[{"data":1,"prerenderedAt":767},["ShallowReactive",2],{"navigation":3,"\u002Fmodules\u002Fidentity-management":203,"\u002Fmodules\u002Fidentity-management-surround":762},[4,33,96,114,177],{"title":5,"path":6,"stem":7,"children":8,"icon":32},"Get started","\u002Fgetting-started","1.getting-started\u002F1.index",[9,12,17,22,27],{"title":10,"path":6,"stem":7,"icon":11},"Introduction","i-lucide-house",{"title":13,"path":14,"stem":15,"icon":16},"Install AuthEndpoints","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F2.installation","i-lucide-download",{"title":18,"path":19,"stem":20,"icon":21},"Quick start","\u002Fgetting-started\u002Fquick-start","1.getting-started\u002F3.quick-start","i-lucide-play",{"title":23,"path":24,"stem":25,"icon":26},"Choose a sign-in stack","\u002Fgetting-started\u002Fchoose-a-sign-in-stack","1.getting-started\u002F4.choose-a-sign-in-stack","i-lucide-signpost",{"title":28,"path":29,"stem":30,"icon":31},"Use the AuthEndpoints skill with coding agents","\u002Fgetting-started\u002Fai-agents","1.getting-started\u002F5.ai-agents","i-lucide-bot","i-lucide-rocket",{"title":34,"path":35,"stem":36,"children":37,"icon":95},"Guides","\u002Fguides","2.guides\u002F01.index",[38,40,45,50,55,60,65,70,75,80,85,90],{"title":34,"path":35,"stem":36,"icon":39},"i-lucide-list-checks",{"title":41,"path":42,"stem":43,"icon":44},"Register users","\u002Fguides\u002Fregistration","2.guides\u002F02.registration","i-lucide-user-plus",{"title":46,"path":47,"stem":48,"icon":49},"Sign users in","\u002Fguides\u002Fsign-in","2.guides\u002F03.sign-in","i-lucide-log-in",{"title":51,"path":52,"stem":53,"icon":54},"Sign users out","\u002Fguides\u002Fsign-out","2.guides\u002F04.sign-out","i-lucide-log-out",{"title":56,"path":57,"stem":58,"icon":59},"Turn on two-factor authentication","\u002Fguides\u002Ftwo-factor","2.guides\u002F05.two-factor","i-lucide-smartphone",{"title":61,"path":62,"stem":63,"icon":64},"Reset a forgotten password","\u002Fguides\u002Freset-password","2.guides\u002F06.reset-password","i-lucide-key-round",{"title":66,"path":67,"stem":68,"icon":69},"Change a user's email or password","\u002Fguides\u002Fmanage-account","2.guides\u002F07.manage-account","i-lucide-user-cog",{"title":71,"path":72,"stem":73,"icon":74},"Add, rename, and remove passkeys","\u002Fguides\u002Fmanage-passkeys","2.guides\u002F08.manage-passkeys","i-lucide-scan-face",{"title":76,"path":77,"stem":78,"icon":79},"Link and unlink GitHub or Google accounts","\u002Fguides\u002Flink-external-accounts","2.guides\u002F09.link-external-accounts","i-lucide-link",{"title":81,"path":82,"stem":83,"icon":84},"Require step-up before sensitive actions","\u002Fguides\u002Fstep-up","2.guides\u002F10.step-up","i-lucide-shield-check",{"title":86,"path":87,"stem":88,"icon":89},"Call the API from a browser","\u002Fguides\u002Fbrowser-clients","2.guides\u002F11.browser-clients","i-lucide-globe",{"title":91,"path":92,"stem":93,"icon":94},"Prepare for production","\u002Fguides\u002Fproduction","2.guides\u002F12.production","i-lucide-factory","i-lucide-waypoints",{"title":97,"path":98,"stem":99,"children":100,"icon":113},"Composable endpoints","\u002Fcomposables","3.composables\u002F1.index",[101,104,108],{"title":102,"path":98,"stem":99,"icon":103},"How composition works","i-lucide-layout-grid",{"title":105,"path":106,"stem":107,"icon":39},"Composition requirements","\u002Fcomposables\u002Frequirements","3.composables\u002F2.requirements",{"title":109,"path":110,"stem":111,"icon":112},"Compose a custom auth stack","\u002Fcomposables\u002Frecipes","3.composables\u002F3.recipes","i-lucide-book-marked","i-lucide-blocks",{"title":115,"icon":116,"path":117,"stem":118,"children":119,"page":176},"Reference","i-lucide-book-open","\u002Fmodules","4.modules",[120,125,129,134,139,144,148,153,157,162,166,171],{"title":121,"path":122,"stem":123,"icon":124},"Endpoint reference","\u002Fmodules\u002Fendpoints","4.modules\u002F01.endpoints","i-lucide-route",{"title":126,"path":127,"stem":128,"icon":69},"Identity management module","\u002Fmodules\u002Fidentity-management","4.modules\u002F02.identity-management",{"title":130,"path":131,"stem":132,"icon":133},"Cookie sign-in module","\u002Fmodules\u002Fcookie-auth","4.modules\u002F03.cookie-auth","i-lucide-cookie",{"title":135,"path":136,"stem":137,"icon":138},"Identity bearer sign-in module","\u002Fmodules\u002Fbearer-auth","4.modules\u002F04.bearer-auth","i-lucide-key",{"title":140,"path":141,"stem":142,"icon":143},"JWT module","\u002Fmodules\u002Fjwt","4.modules\u002F05.jwt","i-lucide-fingerprint",{"title":145,"path":146,"stem":147,"icon":74},"Passkeys module","\u002Fmodules\u002Fpasskeys","4.modules\u002F06.passkeys",{"title":149,"path":150,"stem":151,"icon":152},"ReAuth module","\u002Fmodules\u002Freauth","4.modules\u002F07.reauth","i-lucide-shield-alert",{"title":154,"path":155,"stem":156,"icon":49},"External OAuth packages","\u002Fmodules\u002Fexternal-oauth","4.modules\u002F08.external-oauth",{"title":158,"path":159,"stem":160,"icon":161},"Configuration options","\u002Fmodules\u002Fconfiguration","4.modules\u002F09.configuration","i-lucide-settings",{"title":163,"path":164,"stem":165,"icon":84},"Antiforgery (CSRF) rules","\u002Fmodules\u002Fcsrf","4.modules\u002F10.csrf",{"title":167,"path":168,"stem":169,"icon":170},"Responses and errors","\u002Fmodules\u002Ferrors","4.modules\u002F11.errors","i-lucide-circle-alert",{"title":172,"path":173,"stem":174,"icon":175},"Rate-limit policies","\u002Fmodules\u002Frate-limits","4.modules\u002F12.rate-limits","i-lucide-gauge",false,{"title":178,"icon":179,"path":180,"stem":181,"children":182,"page":176},"Concepts","i-lucide-lightbulb","\u002Fconcepts","5.concepts",[183,188,193,198],{"title":184,"path":185,"stem":186,"icon":187},"AuthEndpoints compared with other options","\u002Fconcepts\u002Fcompare","5.concepts\u002F1.compare","i-lucide-git-compare",{"title":189,"path":190,"stem":191,"icon":192},"Stock Identity endpoints vs AuthEndpoints","\u002Fconcepts\u002Fstock-identity-vs-authendpoints","5.concepts\u002F2.stock-identity-vs-authendpoints","i-lucide-columns-2",{"title":194,"path":195,"stem":196,"icon":197},"Security model","\u002Fconcepts\u002Fsecurity-model","5.concepts\u002F3.security-model","i-lucide-shield",{"title":199,"path":200,"stem":201,"icon":202},"FAQ","\u002Fconcepts\u002Ffaq","5.concepts\u002F4.faq","i-lucide-circle-help",{"id":204,"title":126,"body":205,"description":755,"extension":756,"links":757,"meta":758,"navigation":759,"path":127,"seo":760,"stem":128,"__hash__":761},"docs\u002F4.modules\u002F02.identity-management.md",{"type":206,"value":207,"toc":744},"minimark",[208,228,233,241,245,311,315,321,533,538,545,596,629,633,647,665,669,672,681,685,710,714,740],[209,210,211,212,217,218,222,223,227],"p",{},"Maps account lifecycle endpoints. Pair with a sign-in module (",[213,214,216],"a",{"href":215},"\u002Fmodules\u002Fcookie-auth\u002F","cookie",", ",[213,219,221],{"href":220},"\u002Fmodules\u002Fbearer-auth\u002F","bearer",", or ",[213,224,226],{"href":225},"\u002Fmodules\u002Fjwt\u002F","JWT",").",[229,230,232],"h2",{"id":231},"di","DI",[209,234,235,236,240],{},"Registered by the facade (",[237,238,239],"code",{},"AddAuthEndpoints",") or manually via Identity API endpoints + EF stores + token providers.",[229,242,244],{"id":243},"map","Map",[246,247,252],"pre",{"className":248,"code":249,"language":250,"meta":251,"style":251},"language-cs shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","app.MapGroup(\"\u002Fidentity\").MapIdentityManagementApi\u003CAppUser>();\n\u002F\u002F Optional: unique confirm email name when mapping twice\n\u002F\u002F .MapIdentityManagementApi\u003CAppUser>(confirmEmailEndpointName: \"BearerConfirmEmail\");\n","cs","",[237,253,254,298,305],{"__ignoreMap":251},[255,256,259,263,267,271,274,277,281,283,285,288,291,295],"span",{"class":257,"line":258},"line",1,[255,260,262],{"class":261},"sTEyZ","app",[255,264,266],{"class":265},"sMK4o",".",[255,268,270],{"class":269},"s2Zo4","MapGroup",[255,272,273],{"class":265},"(",[255,275,276],{"class":265},"\"",[255,278,280],{"class":279},"sfazB","\u002Fidentity",[255,282,276],{"class":265},[255,284,227],{"class":265},[255,286,287],{"class":269},"MapIdentityManagementApi",[255,289,290],{"class":265},"\u003C",[255,292,294],{"class":293},"sBMFI","AppUser",[255,296,297],{"class":265},">();\n",[255,299,301],{"class":257,"line":300},2,[255,302,304],{"class":303},"sHwdD","\u002F\u002F Optional: unique confirm email name when mapping twice\n",[255,306,308],{"class":257,"line":307},3,[255,309,310],{"class":303},"\u002F\u002F .MapIdentityManagementApi\u003CAppUser>(confirmEmailEndpointName: \"BearerConfirmEmail\");\n",[229,312,314],{"id":313},"routes","Routes",[209,316,317,318,320],{},"Relative to the group prefix (facade default ",[237,319,280],{},"):",[322,323,324,340],"table",{},[325,326,327],"thead",{},[328,329,330,334,337],"tr",{},[331,332,333],"th",{},"Method",[331,335,336],{},"Path",[331,338,339],{},"Notes",[341,342,343,363,387,405,419,432,451,465,479,493,506,520],"tbody",{},[328,344,345,351,356],{},[346,347,348],"td",{},[237,349,350],{},"POST",[346,352,353],{},[237,354,355],{},"\u002Fregister",[346,357,358,359,362],{},"Creates user; duplicate email returns ",[237,360,361],{},"200 OK"," (no enumeration). Rate-limited.",[328,364,365,370,375],{},[346,366,367],{},[237,368,369],{},"GET",[346,371,372],{},[237,373,374],{},"\u002FconfirmEmail",[346,376,377,378,217,381,383,384],{},"Query ",[237,379,380],{},"userId",[237,382,237],{},", optional ",[237,385,386],{},"changedEmail",[328,388,389,393,398],{},[346,390,391],{},[237,392,350],{},[346,394,395],{},[237,396,397],{},"\u002FresendConfirmationEmail",[346,399,400,401,404],{},"Auth + CSRF + rate limit. Signed-in user only; body ",[237,402,403],{},"email"," is ignored.",[328,406,407,411,416],{},[346,408,409],{},[237,410,350],{},[346,412,413],{},[237,414,415],{},"\u002FforgotPassword",[346,417,418],{},"Rate-limited",[328,420,421,425,430],{},[346,422,423],{},[237,424,350],{},[346,426,427],{},[237,428,429],{},"\u002FresetPassword",[346,431,418],{},[328,433,434,438,443],{},[346,435,436],{},[237,437,369],{},[346,439,440],{},[237,441,442],{},"\u002Fmanage\u002FauthMethods",[346,444,445,446,450],{},"ReAuth methods (see ",[213,447,449],{"href":448},"\u002Fmodules\u002Freauth\u002F","ReAuth",")",[328,452,453,457,462],{},[346,454,455],{},[237,456,350],{},[346,458,459],{},[237,460,461],{},"\u002FconfirmIdentity",[346,463,464],{},"Step-up proof. Auth + CSRF + rate limit.",[328,466,467,471,476],{},[346,468,469],{},[237,470,350],{},[346,472,473],{},[237,474,475],{},"\u002FconfirmIdentity\u002FpasskeyOptions",[346,477,478],{},"Passkey options for step-up. Auth + CSRF + rate limit.",[328,480,481,485,490],{},[346,482,483],{},[237,484,369],{},[346,486,487],{},[237,488,489],{},"\u002Fmanage\u002F2fa",[346,491,492],{},"2FA status",[328,494,495,499,503],{},[346,496,497],{},[237,498,350],{},[346,500,501],{},[237,502,489],{},[346,504,505],{},"Enable\u002Fdisable 2FA — CSRF + ReAuth",[328,507,508,512,517],{},[346,509,510],{},[237,511,369],{},[346,513,514],{},[237,515,516],{},"\u002Fmanage\u002Finfo",[346,518,519],{},"Current user info",[328,521,522,526,530],{},[346,523,524],{},[237,525,350],{},[346,527,528],{},[237,529,516],{},[346,531,532],{},"Update info — CSRF + ReAuth",[534,535,537],"h3",{"id":536},"confirmemail","confirmEmail",[209,539,540,541,544],{},"Query string on ",[237,542,543],{},"GET \u002FconfirmEmail",":",[322,546,547,559],{},[325,548,549],{},[328,550,551,554,557],{},[331,552,553],{},"Query",[331,555,556],{},"Required",[331,558,339],{},[341,560,561,573,584],{},[328,562,563,567,570],{},[346,564,565],{},[237,566,380],{},[346,568,569],{},"yes",[346,571,572],{},"Identity user id",[328,574,575,579,581],{},[346,576,577],{},[237,578,237],{},[346,580,569],{},[346,582,583],{},"Confirmation (or change-email) token from the emailed link",[328,585,586,590,593],{},[346,587,588],{},[237,589,386],{},[346,591,592],{},"no",[346,594,595],{},"When set, confirms a change to that email and updates the user name",[209,597,598,599,602,603,606,607,610,611,614,615,618,619,622,623,625,626,266],{},"When ",[237,600,601],{},"AuthEndpointsOptions.EmailConfirmation.ConfirmEmailRedirectUri"," is set, success and failure return ",[237,604,605],{},"302"," to that URI with ",[237,608,609],{},"status"," and ",[237,612,613],{},"flow"," instead of the thank-you body or ",[237,616,617],{},"401",". The account mutation still runs first. Leave the option unset for callers that expect ",[237,620,621],{},"200"," or ",[237,624,617],{},". See ",[213,627,158],{"href":628},"\u002Fmodules\u002Fconfiguration\u002F#email-confirmation",[534,630,632],{"id":631},"resendconfirmationemail","resendConfirmationEmail",[209,634,635,636,639,640,642,643,646],{},"Requires a signed-in user (",[237,637,638],{},"RequireAuthorization"," + CSRF). The request body ",[237,641,403],{}," (",[237,644,645],{},"ResendConfirmationEmailRequest",") is ignored; the handler resends to the signed-in user's email.",[209,648,649,650,653,654,657,658,660,661,664],{},"With ",[237,651,652],{},"RequireConfirmedAccount"," set to ",[237,655,656],{},"true"," (the default), an unconfirmed user cannot sign in, so that user cannot call this endpoint. Resend helps only when ",[237,659,652],{}," is ",[237,662,663],{},"false",", or after a signed-in user changes their email. There is no anonymous resend endpoint.",[229,666,668],{"id":667},"authorization","Authorization",[209,670,671],{},"Management authorize attribute accepts registered schemes among: application cookie, Identity bearer, and JWT bearer.",[209,673,674,675,610,679,266],{},"Sensitive manage mutations require ",[676,677,678],"strong",{},"antiforgery",[676,680,449],{},[229,682,684],{"id":683},"gotchas","Gotchas",[686,687,688,700,707],"ul",{},[689,690,691,692,695,696,227],"li",{},"Map management ",[676,693,694],{},"once"," in production (see ",[213,697,699],{"href":698},"\u002Fcomposables\u002Frequirements\u002F","Requirements",[689,701,702,703,706],{},"Production requires a real ",[237,704,705],{},"IEmailSender\u003CTUser>"," for confirmation and reset emails.",[689,708,709],{},"Register alone does not sign the user in — use a sign-in module.",[229,711,713],{"id":712},"related","Related",[686,715,716,721,725,730,735],{},[689,717,718],{},[213,719,720],{"href":698},"Composable requirements",[689,722,723],{},[213,724,449],{"href":448},[689,726,727],{},[213,728,41],{"href":729},"\u002Fguides\u002Fregistration\u002F",[689,731,732],{},[213,733,61],{"href":734},"\u002Fguides\u002Freset-password\u002F",[689,736,737],{},[213,738,66],{"href":739},"\u002Fguides\u002Fmanage-account\u002F",[741,742,743],"style",{},"html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":251,"searchDepth":258,"depth":300,"links":745},[746,747,748,752,753,754],{"id":231,"depth":300,"text":232},{"id":243,"depth":300,"text":244},{"id":313,"depth":300,"text":314,"children":749},[750,751],{"id":536,"depth":307,"text":537},{"id":631,"depth":307,"text":632},{"id":667,"depth":300,"text":668},{"id":683,"depth":300,"text":684},{"id":712,"depth":300,"text":713},"Account lifecycle endpoints — register, confirm, forgot\u002Freset password, manage info and 2FA.","md",null,{},{"icon":69},{"title":126,"description":755},"XNS6qWbimTXSWulMpg0kPk8UHNuyGBgr1h8R2N-DylY",[763,765],{"title":121,"path":122,"stem":123,"description":764,"icon":124,"children":-1},"Every route that AuthEndpoints maps, with its auth, CSRF, ReAuth, and rate-limit requirements.",{"title":130,"path":131,"stem":132,"description":766,"icon":133,"children":-1},"Identity cookie login, logout, and CSRF token endpoints for browser\u002Fweb clients.",1791123627930]