[{"data":1,"prerenderedAt":654},["ShallowReactive",2],{"navigation":3,"\u002Fmodules\u002Fbearer-auth":203,"\u002Fmodules\u002Fbearer-auth-surround":649},[4,33,96,114,177],{"title":5,"path":6,"stem":7,"children":8,"icon":32},"Get started","\u002Fgetting-started","1.getting-started\u002F1.index",[9,12,17,22,27],{"title":10,"path":6,"stem":7,"icon":11},"Introduction","i-lucide-house",{"title":13,"path":14,"stem":15,"icon":16},"Install AuthEndpoints","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F2.installation","i-lucide-download",{"title":18,"path":19,"stem":20,"icon":21},"Quick start","\u002Fgetting-started\u002Fquick-start","1.getting-started\u002F3.quick-start","i-lucide-play",{"title":23,"path":24,"stem":25,"icon":26},"Choose a sign-in stack","\u002Fgetting-started\u002Fchoose-a-sign-in-stack","1.getting-started\u002F4.choose-a-sign-in-stack","i-lucide-signpost",{"title":28,"path":29,"stem":30,"icon":31},"Use the AuthEndpoints skill with coding agents","\u002Fgetting-started\u002Fai-agents","1.getting-started\u002F5.ai-agents","i-lucide-bot","i-lucide-rocket",{"title":34,"path":35,"stem":36,"children":37,"icon":95},"Guides","\u002Fguides","2.guides\u002F01.index",[38,40,45,50,55,60,65,70,75,80,85,90],{"title":34,"path":35,"stem":36,"icon":39},"i-lucide-list-checks",{"title":41,"path":42,"stem":43,"icon":44},"Register users","\u002Fguides\u002Fregistration","2.guides\u002F02.registration","i-lucide-user-plus",{"title":46,"path":47,"stem":48,"icon":49},"Sign users in","\u002Fguides\u002Fsign-in","2.guides\u002F03.sign-in","i-lucide-log-in",{"title":51,"path":52,"stem":53,"icon":54},"Sign users out","\u002Fguides\u002Fsign-out","2.guides\u002F04.sign-out","i-lucide-log-out",{"title":56,"path":57,"stem":58,"icon":59},"Turn on two-factor authentication","\u002Fguides\u002Ftwo-factor","2.guides\u002F05.two-factor","i-lucide-smartphone",{"title":61,"path":62,"stem":63,"icon":64},"Reset a forgotten password","\u002Fguides\u002Freset-password","2.guides\u002F06.reset-password","i-lucide-key-round",{"title":66,"path":67,"stem":68,"icon":69},"Change a user's email or password","\u002Fguides\u002Fmanage-account","2.guides\u002F07.manage-account","i-lucide-user-cog",{"title":71,"path":72,"stem":73,"icon":74},"Add, rename, and remove passkeys","\u002Fguides\u002Fmanage-passkeys","2.guides\u002F08.manage-passkeys","i-lucide-scan-face",{"title":76,"path":77,"stem":78,"icon":79},"Link and unlink GitHub or Google accounts","\u002Fguides\u002Flink-external-accounts","2.guides\u002F09.link-external-accounts","i-lucide-link",{"title":81,"path":82,"stem":83,"icon":84},"Require step-up before sensitive actions","\u002Fguides\u002Fstep-up","2.guides\u002F10.step-up","i-lucide-shield-check",{"title":86,"path":87,"stem":88,"icon":89},"Call the API from a browser","\u002Fguides\u002Fbrowser-clients","2.guides\u002F11.browser-clients","i-lucide-globe",{"title":91,"path":92,"stem":93,"icon":94},"Prepare for production","\u002Fguides\u002Fproduction","2.guides\u002F12.production","i-lucide-factory","i-lucide-waypoints",{"title":97,"path":98,"stem":99,"children":100,"icon":113},"Composable endpoints","\u002Fcomposables","3.composables\u002F1.index",[101,104,108],{"title":102,"path":98,"stem":99,"icon":103},"How composition works","i-lucide-layout-grid",{"title":105,"path":106,"stem":107,"icon":39},"Composition requirements","\u002Fcomposables\u002Frequirements","3.composables\u002F2.requirements",{"title":109,"path":110,"stem":111,"icon":112},"Compose a custom auth stack","\u002Fcomposables\u002Frecipes","3.composables\u002F3.recipes","i-lucide-book-marked","i-lucide-blocks",{"title":115,"icon":116,"path":117,"stem":118,"children":119,"page":176},"Reference","i-lucide-book-open","\u002Fmodules","4.modules",[120,125,129,134,139,144,148,153,157,162,166,171],{"title":121,"path":122,"stem":123,"icon":124},"Endpoint reference","\u002Fmodules\u002Fendpoints","4.modules\u002F01.endpoints","i-lucide-route",{"title":126,"path":127,"stem":128,"icon":69},"Identity management module","\u002Fmodules\u002Fidentity-management","4.modules\u002F02.identity-management",{"title":130,"path":131,"stem":132,"icon":133},"Cookie sign-in module","\u002Fmodules\u002Fcookie-auth","4.modules\u002F03.cookie-auth","i-lucide-cookie",{"title":135,"path":136,"stem":137,"icon":138},"Identity bearer sign-in module","\u002Fmodules\u002Fbearer-auth","4.modules\u002F04.bearer-auth","i-lucide-key",{"title":140,"path":141,"stem":142,"icon":143},"JWT module","\u002Fmodules\u002Fjwt","4.modules\u002F05.jwt","i-lucide-fingerprint",{"title":145,"path":146,"stem":147,"icon":74},"Passkeys module","\u002Fmodules\u002Fpasskeys","4.modules\u002F06.passkeys",{"title":149,"path":150,"stem":151,"icon":152},"ReAuth module","\u002Fmodules\u002Freauth","4.modules\u002F07.reauth","i-lucide-shield-alert",{"title":154,"path":155,"stem":156,"icon":49},"External OAuth packages","\u002Fmodules\u002Fexternal-oauth","4.modules\u002F08.external-oauth",{"title":158,"path":159,"stem":160,"icon":161},"Configuration options","\u002Fmodules\u002Fconfiguration","4.modules\u002F09.configuration","i-lucide-settings",{"title":163,"path":164,"stem":165,"icon":84},"Antiforgery (CSRF) rules","\u002Fmodules\u002Fcsrf","4.modules\u002F10.csrf",{"title":167,"path":168,"stem":169,"icon":170},"Responses and errors","\u002Fmodules\u002Ferrors","4.modules\u002F11.errors","i-lucide-circle-alert",{"title":172,"path":173,"stem":174,"icon":175},"Rate-limit policies","\u002Fmodules\u002Frate-limits","4.modules\u002F12.rate-limits","i-lucide-gauge",false,{"title":178,"icon":179,"path":180,"stem":181,"children":182,"page":176},"Concepts","i-lucide-lightbulb","\u002Fconcepts","5.concepts",[183,188,193,198],{"title":184,"path":185,"stem":186,"icon":187},"AuthEndpoints compared with other options","\u002Fconcepts\u002Fcompare","5.concepts\u002F1.compare","i-lucide-git-compare",{"title":189,"path":190,"stem":191,"icon":192},"Stock Identity endpoints vs AuthEndpoints","\u002Fconcepts\u002Fstock-identity-vs-authendpoints","5.concepts\u002F2.stock-identity-vs-authendpoints","i-lucide-columns-2",{"title":194,"path":195,"stem":196,"icon":197},"Security model","\u002Fconcepts\u002Fsecurity-model","5.concepts\u002F3.security-model","i-lucide-shield",{"title":199,"path":200,"stem":201,"icon":202},"FAQ","\u002Fconcepts\u002Ffaq","5.concepts\u002F4.faq","i-lucide-circle-help",{"id":204,"title":135,"body":205,"description":642,"extension":643,"links":644,"meta":645,"navigation":646,"path":136,"seo":647,"stem":137,"__hash__":648},"docs\u002F4.modules\u002F04.bearer-auth.md",{"type":206,"value":207,"toc":631},"minimark",[208,223,250,255,298,302,338,342,384,393,397,463,467,486,532,553,557,566,570,577,604,608,627],[209,210,211,212,216,217,222],"p",{},"ASP.NET Core Identity ",[213,214,215],"strong",{},"bearer token"," sign-in (not JWT). Pair with ",[218,219,221],"a",{"href":220},"\u002Fmodules\u002Fidentity-management\u002F","Identity management",".",[209,224,225,226,230,231,234,235,238,239,242,243,246,247,222],{},"This module maps Identity ",[227,228,229],"code",{},"Login",". The cookie facade does ",[213,232,233],{},"not"," map these routes. Use ",[227,236,237],{},"AddAuthEndpoints"," with ",[227,240,241],{},"AuthEndpointsSignIn.IdentityBearer",", or compose ",[227,244,245],{},"AddBearerAuthEndpoints"," and ",[227,248,249],{},"MapBearerAuthEndpoints",[251,252,254],"h2",{"id":253},"when-to-choose-bearer-vs-jwt","When to choose bearer vs JWT",[256,257,258,271],"table",{},[259,260,261],"thead",{},[262,263,264,268],"tr",{},[265,266,267],"th",{},"Stack",[265,269,270],{},"Use when",[272,273,274,285],"tbody",{},[262,275,276,282],{},[277,278,279],"td",{},[213,280,281],{},"Identity bearer",[277,283,284],{},"You want Identity's built-in access\u002Frefresh token format",[262,286,287,295],{},[277,288,289],{},[213,290,291],{},[218,292,294],{"href":293},"\u002Fmodules\u002Fjwt\u002F","JWT",[277,296,297],{},"You want JWT Bearer auth + HttpOnly refresh cookie with hashed storage and reuse detection",[251,299,301],{"id":300},"di","DI",[303,304,309],"pre",{"className":305,"code":306,"language":307,"meta":308,"style":308},"language-cs shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","builder.Services.AddBearerAuthEndpoints(); \u002F\u002F ReAuth schemes + rate limits\n","cs","",[227,310,311],{"__ignoreMap":308},[312,313,316,320,323,326,328,331,334],"span",{"class":314,"line":315},"line",1,[312,317,319],{"class":318},"sTEyZ","builder",[312,321,222],{"class":322},"sMK4o",[312,324,325],{"class":318},"Services",[312,327,222],{"class":322},[312,329,245],{"class":330},"s2Zo4",[312,332,333],{"class":322},"();",[312,335,337],{"class":336},"sHwdD"," \u002F\u002F ReAuth schemes + rate limits\n",[251,339,341],{"id":340},"map","Map",[303,343,345],{"className":305,"code":344,"language":307,"meta":308,"style":308},"app.MapGroup(\"\u002Fidentity\").MapBearerAuthEndpoints\u003CAppUser>();\n",[227,346,347],{"__ignoreMap":308},[312,348,349,352,354,357,360,363,367,369,372,374,377,381],{"class":314,"line":315},[312,350,351],{"class":318},"app",[312,353,222],{"class":322},[312,355,356],{"class":330},"MapGroup",[312,358,359],{"class":322},"(",[312,361,362],{"class":322},"\"",[312,364,366],{"class":365},"sfazB","\u002Fidentity",[312,368,362],{"class":322},[312,370,371],{"class":322},").",[312,373,249],{"class":330},[312,375,376],{"class":322},"\u003C",[312,378,380],{"class":379},"sBMFI","AppUser",[312,382,383],{"class":322},">();\n",[209,385,386,387,390,391,371],{},"The Identity bearer facade maps this group under ",[227,388,389],{},"IdentityPath"," (default ",[227,392,366],{},[251,394,396],{"id":395},"routes","Routes",[256,398,399,412],{},[259,400,401],{},[262,402,403,406,409],{},[265,404,405],{},"Method",[265,407,408],{},"Path",[265,410,411],{},"Notes",[272,413,414,435,449],{},[262,415,416,421,426],{},[277,417,418],{},[227,419,420],{},"POST",[277,422,423],{},[227,424,425],{},"\u002Flogin",[277,427,428,430,431,434],{},[227,429,229],{},"; Identity bearer tokens (",[227,432,433],{},"AccessTokenResponse",") when both query flags are omitted; rate-limited",[262,436,437,441,446],{},[277,438,439],{},[227,440,420],{},[277,442,443],{},[227,444,445],{},"\u002Frefresh",[277,447,448],{},"Refresh access token",[262,450,451,455,460],{},[277,452,453],{},[227,454,420],{},[277,456,457],{},[227,458,459],{},"\u002Flogout",[277,461,462],{},"Requires authorization",[251,464,466],{"id":465},"login-query-string","Login query string",[209,468,469,470,473,474,477,478,480,481,483,484,371],{},"Issues an application cookie when ",[227,471,472],{},"useCookies"," or ",[227,475,476],{},"useSessionCookies"," is true. Persistent when ",[227,479,472],{}," is true and ",[227,482,476],{}," is not true. Neither flag → Identity bearer tokens (",[227,485,433],{},[256,487,488,498],{},[259,489,490],{},[262,491,492,495],{},[265,493,494],{},"Query",[265,496,497],{},"Result",[272,499,500,508,522],{},[262,501,502,505],{},[277,503,504],{},"neither flag",[277,506,507],{},"Identity bearer tokens",[262,509,510,519],{},[277,511,512,515,516,518],{},[227,513,514],{},"useCookies=true"," (and ",[227,517,476],{}," not true)",[277,520,521],{},"persistent application cookie",[262,523,524,529],{},[277,525,526],{},[227,527,528],{},"useSessionCookies=true",[277,530,531],{},"session application cookie",[209,533,534,535,537,538,540,541,544,545,246,549,222],{},"These flags apply to ",[227,536,229],{}," and to the default passkey completer. They do ",[213,539,233],{}," apply to cookie-facade \u002F ",[227,542,543],{},"LoginCookie"," password login. See ",[218,546,548],{"href":547},"\u002Fmodules\u002Fcookie-auth\u002F","Cookie auth",[218,550,552],{"href":551},"\u002Fmodules\u002Fpasskeys\u002F","Passkeys",[251,554,556],{"id":555},"logout","Logout",[209,558,559,562,563,565],{},[227,560,561],{},"POST \u002Flogout"," requires authorization. It signs out cookies only and does ",[213,564,233],{}," revoke Identity bearer tokens. Tokens remain valid until they expire.",[251,567,569],{"id":568},"antiforgery","Antiforgery",[209,571,572,573,222],{},"The antiforgery filter skips CSRF for requests that a bearer scheme authenticates and that carry no application or external cookie. See ",[218,574,576],{"href":575},"\u002Fcomposables\u002Frequirements\u002F","Requirements",[209,578,579,581,582,585,586,589,590,589,593,596,597,600,601,222],{},[227,580,249],{}," does not map a ",[227,583,584],{},"\u002FcsrfToken"," route. Anonymous passkey ceremonies (",[227,587,588],{},"requestOptions",", ",[227,591,592],{},"login",[227,594,595],{},"register\u002Foptions",", and ",[227,598,599],{},"register",") still require a CSRF token. On a bearer host that maps passkeys, map an antiforgery token endpoint yourself. See ",[218,602,18],{"href":603},"\u002Fgetting-started\u002Fquick-start\u002F#native-and-mobile",[251,605,607],{"id":606},"related","Related",[609,610,611,616,621],"ul",{},[612,613,614],"li",{},[218,615,548],{"href":547},[612,617,618,620],{},[218,619,140],{"href":293}," for JWT",[612,622,623],{},[218,624,626],{"href":625},"\u002Fcomposables\u002Frecipes\u002F","Composable recipes",[628,629,630],"style",{},"html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}",{"title":308,"searchDepth":315,"depth":632,"links":633},2,[634,635,636,637,638,639,640,641],{"id":253,"depth":632,"text":254},{"id":300,"depth":632,"text":301},{"id":340,"depth":632,"text":341},{"id":395,"depth":632,"text":396},{"id":465,"depth":632,"text":466},{"id":555,"depth":632,"text":556},{"id":568,"depth":632,"text":569},{"id":606,"depth":632,"text":607},"Identity bearer token login, refresh, and logout endpoints.","md",null,{},{"icon":138},{"title":135,"description":642},"DGsG7QGRUwbQ5xbSRBovEk5rD1qCpBsvEsuJKOYeJ2c",[650,652],{"title":130,"path":131,"stem":132,"description":651,"icon":133,"children":-1},"Identity cookie login, logout, and CSRF token endpoints for browser\u002Fweb clients.",{"title":140,"path":141,"stem":142,"description":653,"icon":143,"children":-1},"JWT access tokens with an HttpOnly refresh cookie, hashed storage, and reuse detection.",1791123628083]