[{"data":1,"prerenderedAt":1399},["ShallowReactive",2],{"navigation":3,"\u002Fmodules\u002Fpassword-auth":214,"\u002Fmodules\u002Fpassword-auth-surround":1394},[4,43,105,113,188],{"title":5,"path":6,"stem":7,"children":8,"icon":42},"Get started","\u002Fgetting-started","1.getting-started\u002F1.index",[9,12,17,22,27,32,37],{"title":10,"path":6,"stem":7,"icon":11},"Introduction","i-lucide-house",{"title":13,"path":14,"stem":15,"icon":16},"Install","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F2.installation","i-lucide-download",{"title":18,"path":19,"stem":20,"icon":21},"Quick start","\u002Fgetting-started\u002Fquick-start","1.getting-started\u002F3.quick-start","i-lucide-play",{"title":23,"path":24,"stem":25,"icon":26},"Choose your setup","\u002Fgetting-started\u002Fchoose-a-sign-in-stack","1.getting-started\u002F4.choose-a-sign-in-stack","i-lucide-signpost",{"title":28,"path":29,"stem":30,"icon":31},"Browser clients","\u002Fgetting-started\u002Fbrowser-clients","1.getting-started\u002F5.browser-clients","i-lucide-globe",{"title":33,"path":34,"stem":35,"icon":36},"Coding agents","\u002Fgetting-started\u002Fai-agents","1.getting-started\u002F6.ai-agents","i-lucide-bot",{"title":38,"path":39,"stem":40,"icon":41},"Upgrade from 3.x","\u002Fgetting-started\u002Fupgrading-to-4","1.getting-started\u002F8.upgrading-to-4","i-lucide-arrow-up-right","i-lucide-rocket",{"title":44,"icon":45,"path":46,"stem":47,"children":48,"page":104},"Guides","i-lucide-waypoints","\u002Fguides","2.guides",[49,54,59,64,69,74,79,84,89,94,99],{"title":50,"path":51,"stem":52,"icon":53},"Register users","\u002Fguides\u002Fregistration","2.guides\u002F02.registration","i-lucide-user-plus",{"title":55,"path":56,"stem":57,"icon":58},"Sign users in","\u002Fguides\u002Fsign-in","2.guides\u002F03.sign-in","i-lucide-log-in",{"title":60,"path":61,"stem":62,"icon":63},"Sign users out","\u002Fguides\u002Fsign-out","2.guides\u002F04.sign-out","i-lucide-log-out",{"title":65,"path":66,"stem":67,"icon":68},"Two-factor auth","\u002Fguides\u002Ftwo-factor","2.guides\u002F05.two-factor","i-lucide-smartphone",{"title":70,"path":71,"stem":72,"icon":73},"Email-code sign-in","\u002Fguides\u002Femail-code","2.guides\u002F06.email-code","i-lucide-mail",{"title":75,"path":76,"stem":77,"icon":78},"Reset a password","\u002Fguides\u002Freset-password","2.guides\u002F07.reset-password","i-lucide-key-round",{"title":80,"path":81,"stem":82,"icon":83},"Manage account","\u002Fguides\u002Fmanage-account","2.guides\u002F08.manage-account","i-lucide-user-cog",{"title":85,"path":86,"stem":87,"icon":88},"Manage passkeys","\u002Fguides\u002Fmanage-passkeys","2.guides\u002F09.manage-passkeys","i-lucide-scan-face",{"title":90,"path":91,"stem":92,"icon":93},"Link accounts","\u002Fguides\u002Flink-external-accounts","2.guides\u002F10.link-external-accounts","i-lucide-link",{"title":95,"path":96,"stem":97,"icon":98},"Require step-up","\u002Fguides\u002Fstep-up","2.guides\u002F11.step-up","i-lucide-shield-check",{"title":100,"path":101,"stem":102,"icon":103},"No public sign-up","\u002Fguides\u002Finternal-app","2.guides\u002F12.internal-app","i-lucide-building-2",false,{"title":106,"path":107,"stem":108,"children":109,"icon":112},"Composables","\u002Fcomposables","3.composables\u002F1.index",[110],{"title":111,"path":107,"stem":108,"icon":112},"Build a custom stack","i-lucide-blocks",{"title":114,"icon":115,"path":116,"stem":117,"children":118,"page":104},"Reference","i-lucide-book-open","\u002Fmodules","4.modules",[119,124,128,133,137,142,147,152,156,161,165,170,174,179,184],{"title":120,"path":121,"stem":122,"icon":123},"Endpoint reference","\u002Fmodules\u002Fendpoints","4.modules\u002F01.endpoints","i-lucide-route",{"title":125,"path":126,"stem":127,"icon":78},"Password auth","\u002Fmodules\u002Fpassword-auth","4.modules\u002F02.password-auth",{"title":129,"path":130,"stem":131,"icon":132},"Composition table","\u002Fmodules\u002Fcomposition","4.modules\u002F03.composition","i-lucide-table",{"title":134,"path":135,"stem":136,"icon":83},"Identity module","\u002Fmodules\u002Fidentity-management","4.modules\u002F04.identity-management",{"title":138,"path":139,"stem":140,"icon":141},"Cookie sign-in","\u002Fmodules\u002Fcookie-auth","4.modules\u002F05.cookie-auth","i-lucide-cookie",{"title":143,"path":144,"stem":145,"icon":146},"Identity bearer","\u002Fmodules\u002Fbearer-auth","4.modules\u002F06.bearer-auth","i-lucide-key",{"title":148,"path":149,"stem":150,"icon":151},"JWT","\u002Fmodules\u002Fjwt","4.modules\u002F07.jwt","i-lucide-fingerprint",{"title":153,"path":154,"stem":155,"icon":88},"Passkeys","\u002Fmodules\u002Fpasskeys","4.modules\u002F08.passkeys",{"title":157,"path":158,"stem":159,"icon":160},"Step-up ReAuth","\u002Fmodules\u002Freauth","4.modules\u002F09.reauth","i-lucide-shield-alert",{"title":162,"path":163,"stem":164,"icon":58},"External OAuth","\u002Fmodules\u002Fexternal-oauth","4.modules\u002F10.external-oauth",{"title":166,"path":167,"stem":168,"icon":169},"Configuration","\u002Fmodules\u002Fconfiguration","4.modules\u002F11.configuration","i-lucide-settings",{"title":171,"path":172,"stem":173,"icon":98},"CSRF rules","\u002Fmodules\u002Fcsrf","4.modules\u002F12.csrf",{"title":175,"path":176,"stem":177,"icon":178},"Responses","\u002Fmodules\u002Ferrors","4.modules\u002F13.errors","i-lucide-circle-alert",{"title":180,"path":181,"stem":182,"icon":183},"Rate-limit policies","\u002Fmodules\u002Frate-limits","4.modules\u002F14.rate-limits","i-lucide-gauge",{"title":185,"path":186,"stem":187,"icon":73},"Email codes","\u002Fmodules\u002Femail-code","4.modules\u002F15.email-code",{"title":189,"icon":190,"path":191,"stem":192,"children":193,"page":104},"Concepts","i-lucide-lightbulb","\u002Fconcepts","5.concepts",[194,199,204,209],{"title":195,"path":196,"stem":197,"icon":198},"Comparison","\u002Fconcepts\u002Fcompare","5.concepts\u002F1.compare","i-lucide-git-compare",{"title":200,"path":201,"stem":202,"icon":203},"Security model","\u002Fconcepts\u002Fsecurity-model","5.concepts\u002F2.security-model","i-lucide-shield",{"title":205,"path":206,"stem":207,"icon":208},"Production","\u002Fconcepts\u002Fproduction","5.concepts\u002F3.production","i-lucide-factory",{"title":210,"path":211,"stem":212,"icon":213},"FAQ","\u002Fconcepts\u002Ffaq","5.concepts\u002F4.faq","i-lucide-circle-help",{"id":215,"title":216,"body":217,"description":1387,"extension":1388,"faq":104,"links":1389,"meta":1390,"navigation":1391,"path":126,"seo":1392,"stem":127,"__hash__":1393},"docs\u002F4.modules\u002F02.password-auth.md","Password auth: one session under \u002Fauth",{"type":218,"value":219,"toc":1380},"minimark",[220,232,270,294,299,380,414,421,425,440,603,624,633,637,665,688,705,728,732,739,1115,1118,1238,1241,1276,1279,1319,1344,1348,1376],[221,222,223,227,228,231],"p",{},[224,225,226],"code",{},"AddPasswordAuth\u003CTUser, TContext>"," and ",[224,229,230],{},"MapPasswordAuth\u003CTUser>"," are the password facade. One call registers Identity, password sign-up, sign-in, and recovery, account management, and one session. Cookie is the default. JWT is the other session. The facade adds no routes of its own. It expands to the building-block calls on this page.",[221,233,234,237,238,241,242,237,245,248,249,252,253,256,257,259,260,263,264,269],{},[224,235,236],{},"TUser"," is a ",[224,239,240],{},"class"," with a public parameterless constructor. ",[224,243,244],{},"TContext",[224,246,247],{},"DbContext",". There is no role overload. Calling ",[224,250,251],{},"AddPasswordAuth"," twice throws. ",[224,254,255],{},"MapPasswordAuth"," without ",[224,258,251],{}," throws ",[224,261,262],{},"InvalidOperationException",". The message is in ",[265,266,268],"a",{"href":267},"\u002Fcomposables\u002F#what-you-compose","What you compose",".",[221,271,272,273,277,278,282,283,227,286,289,290,269],{},"The tutorial is the ",[265,274,276],{"href":275},"\u002Fgetting-started\u002Fquick-start\u002F","quick start",". Options are in ",[265,279,281],{"href":280},"\u002Fmodules\u002Fconfiguration\u002F#passwordauthoptions","Configuration options",". Routes for each ",[224,284,285],{},"Add*",[224,287,288],{},"Map*"," pair are in the ",[265,291,293],{"href":292},"\u002Fmodules\u002Fcomposition\u002F","composition table",[295,296,298],"h2",{"id":297},"cookie-session","Cookie session",[300,301,306],"pre",{"className":302,"code":303,"language":304,"meta":305,"style":305},"language-cs shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","builder.Services.AddPasswordAuth\u003CAppUser, AppDbContext>();\n\napp.UseAuthEndpoints();\napp.MapPasswordAuth\u003CAppUser>();\n","cs","",[224,307,308,344,351,365],{"__ignoreMap":305},[309,310,313,317,320,323,325,328,331,335,338,341],"span",{"class":311,"line":312},"line",1,[309,314,316],{"class":315},"sTEyZ","builder",[309,318,269],{"class":319},"sMK4o",[309,321,322],{"class":315},"Services",[309,324,269],{"class":319},[309,326,251],{"class":327},"s2Zo4",[309,329,330],{"class":319},"\u003C",[309,332,334],{"class":333},"sBMFI","AppUser",[309,336,337],{"class":319},",",[309,339,340],{"class":333}," AppDbContext",[309,342,343],{"class":319},">();\n",[309,345,347],{"class":311,"line":346},2,[309,348,350],{"emptyLinePlaceholder":349},true,"\n",[309,352,354,357,359,362],{"class":311,"line":353},3,[309,355,356],{"class":315},"app",[309,358,269],{"class":319},[309,360,361],{"class":327},"UseAuthEndpoints",[309,363,364],{"class":319},"();\n",[309,366,368,370,372,374,376,378],{"class":311,"line":367},4,[309,369,356],{"class":315},[309,371,269],{"class":319},[309,373,255],{"class":327},[309,375,330],{"class":319},[309,377,334],{"class":333},[309,379,343],{"class":319},[221,381,382,383,386,387,390,391,394,395,398,399,402,403,406,407,410,411,269],{},"Every route is under ",[224,384,385],{},"\u002Fauth"," (",[224,388,389],{},"PasswordAuthOptions.Path","). Password sign-in is ",[224,392,393],{},"POST \u002Fauth\u002Flogin",". It does not use antiforgery. ",[224,396,397],{},"GET \u002Fauth\u002FcsrfToken"," issues the token for logout, manage ",[224,400,401],{},"POST"," routes, and step-up. ",[224,404,405],{},"RequireConfirmedAccount"," defaults to ",[224,408,409],{},"true",", so login before confirm is ",[224,412,413],{},"401",[221,415,416,417,420],{},"Passkeys stay off until ",[224,418,419],{},"Passkeys.ServerDomain"," is set. Email-code sign-in and external sign-in are not mapped.",[295,422,424],{"id":423},"jwt-session","JWT session",[221,426,427,428,431,432,435,436,439],{},"Set ",[224,429,430],{},"Session"," to ",[224,433,434],{},"AuthEndpointsSession.Jwt"," and pass ",[224,437,438],{},"Jwt",". The callback is required. A missing signing key fails while the host is being built.",[300,441,443],{"className":302,"code":442,"language":304,"meta":305,"style":305},"builder.Services.AddPasswordAuth\u003CAppUser, AppDbContext>(o =>\n{\n    o.Session = AuthEndpointsSession.Jwt;\n    o.Jwt = jwt =>\n    {\n        jwt.Issuer = \"https:\u002F\u002Fexample.com\";\n        jwt.Audience = \"https:\u002F\u002Fexample.com\";\n        jwt.SigningOptions.SymmetricKey = key;\n    };\n});\n",[224,444,445,474,479,502,518,524,549,569,591,597],{"__ignoreMap":305},[309,446,447,449,451,453,455,457,459,461,463,465,468,471],{"class":311,"line":312},[309,448,316],{"class":315},[309,450,269],{"class":319},[309,452,322],{"class":315},[309,454,269],{"class":319},[309,456,251],{"class":327},[309,458,330],{"class":319},[309,460,334],{"class":333},[309,462,337],{"class":319},[309,464,340],{"class":333},[309,466,467],{"class":319},">(",[309,469,470],{"class":333},"o",[309,472,473],{"class":319}," =>\n",[309,475,476],{"class":311,"line":346},[309,477,478],{"class":319},"{\n",[309,480,481,484,486,489,492,495,497,499],{"class":311,"line":353},[309,482,483],{"class":315},"    o",[309,485,269],{"class":319},[309,487,488],{"class":315},"Session ",[309,490,491],{"class":319},"=",[309,493,494],{"class":315}," AuthEndpointsSession",[309,496,269],{"class":319},[309,498,438],{"class":315},[309,500,501],{"class":319},";\n",[309,503,504,506,508,511,513,516],{"class":311,"line":367},[309,505,483],{"class":315},[309,507,269],{"class":319},[309,509,510],{"class":315},"Jwt ",[309,512,491],{"class":319},[309,514,515],{"class":333}," jwt",[309,517,473],{"class":319},[309,519,521],{"class":311,"line":520},5,[309,522,523],{"class":319},"    {\n",[309,525,527,530,532,535,537,540,544,547],{"class":311,"line":526},6,[309,528,529],{"class":315},"        jwt",[309,531,269],{"class":319},[309,533,534],{"class":315},"Issuer ",[309,536,491],{"class":319},[309,538,539],{"class":319}," \"",[309,541,543],{"class":542},"sfazB","https:\u002F\u002Fexample.com",[309,545,546],{"class":319},"\"",[309,548,501],{"class":319},[309,550,552,554,556,559,561,563,565,567],{"class":311,"line":551},7,[309,553,529],{"class":315},[309,555,269],{"class":319},[309,557,558],{"class":315},"Audience ",[309,560,491],{"class":319},[309,562,539],{"class":319},[309,564,543],{"class":542},[309,566,546],{"class":319},[309,568,501],{"class":319},[309,570,572,574,576,579,581,584,586,589],{"class":311,"line":571},8,[309,573,529],{"class":315},[309,575,269],{"class":319},[309,577,578],{"class":315},"SigningOptions",[309,580,269],{"class":319},[309,582,583],{"class":315},"SymmetricKey ",[309,585,491],{"class":319},[309,587,588],{"class":315}," key",[309,590,501],{"class":319},[309,592,594],{"class":311,"line":593},9,[309,595,596],{"class":319},"    };\n",[309,598,600],{"class":311,"line":599},10,[309,601,602],{"class":319},"});\n",[221,604,605,606,609,610,612,613,616,617,619,620,623],{},"Password sign-in is ",[224,607,608],{},"POST \u002Fauth\u002Fcreate",", not ",[224,611,393],{},". Refresh transport, the refresh cookie, and body transport are in ",[265,614,148],{"href":615},"\u002Fmodules\u002Fjwt\u002F#options",". The ",[224,618,247],{}," calls ",[224,621,622],{},"UseRefreshToken()",", and you add a migration before production.",[221,625,626,628,629,632],{},[224,627,430],{}," ",[224,630,631],{},"IdentityBearer"," fails startup validation.",[295,634,636],{"id":635},"what-the-map-includes","What the map includes",[221,638,639,640,643,644,647,648,651,652,651,655,651,658,651,661,664],{},"Cookie session maps register, ",[224,641,642],{},"POST \u002Flogin",", forgot-password, reset-password, logout, ",[224,645,646],{},"GET \u002FcsrfToken",", confirm-email, resend, and account management (",[224,649,650],{},"\u002Fmanage\u002Finfo",", ",[224,653,654],{},"\u002Fmanage\u002F2fa",[224,656,657],{},"\u002Fmanage\u002FauthMethods",[224,659,660],{},"\u002Fmanage\u002Fpassword",[224,662,663],{},"\u002FconfirmIdentity",").",[221,666,667,668,651,671,651,674,677,678,681,682,684,685,687],{},"JWT session uses the same management, recovery, and confirm-email routes. It maps ",[224,669,670],{},"POST \u002Fcreate",[224,672,673],{},"POST \u002Frefresh",[224,675,676],{},"GET \u002Fverify",", and ",[224,679,680],{},"POST \u002Flogout"," instead of ",[224,683,642],{},". Cookie refresh also maps ",[224,686,646],{},". Body refresh omits that route.",[221,689,690,691,693,694,697,698,701,702,269],{},"When ",[224,692,419],{}," is set, the same prefix also maps passkey sign-in and passkey management, plus ",[224,695,696],{},"POST \u002FconfirmIdentity\u002FpasskeyOptions",". Passkey sign-in includes ",[224,699,700],{},"POST \u002Fpasskeys\u002Fregister",". See ",[265,703,153],{"href":704},"\u002Fmodules\u002Fpasskeys\u002F#map",[221,706,707,651,709,677,712,714,715,717,718,721,722,725,726,269],{},[224,708,430],{},[224,710,711],{},"Path",[224,713,419],{}," are fixed by the ",[224,716,251],{}," callback. A later ",[224,719,720],{},"Configure\u003CPasswordAuthOptions>"," that changes any of them fails validation. ",[224,723,724],{},"EmailConfirmation"," can still be configured later. The option table is in ",[265,727,281],{"href":280},[295,729,731],{"id":730},"building-block-expansion","Building-block expansion",[221,733,734,227,736,738],{},[224,735,251],{},[224,737,255],{}," expand to these calls. Copy them when you leave the facade.",[300,740,742],{"className":302,"code":741,"language":304,"meta":305,"style":305},"services.AddAuthEndpointsIdentity\u003CTUser, TContext>(identity =>\n{\n    identity.SignIn.RequireConfirmedAccount = options.RequireConfirmedAccount;\n    options.ConfigureIdentity?.Invoke(identity);\n});\nservices.AddPasswordSignUpEndpoints();\nservices.AddPasswordSignInEndpoints();\nservices.AddPasswordRecoveryEndpoints();\nservices.AddAccountManagementEndpoints();\n\n\u002F\u002F Cookie session:\nservices.AddCookieSessionEndpoints();\n\n\u002F\u002F JWT session (options.Jwt is required).\n\u002F\u002F AddJwtEndpoints copies a non-default SimpleJwtOptions.RefreshTokenTransport.\nservices.AddJwtEndpoints\u003CTUser, TContext>(options.Jwt);\n\n\u002F\u002F When Passkeys.ServerDomain is set:\nservices.AddPasskeyEndpoints\u003CTUser>();\nservices.Configure\u003CIdentityPasskeyOptions>(passkeys => passkeys.ServerDomain = options.Passkeys.ServerDomain);\n\n\u002F\u002F Confirm-email redirect, read by the shared handler:\nservices.Configure\u003CAuthEndpointsOptions>(auth =>\n{\n    auth.EmailConfirmation.ConfirmEmailRedirectUri = options.EmailConfirmation.ConfirmEmailRedirectUri;\n    auth.EmailConfirmation.AllowedRedirectOrigins = options.EmailConfirmation.AllowedRedirectOrigins;\n});\n",[224,743,744,770,774,800,824,828,839,850,861,872,876,883,895,900,906,912,941,946,952,968,1014,1019,1025,1046,1051,1081,1110],{"__ignoreMap":305},[309,745,746,749,751,754,756,758,760,763,765,768],{"class":311,"line":312},[309,747,748],{"class":315},"services",[309,750,269],{"class":319},[309,752,753],{"class":327},"AddAuthEndpointsIdentity",[309,755,330],{"class":319},[309,757,236],{"class":333},[309,759,337],{"class":319},[309,761,762],{"class":333}," TContext",[309,764,467],{"class":319},[309,766,767],{"class":333},"identity",[309,769,473],{"class":319},[309,771,772],{"class":311,"line":346},[309,773,478],{"class":319},[309,775,776,779,781,784,786,789,791,794,796,798],{"class":311,"line":353},[309,777,778],{"class":315},"    identity",[309,780,269],{"class":319},[309,782,783],{"class":315},"SignIn",[309,785,269],{"class":319},[309,787,788],{"class":315},"RequireConfirmedAccount ",[309,790,491],{"class":319},[309,792,793],{"class":315}," options",[309,795,269],{"class":319},[309,797,405],{"class":315},[309,799,501],{"class":319},[309,801,802,805,807,810,813,816,819,821],{"class":311,"line":367},[309,803,804],{"class":315},"    options",[309,806,269],{"class":319},[309,808,809],{"class":315},"ConfigureIdentity",[309,811,812],{"class":319},"?.",[309,814,815],{"class":327},"Invoke",[309,817,818],{"class":319},"(",[309,820,767],{"class":315},[309,822,823],{"class":319},");\n",[309,825,826],{"class":311,"line":520},[309,827,602],{"class":319},[309,829,830,832,834,837],{"class":311,"line":526},[309,831,748],{"class":315},[309,833,269],{"class":319},[309,835,836],{"class":327},"AddPasswordSignUpEndpoints",[309,838,364],{"class":319},[309,840,841,843,845,848],{"class":311,"line":551},[309,842,748],{"class":315},[309,844,269],{"class":319},[309,846,847],{"class":327},"AddPasswordSignInEndpoints",[309,849,364],{"class":319},[309,851,852,854,856,859],{"class":311,"line":571},[309,853,748],{"class":315},[309,855,269],{"class":319},[309,857,858],{"class":327},"AddPasswordRecoveryEndpoints",[309,860,364],{"class":319},[309,862,863,865,867,870],{"class":311,"line":593},[309,864,748],{"class":315},[309,866,269],{"class":319},[309,868,869],{"class":327},"AddAccountManagementEndpoints",[309,871,364],{"class":319},[309,873,874],{"class":311,"line":599},[309,875,350],{"emptyLinePlaceholder":349},[309,877,879],{"class":311,"line":878},11,[309,880,882],{"class":881},"sHwdD","\u002F\u002F Cookie session:\n",[309,884,886,888,890,893],{"class":311,"line":885},12,[309,887,748],{"class":315},[309,889,269],{"class":319},[309,891,892],{"class":327},"AddCookieSessionEndpoints",[309,894,364],{"class":319},[309,896,898],{"class":311,"line":897},13,[309,899,350],{"emptyLinePlaceholder":349},[309,901,903],{"class":311,"line":902},14,[309,904,905],{"class":881},"\u002F\u002F JWT session (options.Jwt is required).\n",[309,907,909],{"class":311,"line":908},15,[309,910,911],{"class":881},"\u002F\u002F AddJwtEndpoints copies a non-default SimpleJwtOptions.RefreshTokenTransport.\n",[309,913,915,917,919,922,924,926,928,930,932,935,937,939],{"class":311,"line":914},16,[309,916,748],{"class":315},[309,918,269],{"class":319},[309,920,921],{"class":327},"AddJwtEndpoints",[309,923,330],{"class":319},[309,925,236],{"class":333},[309,927,337],{"class":319},[309,929,762],{"class":333},[309,931,467],{"class":319},[309,933,934],{"class":315},"options",[309,936,269],{"class":319},[309,938,438],{"class":315},[309,940,823],{"class":319},[309,942,944],{"class":311,"line":943},17,[309,945,350],{"emptyLinePlaceholder":349},[309,947,949],{"class":311,"line":948},18,[309,950,951],{"class":881},"\u002F\u002F When Passkeys.ServerDomain is set:\n",[309,953,955,957,959,962,964,966],{"class":311,"line":954},19,[309,956,748],{"class":315},[309,958,269],{"class":319},[309,960,961],{"class":327},"AddPasskeyEndpoints",[309,963,330],{"class":319},[309,965,236],{"class":333},[309,967,343],{"class":319},[309,969,971,973,975,978,980,983,985,988,991,994,996,999,1001,1003,1005,1007,1009,1012],{"class":311,"line":970},20,[309,972,748],{"class":315},[309,974,269],{"class":319},[309,976,977],{"class":327},"Configure",[309,979,330],{"class":319},[309,981,982],{"class":333},"IdentityPasskeyOptions",[309,984,467],{"class":319},[309,986,987],{"class":333},"passkeys",[309,989,990],{"class":319}," =>",[309,992,993],{"class":315}," passkeys",[309,995,269],{"class":319},[309,997,998],{"class":315},"ServerDomain ",[309,1000,491],{"class":319},[309,1002,793],{"class":315},[309,1004,269],{"class":319},[309,1006,153],{"class":315},[309,1008,269],{"class":319},[309,1010,1011],{"class":315},"ServerDomain",[309,1013,823],{"class":319},[309,1015,1017],{"class":311,"line":1016},21,[309,1018,350],{"emptyLinePlaceholder":349},[309,1020,1022],{"class":311,"line":1021},22,[309,1023,1024],{"class":881},"\u002F\u002F Confirm-email redirect, read by the shared handler:\n",[309,1026,1028,1030,1032,1034,1036,1039,1041,1044],{"class":311,"line":1027},23,[309,1029,748],{"class":315},[309,1031,269],{"class":319},[309,1033,977],{"class":327},[309,1035,330],{"class":319},[309,1037,1038],{"class":333},"AuthEndpointsOptions",[309,1040,467],{"class":319},[309,1042,1043],{"class":333},"auth",[309,1045,473],{"class":319},[309,1047,1049],{"class":311,"line":1048},24,[309,1050,478],{"class":319},[309,1052,1054,1057,1059,1061,1063,1066,1068,1070,1072,1074,1076,1079],{"class":311,"line":1053},25,[309,1055,1056],{"class":315},"    auth",[309,1058,269],{"class":319},[309,1060,724],{"class":315},[309,1062,269],{"class":319},[309,1064,1065],{"class":315},"ConfirmEmailRedirectUri ",[309,1067,491],{"class":319},[309,1069,793],{"class":315},[309,1071,269],{"class":319},[309,1073,724],{"class":315},[309,1075,269],{"class":319},[309,1077,1078],{"class":315},"ConfirmEmailRedirectUri",[309,1080,501],{"class":319},[309,1082,1084,1086,1088,1090,1092,1095,1097,1099,1101,1103,1105,1108],{"class":311,"line":1083},26,[309,1085,1056],{"class":315},[309,1087,269],{"class":319},[309,1089,724],{"class":315},[309,1091,269],{"class":319},[309,1093,1094],{"class":315},"AllowedRedirectOrigins ",[309,1096,491],{"class":319},[309,1098,793],{"class":315},[309,1100,269],{"class":319},[309,1102,724],{"class":315},[309,1104,269],{"class":319},[309,1106,1107],{"class":315},"AllowedRedirectOrigins",[309,1109,501],{"class":319},[309,1111,1113],{"class":311,"line":1112},27,[309,1114,602],{"class":319},[221,1116,1117],{},"Map under one group. Cookie session:",[300,1119,1121],{"className":302,"code":1120,"language":304,"meta":305,"style":305},"var group = app.MapGroup(\"\u002Fauth\");\ngroup.MapPasswordSignUpEndpoints\u003CTUser>();\ngroup.MapPasswordSignInEndpoints\u003CTUser>(AuthEndpointsSession.Cookie);\ngroup.MapPasswordRecoveryEndpoints\u003CTUser>();\ngroup.MapCookieSessionEndpoints\u003CTUser>();\ngroup.MapAccountManagementEndpoints\u003CTUser>();\n",[224,1122,1123,1152,1168,1193,1208,1223],{"__ignoreMap":305},[309,1124,1125,1128,1131,1134,1137,1139,1142,1144,1146,1148,1150],{"class":311,"line":312},[309,1126,1127],{"class":333},"var",[309,1129,1130],{"class":333}," group",[309,1132,1133],{"class":319}," =",[309,1135,1136],{"class":315}," app",[309,1138,269],{"class":319},[309,1140,1141],{"class":327},"MapGroup",[309,1143,818],{"class":319},[309,1145,546],{"class":319},[309,1147,385],{"class":542},[309,1149,546],{"class":319},[309,1151,823],{"class":319},[309,1153,1154,1157,1159,1162,1164,1166],{"class":311,"line":346},[309,1155,1156],{"class":315},"group",[309,1158,269],{"class":319},[309,1160,1161],{"class":327},"MapPasswordSignUpEndpoints",[309,1163,330],{"class":319},[309,1165,236],{"class":333},[309,1167,343],{"class":319},[309,1169,1170,1172,1174,1177,1179,1181,1183,1186,1188,1191],{"class":311,"line":353},[309,1171,1156],{"class":315},[309,1173,269],{"class":319},[309,1175,1176],{"class":327},"MapPasswordSignInEndpoints",[309,1178,330],{"class":319},[309,1180,236],{"class":333},[309,1182,467],{"class":319},[309,1184,1185],{"class":315},"AuthEndpointsSession",[309,1187,269],{"class":319},[309,1189,1190],{"class":315},"Cookie",[309,1192,823],{"class":319},[309,1194,1195,1197,1199,1202,1204,1206],{"class":311,"line":367},[309,1196,1156],{"class":315},[309,1198,269],{"class":319},[309,1200,1201],{"class":327},"MapPasswordRecoveryEndpoints",[309,1203,330],{"class":319},[309,1205,236],{"class":333},[309,1207,343],{"class":319},[309,1209,1210,1212,1214,1217,1219,1221],{"class":311,"line":520},[309,1211,1156],{"class":315},[309,1213,269],{"class":319},[309,1215,1216],{"class":327},"MapCookieSessionEndpoints",[309,1218,330],{"class":319},[309,1220,236],{"class":333},[309,1222,343],{"class":319},[309,1224,1225,1227,1229,1232,1234,1236],{"class":311,"line":526},[309,1226,1156],{"class":315},[309,1228,269],{"class":319},[309,1230,1231],{"class":327},"MapAccountManagementEndpoints",[309,1233,330],{"class":319},[309,1235,236],{"class":333},[309,1237,343],{"class":319},[221,1239,1240],{},"JWT session replaces the sign-in and session lines:",[300,1242,1244],{"className":302,"code":1243,"language":304,"meta":305,"style":305},"group.MapJwtPasswordEndpoints\u003CTUser>();\ngroup.MapJwtSessionEndpoints\u003CTUser>();\n",[224,1245,1246,1261],{"__ignoreMap":305},[309,1247,1248,1250,1252,1255,1257,1259],{"class":311,"line":312},[309,1249,1156],{"class":315},[309,1251,269],{"class":319},[309,1253,1254],{"class":327},"MapJwtPasswordEndpoints",[309,1256,330],{"class":319},[309,1258,236],{"class":333},[309,1260,343],{"class":319},[309,1262,1263,1265,1267,1270,1272,1274],{"class":311,"line":346},[309,1264,1156],{"class":315},[309,1266,269],{"class":319},[309,1268,1269],{"class":327},"MapJwtSessionEndpoints",[309,1271,330],{"class":319},[309,1273,236],{"class":333},[309,1275,343],{"class":319},[221,1277,1278],{},"When passkeys are on, the same group also calls:",[300,1280,1282],{"className":302,"code":1281,"language":304,"meta":305,"style":305},"group.MapPasskeySignInEndpoints\u003CTUser>(session);\ngroup.MapPasskeyManagementEndpoints\u003CTUser>();\n",[224,1283,1284,1304],{"__ignoreMap":305},[309,1285,1286,1288,1290,1293,1295,1297,1299,1302],{"class":311,"line":312},[309,1287,1156],{"class":315},[309,1289,269],{"class":319},[309,1291,1292],{"class":327},"MapPasskeySignInEndpoints",[309,1294,330],{"class":319},[309,1296,236],{"class":333},[309,1298,467],{"class":319},[309,1300,1301],{"class":315},"session",[309,1303,823],{"class":319},[309,1305,1306,1308,1310,1313,1315,1317],{"class":311,"line":346},[309,1307,1156],{"class":315},[309,1309,269],{"class":319},[309,1311,1312],{"class":327},"MapPasskeyManagementEndpoints",[309,1314,330],{"class":319},[309,1316,236],{"class":333},[309,1318,343],{"class":319},[221,1320,1321,1323,1324,1327,1328,1330,1331,1334,1335,1337,1338,227,1341,269],{},[224,1322,1301],{}," is ",[224,1325,1326],{},"AuthEndpointsSession.Cookie"," or ",[224,1329,434],{},". Do not also call ",[224,1332,1333],{},"MapPasskeyRegisterOptionsEndpoints",". ",[224,1336,1292],{}," already maps ",[224,1339,1340],{},"register\u002Foptions",[224,1342,1343],{},"register",[295,1345,1347],{"id":1346},"related","Related",[1349,1350,1351,1356,1362,1366,1372],"ul",{},[1352,1353,1354],"li",{},[265,1355,18],{"href":275},[1352,1357,1358],{},[265,1359,1361],{"href":1360},"\u002Fgetting-started\u002Fchoose-a-sign-in-stack\u002F","Choose your sign-in setup",[1352,1363,1364],{},[265,1365,129],{"href":292},[1352,1367,1368],{},[265,1369,1371],{"href":1370},"\u002Fgetting-started\u002Fupgrading-to-4\u002F","Upgrade to 4.0",[1352,1373,1374],{},[265,1375,281],{"href":280},[1377,1378,1379],"style",{},"html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}",{"title":305,"searchDepth":312,"depth":346,"links":1381},[1382,1383,1384,1385,1386],{"id":297,"depth":346,"text":298},{"id":423,"depth":346,"text":424},{"id":635,"depth":346,"text":636},{"id":730,"depth":346,"text":731},{"id":1346,"depth":346,"text":1347},"What AddPasswordAuth and MapPasswordAuth register and map, and the building-block calls they expand to.","md",null,{},{"title":125,"icon":78},{"title":216,"description":1387},"a-TyEFZR0u7B8HtkBSJ6n_KUK4mqOQMzlQYYIwP2JT8",[1395,1397],{"title":120,"path":121,"stem":122,"description":1396,"icon":123,"children":-1},"Every route that AuthEndpoints maps, with its auth, CSRF, ReAuth, and rate-limit requirements.",{"title":129,"path":130,"stem":131,"description":1398,"icon":132,"children":-1},"Add and Map pairs, the routes each one maps, whether the group is per session or shared, and which snapshots contain it.",1792403034132]