAuthOptions>"," that changes any of them fails validation. ",[260,763,764],{},"EmailConfirmation"," can still be configured later. The option table is in ",[286,767,187],{"href":319},[333,769,771],{"id":770},"building-block-expansion","Building-block expansion",[257,773,774,263,776,778],{},[260,775,292],{},[260,777,296],{}," expand to these calls. Copy them when you leave the facade.",[338,780,782],{"className":340,"code":781,"language":342,"meta":343,"style":343},"services.AddAuthEndpointsIdentity\u003CTUser, TContext>(identity =>\n{\n    identity.SignIn.RequireConfirmedAccount = options.RequireConfirmedAccount;\n    options.ConfigureIdentity?.Invoke(identity);\n});\nservices.AddPasswordSignUpEndpoints();\nservices.AddPasswordSignInEndpoints();\nservices.AddPasswordRecoveryEndpoints();\nservices.AddAccountManagementEndpoints();\n\n\u002F\u002F Cookie session:\nservices.AddCookieSessionEndpoints();\n\n\u002F\u002F JWT session (options.Jwt is required).\n\u002F\u002F AddJwtEndpoints copies a non-default SimpleJwtOptions.RefreshTokenTransport.\nservices.AddJwtEndpoints\u003CTUser, TContext>(options.Jwt);\n\n\u002F\u002F When Passkeys.ServerDomain is set:\nservices.AddPasskeyEndpoints\u003CTUser>();\nservices.Configure\u003CIdentityPasskeyOptions>(passkeys => passkeys.ServerDomain = options.Passkeys.ServerDomain);\n\n\u002F\u002F Confirm-email redirect, read by the shared handler:\nservices.Configure\u003CAuthEndpointsOptions>(auth =>\n{\n    auth.EmailConfirmation.ConfirmEmailRedirectUri = options.EmailConfirmation.ConfirmEmailRedirectUri;\n    auth.EmailConfirmation.AllowedRedirectOrigins = options.EmailConfirmation.AllowedRedirectOrigins;\n});\n",[260,783,784,810,814,840,864,868,879,890,901,912,916,923,935,940,946,952,981,986,992,1008,1054,1059,1065,1086,1091,1121,1150],{"__ignoreMap":343},[347,785,786,789,791,794,796,798,800,803,805,808],{"class":349,"line":350},[347,787,788],{"class":353},"services",[347,790,308],{"class":357},[347,792,793],{"class":365},"AddAuthEndpointsIdentity",[347,795,368],{"class":357},[347,797,272],{"class":371},[347,799,375],{"class":357},[347,801,802],{"class":371}," TContext",[347,804,505],{"class":357},[347,806,807],{"class":371},"identity",[347,809,511],{"class":357},[347,811,812],{"class":349,"line":384},[347,813,516],{"class":357},[347,815,816,819,821,824,826,829,831,834,836,838],{"class":349,"line":391},[347,817,818],{"class":353},"    identity",[347,820,308],{"class":357},[347,822,823],{"class":353},"SignIn",[347,825,308],{"class":357},[347,827,828],{"class":353},"RequireConfirmedAccount ",[347,830,529],{"class":357},[347,832,833],{"class":353}," options",[347,835,308],{"class":357},[347,837,443],{"class":353},[347,839,539],{"class":357},[347,841,842,845,847,850,853,856,859,861],{"class":349,"line":405},[347,843,844],{"class":353},"    options",[347,846,308],{"class":357},[347,848,849],{"class":353},"ConfigureIdentity",[347,851,852],{"class":357},"?.",[347,854,855],{"class":365},"Invoke",[347,857,858],{"class":357},"(",[347,860,807],{"class":353},[347,862,863],{"class":357},");\n",[347,865,866],{"class":349,"line":558},[347,867,640],{"class":357},[347,869,870,872,874,877],{"class":349,"line":564},[347,871,788],{"class":353},[347,873,308],{"class":357},[347,875,876],{"class":365},"AddPasswordSignUpEndpoints",[347,878,402],{"class":357},[347,880,881,883,885,888],{"class":349,"line":589},[347,882,788],{"class":353},[347,884,308],{"class":357},[347,886,887],{"class":365},"AddPasswordSignInEndpoints",[347,889,402],{"class":357},[347,891,892,894,896,899],{"class":349,"line":609},[347,893,788],{"class":353},[347,895,308],{"class":357},[347,897,898],{"class":365},"AddPasswordRecoveryEndpoints",[347,900,402],{"class":357},[347,902,903,905,907,910],{"class":349,"line":631},[347,904,788],{"class":353},[347,906,308],{"class":357},[347,908,909],{"class":365},"AddAccountManagementEndpoints",[347,911,402],{"class":357},[347,913,914],{"class":349,"line":637},[347,915,388],{"emptyLinePlaceholder":387},[347,917,919],{"class":349,"line":918},11,[347,920,922],{"class":921},"sHwdD","\u002F\u002F Cookie session:\n",[347,924,926,928,930,933],{"class":349,"line":925},12,[347,927,788],{"class":353},[347,929,308],{"class":357},[347,931,932],{"class":365},"AddCookieSessionEndpoints",[347,934,402],{"class":357},[347,936,938],{"class":349,"line":937},13,[347,939,388],{"emptyLinePlaceholder":387},[347,941,943],{"class":349,"line":942},14,[347,944,945],{"class":921},"\u002F\u002F JWT session (options.Jwt is required).\n",[347,947,949],{"class":349,"line":948},15,[347,950,951],{"class":921},"\u002F\u002F AddJwtEndpoints copies a non-default SimpleJwtOptions.RefreshTokenTransport.\n",[347,953,955,957,959,962,964,966,968,970,972,975,977,979],{"class":349,"line":954},16,[347,956,788],{"class":353},[347,958,308],{"class":357},[347,960,961],{"class":365},"AddJwtEndpoints",[347,963,368],{"class":357},[347,965,272],{"class":371},[347,967,375],{"class":357},[347,969,802],{"class":371},[347,971,505],{"class":357},[347,973,974],{"class":353},"options",[347,976,308],{"class":357},[347,978,476],{"class":353},[347,980,863],{"class":357},[347,982,984],{"class":349,"line":983},17,[347,985,388],{"emptyLinePlaceholder":387},[347,987,989],{"class":349,"line":988},18,[347,990,991],{"class":921},"\u002F\u002F When Passkeys.ServerDomain is set:\n",[347,993,995,997,999,1002,1004,1006],{"class":349,"line":994},19,[347,996,788],{"class":353},[347,998,308],{"class":357},[347,1000,1001],{"class":365},"AddPasskeyEndpoints",[347,1003,368],{"class":357},[347,1005,272],{"class":371},[347,1007,381],{"class":357},[347,1009,1011,1013,1015,1018,1020,1023,1025,1028,1031,1034,1036,1039,1041,1043,1045,1047,1049,1052],{"class":349,"line":1010},20,[347,1012,788],{"class":353},[347,1014,308],{"class":357},[347,1016,1017],{"class":365},"Configure",[347,1019,368],{"class":357},[347,1021,1022],{"class":371},"IdentityPasskeyOptions",[347,1024,505],{"class":357},[347,1026,1027],{"class":371},"passkeys",[347,1029,1030],{"class":357}," =>",[347,1032,1033],{"class":353}," passkeys",[347,1035,308],{"class":357},[347,1037,1038],{"class":353},"ServerDomain ",[347,1040,529],{"class":357},[347,1042,833],{"class":353},[347,1044,308],{"class":357},[347,1046,744],{"class":353},[347,1048,308],{"class":357},[347,1050,1051],{"class":353},"ServerDomain",[347,1053,863],{"class":357},[347,1055,1057],{"class":349,"line":1056},21,[347,1058,388],{"emptyLinePlaceholder":387},[347,1060,1062],{"class":349,"line":1061},22,[347,1063,1064],{"class":921},"\u002F\u002F Confirm-email redirect, read by the shared handler:\n",[347,1066,1068,1070,1072,1074,1076,1079,1081,1084],{"class":349,"line":1067},23,[347,1069,788],{"class":353},[347,1071,308],{"class":357},[347,1073,1017],{"class":365},[347,1075,368],{"class":357},[347,1077,1078],{"class":371},"AuthEndpointsOptions",[347,1080,505],{"class":357},[347,1082,1083],{"class":371},"auth",[347,1085,511],{"class":357},[347,1087,1089],{"class":349,"line":1088},24,[347,1090,516],{"class":357},[347,1092,1094,1097,1099,1101,1103,1106,1108,1110,1112,1114,1116,1119],{"class":349,"line":1093},25,[347,1095,1096],{"class":353},"    auth",[347,1098,308],{"class":357},[347,1100,764],{"class":353},[347,1102,308],{"class":357},[347,1104,1105],{"class":353},"ConfirmEmailRedirectUri ",[347,1107,529],{"class":357},[347,1109,833],{"class":353},[347,1111,308],{"class":357},[347,1113,764],{"class":353},[347,1115,308],{"class":357},[347,1117,1118],{"class":353},"ConfirmEmailRedirectUri",[347,1120,539],{"class":357},[347,1122,1124,1126,1128,1130,1132,1135,1137,1139,1141,1143,1145,1148],{"class":349,"line":1123},26,[347,1125,1096],{"class":353},[347,1127,308],{"class":357},[347,1129,764],{"class":353},[347,1131,308],{"class":357},[347,1133,1134],{"class":353},"AllowedRedirectOrigins ",[347,1136,529],{"class":357},[347,1138,833],{"class":353},[347,1140,308],{"class":357},[347,1142,764],{"class":353},[347,1144,308],{"class":357},[347,1146,1147],{"class":353},"AllowedRedirectOrigins",[347,1149,539],{"class":357},[347,1151,1153],{"class":349,"line":1152},27,[347,1154,640],{"class":357},[257,1156,1157],{},"Map under one group. Cookie session:",[338,1159,1161],{"className":340,"code":1160,"language":342,"meta":343,"style":343},"var group = app.MapGroup(\"\u002Fauth\");\ngroup.MapPasswordSignUpEndpoints\u003CTUser>();\ngroup.MapPasswordSignInEndpoints\u003CTUser>(AuthEndpointsSession.Cookie);\ngroup.MapPasswordRecoveryEndpoints\u003CTUser>();\ngroup.MapCookieSessionEndpoints\u003CTUser>();\ngroup.MapAccountManagementEndpoints\u003CTUser>();\n",[260,1162,1163,1192,1208,1233,1248,1263],{"__ignoreMap":343},[347,1164,1165,1168,1171,1174,1177,1179,1182,1184,1186,1188,1190],{"class":349,"line":350},[347,1166,1167],{"class":371},"var",[347,1169,1170],{"class":371}," group",[347,1172,1173],{"class":357}," =",[347,1175,1176],{"class":353}," app",[347,1178,308],{"class":357},[347,1180,1181],{"class":365},"MapGroup",[347,1183,858],{"class":357},[347,1185,584],{"class":357},[347,1187,423],{"class":580},[347,1189,584],{"class":357},[347,1191,863],{"class":357},[347,1193,1194,1197,1199,1202,1204,1206],{"class":349,"line":384},[347,1195,1196],{"class":353},"group",[347,1198,308],{"class":357},[347,1200,1201],{"class":365},"MapPasswordSignUpEndpoints",[347,1203,368],{"class":357},[347,1205,272],{"class":371},[347,1207,381],{"class":357},[347,1209,1210,1212,1214,1217,1219,1221,1223,1226,1228,1231],{"class":349,"line":391},[347,1211,1196],{"class":353},[347,1213,308],{"class":357},[347,1215,1216],{"class":365},"MapPasswordSignInEndpoints",[347,1218,368],{"class":357},[347,1220,272],{"class":371},[347,1222,505],{"class":357},[347,1224,1225],{"class":353},"AuthEndpointsSession",[347,1227,308],{"class":357},[347,1229,1230],{"class":353},"Cookie",[347,1232,863],{"class":357},[347,1234,1235,1237,1239,1242,1244,1246],{"class":349,"line":405},[347,1236,1196],{"class":353},[347,1238,308],{"class":357},[347,1240,1241],{"class":365},"MapPasswordRecoveryEndpoints",[347,1243,368],{"class":357},[347,1245,272],{"class":371},[347,1247,381],{"class":357},[347,1249,1250,1252,1254,1257,1259,1261],{"class":349,"line":558},[347,1251,1196],{"class":353},[347,1253,308],{"class":357},[347,1255,1256],{"class":365},"MapCookieSessionEndpoints",[347,1258,368],{"class":357},[347,1260,272],{"class":371},[347,1262,381],{"class":357},[347,1264,1265,1267,1269,1272,1274,1276],{"class":349,"line":564},[347,1266,1196],{"class":353},[347,1268,308],{"class":357},[347,1270,1271],{"class":365},"MapAccountManagementEndpoints",[347,1273,368],{"class":357},[347,1275,272],{"class":371},[347,1277,381],{"class":357},[257,1279,1280],{},"JWT session replaces the sign-in and session lines:",[338,1282,1284],{"className":340,"code":1283,"language":342,"meta":343,"style":343},"group.MapJwtPasswordEndpoints\u003CTUser>();\ngroup.MapJwtSessionEndpoints\u003CTUser>();\n",[260,1285,1286,1301],{"__ignoreMap":343},[347,1287,1288,1290,1292,1295,1297,1299],{"class":349,"line":350},[347,1289,1196],{"class":353},[347,1291,308],{"class":357},[347,1293,1294],{"class":365},"MapJwtPasswordEndpoints",[347,1296,368],{"class":357},[347,1298,272],{"class":371},[347,1300,381],{"class":357},[347,1302,1303,1305,1307,1310,1312,1314],{"class":349,"line":384},[347,1304,1196],{"class":353},[347,1306,308],{"class":357},[347,1308,1309],{"class":365},"MapJwtSessionEndpoints",[347,1311,368],{"class":357},[347,1313,272],{"class":371},[347,1315,381],{"class":357},[257,1317,1318],{},"When passkeys are on, the same group also calls:",[338,1320,1322],{"className":340,"code":1321,"language":342,"meta":343,"style":343},"group.MapPasskeySignInEndpoints\u003CTUser>(session);\ngroup.MapPasskeyManagementEndpoints\u003CTUser>();\n",[260,1323,1324,1344],{"__ignoreMap":343},[347,1325,1326,1328,1330,1333,1335,1337,1339,1342],{"class":349,"line":350},[347,1327,1196],{"class":353},[347,1329,308],{"class":357},[347,1331,1332],{"class":365},"MapPasskeySignInEndpoints",[347,1334,368],{"class":357},[347,1336,272],{"class":371},[347,1338,505],{"class":357},[347,1340,1341],{"class":353},"session",[347,1343,863],{"class":357},[347,1345,1346,1348,1350,1353,1355,1357],{"class":349,"line":384},[347,1347,1196],{"class":353},[347,1349,308],{"class":357},[347,1351,1352],{"class":365},"MapPasskeyManagementEndpoints",[347,1354,368],{"class":357},[347,1356,272],{"class":371},[347,1358,381],{"class":357},[257,1360,1361,1363,1364,1367,1368,1370,1371,1374,1375,1377,1378,263,1381,308],{},[260,1362,1341],{}," is ",[260,1365,1366],{},"AuthEndpointsSession.Cookie"," or ",[260,1369,472],{},". Do not also call ",[260,1372,1373],{},"MapPasskeyRegisterOptionsEndpoints",". ",[260,1376,1332],{}," already maps ",[260,1379,1380],{},"register\u002Foptions",[260,1382,1383],{},"register",[333,1385,1387],{"id":1386},"related","Related",[1389,1390,1391,1396,1401,1405,1410,1415],"ul",{},[1392,1393,1394],"li",{},[286,1395,18],{"href":314},[1392,1397,1398],{},[286,1399,23],{"href":1400},"\u002Fgetting-started\u002Fchoose-a-sign-in-stack\u002F",[1392,1402,1403],{},[286,1404,38],{"href":288},[1392,1406,1407],{},[286,1408,1409],{"href":330},"Composition table",[1392,1411,1412],{},[286,1413,110],{"href":1414},"\u002Fguides\u002Fupgrading-to-4\u002F",[1392,1416,1417],{},[286,1418,187],{"href":319},[1420,1421,1422],"style",{},"html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}",{"title":343,"searchDepth":350,"depth":384,"links":1424},[1425,1426,1427,1428,1429],{"id":335,"depth":384,"text":336},{"id":461,"depth":384,"text":462},{"id":674,"depth":384,"text":675},{"id":770,"depth":384,"text":771},{"id":1386,"depth":384,"text":1387},"What AddPasswordAuth and MapPasswordAuth register and map, and the building-block calls they expand to.","md",null,{},{"title":33,"icon":36},{"title":252,"description":1430},"7FJ6SkxASdChcL4aGqEvzapiB-QmetMEYUKf_y5niak",[1438,1440],{"title":28,"path":29,"stem":30,"description":1439,"icon":31,"children":-1},"Add the AuthEndpoints skill to your app so that coding agents follow the library's conventions.",{"title":38,"path":39,"stem":40,"description":1441,"icon":41,"children":-1},"AddAuthEndpoints and MapAuthEndpoints keep the 3.4.1 options, the AuthEndpointsSignIn values, and the \u002Fidentity, \u002Faccount, and \u002Fauth routes.",1792054254623]