[{"data":1,"prerenderedAt":482},["ShallowReactive",2],{"navigation":3,"\u002Fmodules\u002Fenumeration":250,"\u002Fmodules\u002Fenumeration-surround":477},[4,43,120,143,219],{"title":5,"path":6,"stem":7,"children":8,"icon":42},"Get started","\u002Fgetting-started","1.getting-started\u002F1.index",[9,12,17,22,27,32,37],{"title":10,"path":6,"stem":7,"icon":11},"Introduction","i-lucide-house",{"title":13,"path":14,"stem":15,"icon":16},"Install AuthEndpoints","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F2.installation","i-lucide-download",{"title":18,"path":19,"stem":20,"icon":21},"Quick start","\u002Fgetting-started\u002Fquick-start","1.getting-started\u002F3.quick-start","i-lucide-play",{"title":23,"path":24,"stem":25,"icon":26},"Pick your setup","\u002Fgetting-started\u002Fchoose-a-sign-in-stack","1.getting-started\u002F4.choose-a-sign-in-stack","i-lucide-signpost",{"title":28,"path":29,"stem":30,"icon":31},"Use the AuthEndpoints skill with coding agents","\u002Fgetting-started\u002Fai-agents","1.getting-started\u002F5.ai-agents","i-lucide-bot",{"title":33,"path":34,"stem":35,"icon":36},"Password auth","\u002Fgetting-started\u002Fpassword-auth","1.getting-started\u002F6.password-auth","i-lucide-key-round",{"title":38,"path":39,"stem":40,"icon":41},"3.x facade","\u002Fgetting-started\u002Fcompatibility-facade","1.getting-started\u002F7.compatibility-facade","i-lucide-archive","i-lucide-rocket",{"title":44,"path":45,"stem":46,"children":47,"icon":119},"Guides","\u002Fguides","2.guides\u002F01.index",[48,50,55,60,65,70,74,79,84,89,94,99,104,109,114],{"title":44,"path":45,"stem":46,"icon":49},"i-lucide-list-checks",{"title":51,"path":52,"stem":53,"icon":54},"Register users","\u002Fguides\u002Fregistration","2.guides\u002F02.registration","i-lucide-user-plus",{"title":56,"path":57,"stem":58,"icon":59},"Sign users in","\u002Fguides\u002Fsign-in","2.guides\u002F03.sign-in","i-lucide-log-in",{"title":61,"path":62,"stem":63,"icon":64},"Sign users out","\u002Fguides\u002Fsign-out","2.guides\u002F04.sign-out","i-lucide-log-out",{"title":66,"path":67,"stem":68,"icon":69},"Turn on two-factor authentication","\u002Fguides\u002Ftwo-factor","2.guides\u002F05.two-factor","i-lucide-smartphone",{"title":71,"path":72,"stem":73,"icon":36},"Reset a forgotten password","\u002Fguides\u002Freset-password","2.guides\u002F06.reset-password",{"title":75,"path":76,"stem":77,"icon":78},"Change a user's email or password","\u002Fguides\u002Fmanage-account","2.guides\u002F07.manage-account","i-lucide-user-cog",{"title":80,"path":81,"stem":82,"icon":83},"Add, rename, and remove passkeys","\u002Fguides\u002Fmanage-passkeys","2.guides\u002F08.manage-passkeys","i-lucide-scan-face",{"title":85,"path":86,"stem":87,"icon":88},"Link and unlink GitHub or Google accounts","\u002Fguides\u002Flink-external-accounts","2.guides\u002F09.link-external-accounts","i-lucide-link",{"title":90,"path":91,"stem":92,"icon":93},"Require step-up before sensitive actions","\u002Fguides\u002Fstep-up","2.guides\u002F10.step-up","i-lucide-shield-check",{"title":95,"path":96,"stem":97,"icon":98},"Call the API from a browser","\u002Fguides\u002Fbrowser-clients","2.guides\u002F11.browser-clients","i-lucide-globe",{"title":100,"path":101,"stem":102,"icon":103},"Prepare for production","\u002Fguides\u002Fproduction","2.guides\u002F12.production","i-lucide-factory",{"title":105,"path":106,"stem":107,"icon":108},"Sign in with an emailed code","\u002Fguides\u002Femail-code","2.guides\u002F13.email-code","i-lucide-mail",{"title":110,"path":111,"stem":112,"icon":113},"Upgrade to 4.0","\u002Fguides\u002Fupgrading-to-4","2.guides\u002F14.upgrading-to-4","i-lucide-arrow-up-right",{"title":115,"path":116,"stem":117,"icon":118},"Run an app with no public sign-up","\u002Fguides\u002Finternal-app","2.guides\u002F15.internal-app","i-lucide-building-2","i-lucide-waypoints",{"title":121,"path":122,"stem":123,"children":124,"icon":142},"Composable endpoints","\u002Fcomposables","3.composables\u002F1.index",[125,128,132,137],{"title":126,"path":122,"stem":123,"icon":127},"How composition works","i-lucide-layout-grid",{"title":129,"path":130,"stem":131,"icon":49},"Composition requirements","\u002Fcomposables\u002Frequirements","3.composables\u002F2.requirements",{"title":133,"path":134,"stem":135,"icon":136},"Compose a custom auth stack","\u002Fcomposables\u002Frecipes","3.composables\u002F3.recipes","i-lucide-book-marked",{"title":138,"path":139,"stem":140,"icon":141},"Composition","\u002Fcomposables\u002Fcomposition","3.composables\u002F4.composition","i-lucide-table","i-lucide-blocks",{"title":144,"icon":145,"path":146,"stem":147,"children":148,"page":218},"Reference","i-lucide-book-open","\u002Fmodules","4.modules",[149,154,158,163,168,173,177,182,186,191,195,200,205,209,213],{"title":150,"path":151,"stem":152,"icon":153},"Endpoint reference","\u002Fmodules\u002Fendpoints","4.modules\u002F01.endpoints","i-lucide-route",{"title":155,"path":156,"stem":157,"icon":78},"Identity management module","\u002Fmodules\u002Fidentity-management","4.modules\u002F02.identity-management",{"title":159,"path":160,"stem":161,"icon":162},"Cookie sign-in module","\u002Fmodules\u002Fcookie-auth","4.modules\u002F03.cookie-auth","i-lucide-cookie",{"title":164,"path":165,"stem":166,"icon":167},"Identity bearer sign-in module","\u002Fmodules\u002Fbearer-auth","4.modules\u002F04.bearer-auth","i-lucide-key",{"title":169,"path":170,"stem":171,"icon":172},"JWT module","\u002Fmodules\u002Fjwt","4.modules\u002F05.jwt","i-lucide-fingerprint",{"title":174,"path":175,"stem":176,"icon":83},"Passkeys module","\u002Fmodules\u002Fpasskeys","4.modules\u002F06.passkeys",{"title":178,"path":179,"stem":180,"icon":181},"ReAuth module","\u002Fmodules\u002Freauth","4.modules\u002F07.reauth","i-lucide-shield-alert",{"title":183,"path":184,"stem":185,"icon":59},"External OAuth packages","\u002Fmodules\u002Fexternal-oauth","4.modules\u002F08.external-oauth",{"title":187,"path":188,"stem":189,"icon":190},"Configuration options","\u002Fmodules\u002Fconfiguration","4.modules\u002F09.configuration","i-lucide-settings",{"title":192,"path":193,"stem":194,"icon":93},"Antiforgery (CSRF) rules","\u002Fmodules\u002Fcsrf","4.modules\u002F10.csrf",{"title":196,"path":197,"stem":198,"icon":199},"Responses and errors","\u002Fmodules\u002Ferrors","4.modules\u002F11.errors","i-lucide-circle-alert",{"title":201,"path":202,"stem":203,"icon":204},"Rate-limit policies","\u002Fmodules\u002Frate-limits","4.modules\u002F12.rate-limits","i-lucide-gauge",{"title":206,"path":207,"stem":208,"icon":108},"Email-code module","\u002Fmodules\u002Femail-code","4.modules\u002F13.email-code",{"title":210,"path":211,"stem":212,"icon":59},"Sign-in completer","\u002Fmodules\u002Fsign-in-completer","4.modules\u002F14.sign-in-completer",{"title":214,"path":215,"stem":216,"icon":217},"Enumeration-safe responses","\u002Fmodules\u002Fenumeration","4.modules\u002F15.enumeration","i-lucide-eye-off",false,{"title":220,"icon":221,"path":222,"stem":223,"children":224,"page":218},"Concepts","i-lucide-lightbulb","\u002Fconcepts","5.concepts",[225,230,235,240,245],{"title":226,"path":227,"stem":228,"icon":229},"AuthEndpoints compared with other options","\u002Fconcepts\u002Fcompare","5.concepts\u002F1.compare","i-lucide-git-compare",{"title":231,"path":232,"stem":233,"icon":234},"Stock Identity endpoints vs AuthEndpoints","\u002Fconcepts\u002Fstock-identity-vs-authendpoints","5.concepts\u002F2.stock-identity-vs-authendpoints","i-lucide-columns-2",{"title":236,"path":237,"stem":238,"icon":239},"MapIdentityApi alternative","\u002Fconcepts\u002Fmapidentityapi-alternative","5.concepts\u002F3.mapidentityapi-alternative","i-lucide-arrow-left-right",{"title":241,"path":242,"stem":243,"icon":244},"Security model","\u002Fconcepts\u002Fsecurity-model","5.concepts\u002F4.security-model","i-lucide-shield",{"title":246,"path":247,"stem":248,"icon":249},"FAQ","\u002Fconcepts\u002Ffaq","5.concepts\u002F5.faq","i-lucide-circle-help",{"id":251,"title":214,"body":252,"description":470,"extension":471,"faq":218,"links":472,"meta":473,"navigation":474,"path":215,"seo":475,"stem":216,"__hash__":476},"docs\u002F4.modules\u002F15.enumeration.md",{"type":253,"value":254,"toc":464},"minimark",[255,259,363,396,403,406,411,422,439,444],[256,257,258],"p",{},"These routes answer an email that has an account and an email that does not with the same status, the same body shape, and the same headers. The behaviour is always on. There is no option to turn it off.",[260,261,262,278],"table",{},[263,264,265],"thead",{},[266,267,268,272,275],"tr",{},[269,270,271],"th",{},"Route",[269,273,274],{},"Same response",[269,276,277],{},"Unknown-account work",[279,280,281,299,313,326,348],"tbody",{},[266,282,283,290,296],{},[284,285,286],"td",{},[287,288,289],"code",{},"POST \u002Fregister",[284,291,292,293],{},"Empty ",[287,294,295],{},"200",[284,297,298],{},"Notifies the owner when the email already has an account",[266,300,301,306,310],{},[284,302,303],{},[287,304,305],{},"POST \u002FforgotPassword",[284,307,292,308],{},[287,309,295],{},[284,311,312],{},"Issues a password-reset token only when the account exists and the email is confirmed",[266,314,315,320,323],{},[284,316,317],{},[287,318,319],{},"POST \u002FresendConfirmationEmail",[284,321,322],{},"The signed-in user's resend result",[284,324,325],{},"The body email is ignored",[266,327,328,333,345],{},[284,329,330],{},[287,331,332],{},"POST \u002FemailCode\u002Fsend",[284,334,335,337,338,341,342],{},[287,336,295],{}," with ",[287,339,340],{},"expiresInSeconds"," and ",[287,343,344],{},"resendAfterSeconds",[284,346,347],{},"Issues a code only when the account can receive one",[266,349,350,355,360],{},[284,351,352],{},[287,353,354],{},"POST \u002Fpasskeys\u002Fregister\u002Foptions",[284,356,357,359],{},[287,358,295],{}," options",[284,361,362],{},"Builds creation options",[256,364,365,367,368,371,372,375,376,379,380,383,384,387,388,391,392,395],{},[287,366,289],{}," does not return ",[287,369,370],{},"DuplicateUserName"," or ",[287,373,374],{},"DuplicateEmail",". A valid password for an existing email does not create a second account. 4.0 sends ",[287,377,378],{},"IAccountSecurityEmailSender\u003CTUser>.SendRegistrationAttemptedAsync"," to that owner. The attempted password is not in the message. ",[287,381,382],{},"AddPasswordSignUpEndpoints",", ",[287,385,386],{},"AddAccountManagementEndpoints",", and ",[287,389,390],{},"AddJwtEndpoints"," register ",[287,393,394],{},"LoggingAccountSecurityEmailSender\u003CTUser>"," when no sender is registered. That default logs the attempt and does not send mail. Register an implementation to deliver it. Startup logs a warning while the logging sender is still the registration.",[256,397,398,399,402],{},"Invalid email and password-rule failures stay ",[287,400,401],{},"400",". Those bodies match whether or not the email is registered.",[256,404,405],{},"The unknown-account branch runs the same class of work as the account branch, so the two requests take a similar amount of time. Queue confirmation, reset, and registration-attempt mail and return from the sender. A sender that waits on SMTP makes a known address slower than an unknown one.",[256,407,408,410],{},[287,409,319],{}," still resends for the signed-in user. An anonymous caller cannot use it to ask whether an address is registered.",[256,412,413,414,416,417,421],{},"Clients keep one check-your-email screen for a new registration and a taken email. That empty ",[287,415,295],{}," was already the 3.4.1 register response. See ",[418,419,110],"a",{"href":420},"\u002Fguides\u002Fupgrading-to-4\u002F",".",[256,423,424,425,427,428,431,432,434,435,438],{},"The final passkey register step still reveals a taken email once a valid attestation has been made. ",[287,426,354],{}," returns the same options for a known email and an unknown email. ",[287,429,430],{},"POST \u002Fpasskeys\u002Fregister"," checks the email only after attestation succeeds. A taken email then returns ",[287,433,401],{}," with detail ",[287,436,437],{},"Unable to complete registration."," A new email continues and creates the user.",[440,441,443],"h2",{"id":442},"related","Related",[445,446,447,453,459],"ul",{},[448,449,450],"li",{},[418,451,51],{"href":452},"\u002Fguides\u002Fregistration\u002F",[448,454,455],{},[418,456,458],{"href":457},"\u002Fmodules\u002Fidentity-management\u002F","Identity management",[448,460,461],{},[418,462,206],{"href":463},"\u002Fmodules\u002Femail-code\u002F",{"title":465,"searchDepth":466,"depth":467,"links":468},"",1,2,[469],{"id":442,"depth":467,"text":443},"Register, forgot-password, resend, email-code send, and passkey registration options return the same response for known and unknown emails.","md",null,{},{"title":214,"icon":217},{"title":214,"description":470},"QQSoVUjqFpmh8IAOm-HpEAwKvfBuZgVWK2EtxnWJLGk",[478,480],{"title":210,"path":211,"stem":212,"description":479,"icon":59,"children":-1},"The session a successful sign-in finishes in, and how to replace that step.",{"title":226,"path":227,"stem":228,"description":481,"icon":229,"children":-1},"How AuthEndpoints differs from wiring ASP.NET Core Identity yourself, from OpenIddict, and from Identity API endpoints.",1792054259439]