[{"data":1,"prerenderedAt":1081},["ShallowReactive",2],{"navigation":3,"\u002Fmodules\u002Fcomposition":214,"\u002Fmodules\u002Fcomposition-surround":1076},[4,43,105,113,188],{"title":5,"path":6,"stem":7,"children":8,"icon":42},"Get started","\u002Fgetting-started","1.getting-started\u002F1.index",[9,12,17,22,27,32,37],{"title":10,"path":6,"stem":7,"icon":11},"Introduction","i-lucide-house",{"title":13,"path":14,"stem":15,"icon":16},"Install","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F2.installation","i-lucide-download",{"title":18,"path":19,"stem":20,"icon":21},"Quick start","\u002Fgetting-started\u002Fquick-start","1.getting-started\u002F3.quick-start","i-lucide-play",{"title":23,"path":24,"stem":25,"icon":26},"Choose your setup","\u002Fgetting-started\u002Fchoose-a-sign-in-stack","1.getting-started\u002F4.choose-a-sign-in-stack","i-lucide-signpost",{"title":28,"path":29,"stem":30,"icon":31},"Browser clients","\u002Fgetting-started\u002Fbrowser-clients","1.getting-started\u002F5.browser-clients","i-lucide-globe",{"title":33,"path":34,"stem":35,"icon":36},"Coding agents","\u002Fgetting-started\u002Fai-agents","1.getting-started\u002F6.ai-agents","i-lucide-bot",{"title":38,"path":39,"stem":40,"icon":41},"Upgrade from 3.x","\u002Fgetting-started\u002Fupgrading-to-4","1.getting-started\u002F8.upgrading-to-4","i-lucide-arrow-up-right","i-lucide-rocket",{"title":44,"icon":45,"path":46,"stem":47,"children":48,"page":104},"Guides","i-lucide-waypoints","\u002Fguides","2.guides",[49,54,59,64,69,74,79,84,89,94,99],{"title":50,"path":51,"stem":52,"icon":53},"Register users","\u002Fguides\u002Fregistration","2.guides\u002F02.registration","i-lucide-user-plus",{"title":55,"path":56,"stem":57,"icon":58},"Sign users in","\u002Fguides\u002Fsign-in","2.guides\u002F03.sign-in","i-lucide-log-in",{"title":60,"path":61,"stem":62,"icon":63},"Sign users out","\u002Fguides\u002Fsign-out","2.guides\u002F04.sign-out","i-lucide-log-out",{"title":65,"path":66,"stem":67,"icon":68},"Two-factor auth","\u002Fguides\u002Ftwo-factor","2.guides\u002F05.two-factor","i-lucide-smartphone",{"title":70,"path":71,"stem":72,"icon":73},"Email-code sign-in","\u002Fguides\u002Femail-code","2.guides\u002F06.email-code","i-lucide-mail",{"title":75,"path":76,"stem":77,"icon":78},"Reset a password","\u002Fguides\u002Freset-password","2.guides\u002F07.reset-password","i-lucide-key-round",{"title":80,"path":81,"stem":82,"icon":83},"Manage account","\u002Fguides\u002Fmanage-account","2.guides\u002F08.manage-account","i-lucide-user-cog",{"title":85,"path":86,"stem":87,"icon":88},"Manage passkeys","\u002Fguides\u002Fmanage-passkeys","2.guides\u002F09.manage-passkeys","i-lucide-scan-face",{"title":90,"path":91,"stem":92,"icon":93},"Link accounts","\u002Fguides\u002Flink-external-accounts","2.guides\u002F10.link-external-accounts","i-lucide-link",{"title":95,"path":96,"stem":97,"icon":98},"Require step-up","\u002Fguides\u002Fstep-up","2.guides\u002F11.step-up","i-lucide-shield-check",{"title":100,"path":101,"stem":102,"icon":103},"No public sign-up","\u002Fguides\u002Finternal-app","2.guides\u002F12.internal-app","i-lucide-building-2",false,{"title":106,"path":107,"stem":108,"children":109,"icon":112},"Composables","\u002Fcomposables","3.composables\u002F1.index",[110],{"title":111,"path":107,"stem":108,"icon":112},"Build a custom stack","i-lucide-blocks",{"title":114,"icon":115,"path":116,"stem":117,"children":118,"page":104},"Reference","i-lucide-book-open","\u002Fmodules","4.modules",[119,124,128,133,137,142,147,152,156,161,165,170,174,179,184],{"title":120,"path":121,"stem":122,"icon":123},"Endpoint reference","\u002Fmodules\u002Fendpoints","4.modules\u002F01.endpoints","i-lucide-route",{"title":125,"path":126,"stem":127,"icon":78},"Password auth","\u002Fmodules\u002Fpassword-auth","4.modules\u002F02.password-auth",{"title":129,"path":130,"stem":131,"icon":132},"Composition table","\u002Fmodules\u002Fcomposition","4.modules\u002F03.composition","i-lucide-table",{"title":134,"path":135,"stem":136,"icon":83},"Identity module","\u002Fmodules\u002Fidentity-management","4.modules\u002F04.identity-management",{"title":138,"path":139,"stem":140,"icon":141},"Cookie sign-in","\u002Fmodules\u002Fcookie-auth","4.modules\u002F05.cookie-auth","i-lucide-cookie",{"title":143,"path":144,"stem":145,"icon":146},"Identity bearer","\u002Fmodules\u002Fbearer-auth","4.modules\u002F06.bearer-auth","i-lucide-key",{"title":148,"path":149,"stem":150,"icon":151},"JWT","\u002Fmodules\u002Fjwt","4.modules\u002F07.jwt","i-lucide-fingerprint",{"title":153,"path":154,"stem":155,"icon":88},"Passkeys","\u002Fmodules\u002Fpasskeys","4.modules\u002F08.passkeys",{"title":157,"path":158,"stem":159,"icon":160},"Step-up ReAuth","\u002Fmodules\u002Freauth","4.modules\u002F09.reauth","i-lucide-shield-alert",{"title":162,"path":163,"stem":164,"icon":58},"External OAuth","\u002Fmodules\u002Fexternal-oauth","4.modules\u002F10.external-oauth",{"title":166,"path":167,"stem":168,"icon":169},"Configuration","\u002Fmodules\u002Fconfiguration","4.modules\u002F11.configuration","i-lucide-settings",{"title":171,"path":172,"stem":173,"icon":98},"CSRF rules","\u002Fmodules\u002Fcsrf","4.modules\u002F12.csrf",{"title":175,"path":176,"stem":177,"icon":178},"Responses","\u002Fmodules\u002Ferrors","4.modules\u002F13.errors","i-lucide-circle-alert",{"title":180,"path":181,"stem":182,"icon":183},"Rate-limit policies","\u002Fmodules\u002Frate-limits","4.modules\u002F14.rate-limits","i-lucide-gauge",{"title":185,"path":186,"stem":187,"icon":73},"Email codes","\u002Fmodules\u002Femail-code","4.modules\u002F15.email-code",{"title":189,"icon":190,"path":191,"stem":192,"children":193,"page":104},"Concepts","i-lucide-lightbulb","\u002Fconcepts","5.concepts",[194,199,204,209],{"title":195,"path":196,"stem":197,"icon":198},"Comparison","\u002Fconcepts\u002Fcompare","5.concepts\u002F1.compare","i-lucide-git-compare",{"title":200,"path":201,"stem":202,"icon":203},"Security model","\u002Fconcepts\u002Fsecurity-model","5.concepts\u002F2.security-model","i-lucide-shield",{"title":205,"path":206,"stem":207,"icon":208},"Production","\u002Fconcepts\u002Fproduction","5.concepts\u002F3.production","i-lucide-factory",{"title":210,"path":211,"stem":212,"icon":213},"FAQ","\u002Fconcepts\u002Ffaq","5.concepts\u002F4.faq","i-lucide-circle-help",{"id":215,"title":129,"body":216,"description":1069,"extension":1070,"faq":104,"links":1071,"meta":1072,"navigation":1073,"path":130,"seo":1074,"stem":131,"__hash__":1075},"docs\u002F4.modules\u002F03.composition.md",{"type":217,"value":218,"toc":1063},"minimark",[219,232,245,296,321,347,922,934,960,1010,1030,1038,1043],[220,221,222,223,227,228,231],"p",{},"Each group is one ",[224,225,226],"code",{},"Add*"," and one ",[224,229,230],{},"Map*",". A per-session group finishes in a sign-in completer, so map it once for each session prefix. A shared group does not start a session, so map it once.",[220,233,234,235,239,240,244],{},"This table is the route list for the password facade, the composite maps, and a custom host. The password facade's expansion is on ",[236,237,125],"a",{"href":238},"\u002Fmodules\u002Fpassword-auth\u002F",". The upgrade guide links here instead of copying the table: ",[236,241,243],{"href":242},"\u002Fgetting-started\u002Fupgrading-to-4\u002F#compatibility-composites","Upgrade to 4.0",".",[220,246,247,248,250,251,254,255,258,259,262,263,266,267,270,271,274,275,278,279,282,283,285,286,288,289,292,293,244],{},"Routes below are relative to the group you pass to ",[224,249,230],{},". Passkey maps add the ",[224,252,253],{},"\u002Fpasskeys"," prefix themselves. The composite names in the last column are the route-table snapshots. ",[224,256,257],{},"MapPasswordAuthCookie"," is ",[224,260,261],{},"MapPasswordAuth"," with ",[224,264,265],{},"Session"," left at ",[224,268,269],{},"Cookie"," and no passkey domain. ",[224,272,273],{},"MapPasswordAuthCookiePasskeys"," is that call with ",[224,276,277],{},"Passkeys.ServerDomain"," set. The ",[224,280,281],{},"Jwt"," names are the same split with ",[224,284,265],{}," set to ",[224,287,281],{}," and cookie refresh transport. Body transport drops ",[224,290,291],{},"GET \u002FcsrfToken"," from ",[224,294,295],{},"MapJwtSessionEndpoints",[220,297,298,301,302,305,306,309,310,313,314,305,317,320],{},[224,299,300],{},"MapPasskeySignInEndpoints"," still maps ",[224,303,304],{},"register\u002Foptions"," and ",[224,307,308],{},"register",", and it ensures confirm-email when that endpoint name is new. ",[224,311,312],{},"MapPasskeyEndpoints"," includes those sign-in routes and passkey management, and it leaves confirm-email unmapped. ",[224,315,316],{},"MapPasskeySignUpEndpoints",[224,318,319],{},"MapPasskeyRegisterOptionsEndpoints"," are the split maps for hosts that do not want the whole sign-in bundle.",[220,322,323,326,327,330,331,334,335,338,339,342,343,346],{},[224,324,325],{},"MapAccountManagementEndpoints"," maps ",[224,328,329],{},"POST \u002FconfirmIdentity\u002FpasskeyOptions"," when passkey services are registered. ",[224,332,333],{},"MapIdentityManagementApi"," always maps that route. ",[224,336,337],{},"POST \u002FconfirmIdentity\u002FemailCode\u002Fsend"," is mapped only when email-code services are registered. The ",[224,340,341],{},"AddAuthEndpoints"," \u002F ",[224,344,345],{},"MapAuthEndpoints"," facade maps neither.",[348,349,350,372],"table",{},[351,352,353],"thead",{},[354,355,356,360,363,366,369],"tr",{},[357,358,359],"th",{},"Add",[357,361,362],{},"Map",[357,364,365],{},"Scope",[357,367,368],{},"Routes",[357,370,371],{},"Composites",[373,374,375,411,443,477,511,559,583,602,631,656,684,715,750,769,788,827,848,869,893],"tbody",{},[354,376,377,383,388,391,396],{},[378,379,380],"td",{},[224,381,382],{},"AddPasswordSignUpEndpoints",[378,384,385],{},[224,386,387],{},"MapPasswordSignUpEndpoints",[378,389,390],{},"shared",[378,392,393],{},[224,394,395],{},"POST \u002Fregister",[378,397,398,400,401,400,403,400,405,400,408],{},[224,399,333],{},", ",[224,402,257],{},[224,404,273],{},[224,406,407],{},"MapPasswordAuthJwt",[224,409,410],{},"MapPasswordAuthJwtPasskeys",[354,412,413,418,423,426,431],{},[378,414,415],{},[224,416,417],{},"AddPasswordSignInEndpoints",[378,419,420],{},[224,421,422],{},"MapPasswordSignInEndpoints",[378,424,425],{},"per session",[378,427,428],{},[224,429,430],{},"POST \u002Flogin",[378,432,433,400,436,400,439,400,441],{},[224,434,435],{},"MapCookieAuthEndpoints",[224,437,438],{},"MapBearerAuthEndpoints",[224,440,257],{},[224,442,273],{},[354,444,445,450,455,457,465],{},[378,446,447],{},[224,448,449],{},"AddPasswordRecoveryEndpoints",[378,451,452],{},[224,453,454],{},"MapPasswordRecoveryEndpoints",[378,456,390],{},[378,458,459,400,462],{},[224,460,461],{},"POST \u002FforgotPassword",[224,463,464],{},"POST \u002FresetPassword",[378,466,467,400,469,400,471,400,473,400,475],{},[224,468,333],{},[224,470,257],{},[224,472,273],{},[224,474,407],{},[224,476,410],{},[354,478,479,484,489,491,499],{},[378,480,481],{},[224,482,483],{},"AddAccountAbuseRateLimiting",[378,485,486],{},[224,487,488],{},"MapConfirmEmailEndpoints",[378,490,390],{},[378,492,493,400,496],{},[224,494,495],{},"GET \u002FconfirmEmail",[224,497,498],{},"POST \u002FresendConfirmationEmail",[378,500,501,400,503,400,505,400,507,400,509],{},[224,502,333],{},[224,504,257],{},[224,506,273],{},[224,508,407],{},[224,510,410],{},[354,512,513,518,522,524,547],{},[378,514,515],{},[224,516,517],{},"AddAccountManagementEndpoints",[378,519,520],{},[224,521,325],{},[378,523,390],{},[378,525,526,400,529,400,532,400,535,400,538,400,541,400,544],{},[224,527,528],{},"GET \u002Fmanage\u002Finfo",[224,530,531],{},"POST \u002Fmanage\u002Finfo",[224,533,534],{},"GET \u002Fmanage\u002F2fa",[224,536,537],{},"POST \u002Fmanage\u002F2fa",[224,539,540],{},"GET \u002Fmanage\u002FauthMethods",[224,542,543],{},"POST \u002FconfirmIdentity",[224,545,546],{},"POST \u002Fmanage\u002Fpassword",[378,548,549,400,551,400,553,400,555,400,557],{},[224,550,333],{},[224,552,257],{},[224,554,273],{},[224,556,407],{},[224,558,410],{},[354,560,561,565,569,571,575],{},[378,562,563],{},[224,564,517],{},[378,566,567],{},[224,568,325],{},[378,570,390],{},[378,572,573],{},[224,574,329],{},[378,576,577,400,579,400,581],{},[224,578,333],{},[224,580,273],{},[224,582,410],{},[354,584,585,589,593,595,599],{},[378,586,587],{},[224,588,517],{},[378,590,591],{},[224,592,325],{},[378,594,390],{},[378,596,597],{},[224,598,337],{},[378,600,601],{},"none",[354,603,604,609,614,616,623],{},[378,605,606],{},[224,607,608],{},"AddCookieSessionEndpoints",[378,610,611],{},[224,612,613],{},"MapCookieSessionEndpoints",[378,615,425],{},[378,617,618,400,621],{},[224,619,620],{},"POST \u002Flogout",[224,622,291],{},[378,624,625,400,627,400,629],{},[224,626,435],{},[224,628,257],{},[224,630,273],{},[354,632,633,638,643,645,652],{},[378,634,635],{},[224,636,637],{},"AddBearerSessionEndpoints",[378,639,640],{},[224,641,642],{},"MapBearerSessionEndpoints",[378,644,425],{},[378,646,647,400,650],{},[224,648,649],{},"POST \u002Frefresh",[224,651,620],{},[378,653,654],{},[224,655,438],{},[354,657,658,663,668,670,675],{},[378,659,660],{},[224,661,662],{},"AddJwtEndpoints",[378,664,665],{},[224,666,667],{},"MapJwtPasswordEndpoints",[378,669,425],{},[378,671,672],{},[224,673,674],{},"POST \u002Fcreate",[378,676,677,400,680,400,682],{},[224,678,679],{},"MapJwtAuthEndpoints",[224,681,407],{},[224,683,410],{},[354,685,686,690,694,696,707],{},[378,687,688],{},[224,689,662],{},[378,691,692],{},[224,693,295],{},[378,695,425],{},[378,697,698,400,700,400,703,400,705],{},[224,699,649],{},[224,701,702],{},"GET \u002Fverify",[224,704,620],{},[224,706,291],{},[378,708,709,400,711,400,713],{},[224,710,679],{},[224,712,407],{},[224,714,410],{},[354,716,717,722,726,728,742],{},[378,718,719],{},[224,720,721],{},"AddPasskeySignInEndpoints",[378,723,724],{},[224,725,300],{},[378,727,425],{},[378,729,730,400,733,400,736,400,739],{},[224,731,732],{},"POST \u002Fpasskeys\u002FrequestOptions",[224,734,735],{},"POST \u002Fpasskeys\u002Flogin",[224,737,738],{},"POST \u002Fpasskeys\u002Fregister\u002Foptions",[224,740,741],{},"POST \u002Fpasskeys\u002Fregister",[378,743,744,400,746,400,748],{},[224,745,312],{},[224,747,273],{},[224,749,410],{},[354,751,752,757,761,763,767],{},[378,753,754],{},[224,755,756],{},"AddPasskeySignUpEndpoints",[378,758,759],{},[224,760,316],{},[378,762,425],{},[378,764,765],{},[224,766,741],{},[378,768,601],{},[354,770,771,776,780,782,786],{},[378,772,773],{},[224,774,775],{},"AddPasskeyRegisterOptionsEndpoints",[378,777,778],{},[224,779,319],{},[378,781,390],{},[378,783,784],{},[224,785,738],{},[378,787,601],{},[354,789,790,795,800,802,819],{},[378,791,792],{},[224,793,794],{},"AddPasskeyManagementEndpoints",[378,796,797],{},[224,798,799],{},"MapPasskeyManagementEndpoints",[378,801,390],{},[378,803,804,400,807,400,810,400,813,400,816],{},[224,805,806],{},"GET \u002Fpasskeys\u002F",[224,808,809],{},"POST \u002Fpasskeys\u002F",[224,811,812],{},"POST \u002Fpasskeys\u002FcreationOptions",[224,814,815],{},"PATCH \u002Fpasskeys\u002F",[224,817,818],{},"DELETE \u002Fpasskeys\u002F{credentialIdUrl}",[378,820,821,400,823,400,825],{},[224,822,312],{},[224,824,273],{},[224,826,410],{},[354,828,829,834,839,841,846],{},[378,830,831],{},[224,832,833],{},"AddEmailCodeSendEndpoints",[378,835,836],{},[224,837,838],{},"MapEmailCodeSendEndpoints",[378,840,390],{},[378,842,843],{},[224,844,845],{},"POST \u002FemailCode\u002Fsend",[378,847,601],{},[354,849,850,855,860,862,867],{},[378,851,852],{},[224,853,854],{},"AddEmailCodeSignInEndpoints",[378,856,857],{},[224,858,859],{},"MapEmailCodeSignInEndpoints",[378,861,425],{},[378,863,864],{},[224,865,866],{},"POST \u002FemailCode\u002Fverify",[378,868,601],{},[354,870,871,876,881,883,891],{},[378,872,873],{},[224,874,875],{},"AddExternalAuthEndpoints",[378,877,878],{},[224,879,880],{},"MapExternalAuthEndpoints",[378,882,425],{},[378,884,885,400,888],{},[224,886,887],{},"GET \u002Flogin\u002Fgithub",[224,889,890],{},"GET \u002Flogin\u002Fgithub\u002Fcallback",[378,892,601],{},[354,894,895,899,904,906,920],{},[378,896,897],{},[224,898,875],{},[378,900,901],{},[224,902,903],{},"MapExternalAccountEndpoints",[378,905,390],{},[378,907,908,400,911,400,914,400,917],{},[224,909,910],{},"GET \u002Flogins",[224,912,913],{},"DELETE \u002Flogins\u002F{loginProvider}\u002F{providerKey}",[224,915,916],{},"GET \u002Flink\u002F{scheme}",[224,918,919],{},"GET \u002Flink\u002F{scheme}\u002Fcallback",[378,921,601],{},[220,923,924,926,927,305,930,933],{},[224,925,880],{}," for Google uses ",[224,928,929],{},"GET \u002Flogin\u002Fgoogle",[224,931,932],{},"GET \u002Flogin\u002Fgoogle\u002Fcallback",". Those paths are the same shape as the GitHub row. They are not in a composite snapshot.",[220,935,936,939,940,942,943,945,946,948,949,952,953,955,956,959],{},[224,937,938],{},"MapSignInEndpoints\u003CTUser>(AuthEndpointsSession)"," maps the per-session rows whose ",[224,941,226],{}," is registered, plus that session's session row. Password login on a JWT session is ",[224,944,667],{},", not ",[224,947,430],{},". ",[224,950,951],{},"MapSharedAuthEndpoints\u003CTUser>(sharedPath)"," maps the shared rows whose ",[224,954,226],{}," is registered. Null ",[224,957,958],{},"sharedPath"," uses the builder you call it on.",[220,961,962,965,966,968,969,971,972,975,976,948,978,980,981,983,984,948,986,258,988,305,990,948,992,258,994,262,996,400,999,1001,1002,948,1004,1006,1007,1009],{},[224,963,964],{},"MapPasswordEndpoints"," is sign-up, sign-in, and recovery. ",[224,967,435],{}," is cookie ",[224,970,430],{}," on the ",[224,973,974],{},"LoginCookie"," handler, then ",[224,977,613],{},[224,979,438],{}," is Identity bearer ",[224,982,430],{},", then ",[224,985,642],{},[224,987,679],{},[224,989,667],{},[224,991,295],{},[224,993,333],{},[224,995,964],{},[224,997,998],{},"PasswordLoginMode.None",[224,1000,488],{},", and ",[224,1003,325],{},[224,1005,312],{}," is passkey sign-in and management on one ",[224,1008,253],{}," group.",[220,1011,1012,1013,1015,1016,1018,1019,1021,1022,948,1024,1026,1027,1029],{},"Two session prefixes can both map ",[224,1014,620],{},". Put them on different groups. ",[224,1017,964],{}," in cookie mode and ",[224,1020,435],{}," both map ",[224,1023,430],{},[224,1025,312],{}," already includes sign-in, so do not add ",[224,1028,300],{}," on that same prefix.",[220,1031,1032,1033,305,1035,1037],{},"Confirm-email keeps one endpoint name. Map it with the shared routes, not under every session prefix. ",[224,1034,387],{},[224,1036,325],{}," ensure that route when the name is new. A later map with the same name leaves the first route in place.",[1039,1040,1042],"h2",{"id":1041},"related","Related",[1044,1045,1046,1053,1057],"ul",{},[1047,1048,1049],"li",{},[236,1050,1052],{"href":1051},"\u002Fcomposables\u002F","Build a custom auth stack",[1047,1054,1055],{},[236,1056,125],{"href":238},[1047,1058,1059],{},[236,1060,1062],{"href":1061},"\u002Fconcepts\u002Fsecurity-model\u002F#sign-in-completers-write-the-session","Sign-in completers",{"title":1064,"searchDepth":1065,"depth":1066,"links":1067},"",1,2,[1068],{"id":1041,"depth":1066,"text":1042},"Add and Map pairs, the routes each one maps, whether the group is per session or shared, and which snapshots contain it.","md",null,{},{"title":129,"icon":132},{"title":129,"description":1069},"aDtXbIwbbVcIuscqJqsuwKDqvljHviWWsXCr-TgChec",[1077,1079],{"title":125,"path":126,"stem":127,"description":1078,"icon":78,"children":-1},"What AddPasswordAuth and MapPasswordAuth register and map, and the building-block calls they expand to.",{"title":134,"path":135,"stem":136,"description":1080,"icon":83,"children":-1},"Account lifecycle endpoints — register, confirm, forgot\u002Freset password, manage info and 2FA.",1792403034198]