[{"data":1,"prerenderedAt":753},["ShallowReactive",2],{"navigation":3,"\u002Fmodules\u002Freauth":203,"\u002Fmodules\u002Freauth-surround":748},[4,33,96,114,177],{"title":5,"path":6,"stem":7,"children":8,"icon":32},"Get started","\u002Fgetting-started","1.getting-started\u002F1.index",[9,12,17,22,27],{"title":10,"path":6,"stem":7,"icon":11},"Introduction","i-lucide-house",{"title":13,"path":14,"stem":15,"icon":16},"Install AuthEndpoints","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F2.installation","i-lucide-download",{"title":18,"path":19,"stem":20,"icon":21},"Quick start","\u002Fgetting-started\u002Fquick-start","1.getting-started\u002F3.quick-start","i-lucide-play",{"title":23,"path":24,"stem":25,"icon":26},"Choose a sign-in stack","\u002Fgetting-started\u002Fchoose-a-sign-in-stack","1.getting-started\u002F4.choose-a-sign-in-stack","i-lucide-signpost",{"title":28,"path":29,"stem":30,"icon":31},"Use the AuthEndpoints skill with coding agents","\u002Fgetting-started\u002Fai-agents","1.getting-started\u002F5.ai-agents","i-lucide-bot","i-lucide-rocket",{"title":34,"path":35,"stem":36,"children":37,"icon":95},"Guides","\u002Fguides","2.guides\u002F01.index",[38,40,45,50,55,60,65,70,75,80,85,90],{"title":34,"path":35,"stem":36,"icon":39},"i-lucide-list-checks",{"title":41,"path":42,"stem":43,"icon":44},"Register users","\u002Fguides\u002Fregistration","2.guides\u002F02.registration","i-lucide-user-plus",{"title":46,"path":47,"stem":48,"icon":49},"Sign users in","\u002Fguides\u002Fsign-in","2.guides\u002F03.sign-in","i-lucide-log-in",{"title":51,"path":52,"stem":53,"icon":54},"Sign users out","\u002Fguides\u002Fsign-out","2.guides\u002F04.sign-out","i-lucide-log-out",{"title":56,"path":57,"stem":58,"icon":59},"Turn on two-factor authentication","\u002Fguides\u002Ftwo-factor","2.guides\u002F05.two-factor","i-lucide-smartphone",{"title":61,"path":62,"stem":63,"icon":64},"Reset a forgotten password","\u002Fguides\u002Freset-password","2.guides\u002F06.reset-password","i-lucide-key-round",{"title":66,"path":67,"stem":68,"icon":69},"Change a user's email or password","\u002Fguides\u002Fmanage-account","2.guides\u002F07.manage-account","i-lucide-user-cog",{"title":71,"path":72,"stem":73,"icon":74},"Add, rename, and remove passkeys","\u002Fguides\u002Fmanage-passkeys","2.guides\u002F08.manage-passkeys","i-lucide-scan-face",{"title":76,"path":77,"stem":78,"icon":79},"Link and unlink GitHub or Google accounts","\u002Fguides\u002Flink-external-accounts","2.guides\u002F09.link-external-accounts","i-lucide-link",{"title":81,"path":82,"stem":83,"icon":84},"Require step-up before sensitive actions","\u002Fguides\u002Fstep-up","2.guides\u002F10.step-up","i-lucide-shield-check",{"title":86,"path":87,"stem":88,"icon":89},"Call the API from a browser","\u002Fguides\u002Fbrowser-clients","2.guides\u002F11.browser-clients","i-lucide-globe",{"title":91,"path":92,"stem":93,"icon":94},"Prepare for production","\u002Fguides\u002Fproduction","2.guides\u002F12.production","i-lucide-factory","i-lucide-waypoints",{"title":97,"path":98,"stem":99,"children":100,"icon":113},"Composable endpoints","\u002Fcomposables","3.composables\u002F1.index",[101,104,108],{"title":102,"path":98,"stem":99,"icon":103},"How composition works","i-lucide-layout-grid",{"title":105,"path":106,"stem":107,"icon":39},"Composition requirements","\u002Fcomposables\u002Frequirements","3.composables\u002F2.requirements",{"title":109,"path":110,"stem":111,"icon":112},"Compose a custom auth stack","\u002Fcomposables\u002Frecipes","3.composables\u002F3.recipes","i-lucide-book-marked","i-lucide-blocks",{"title":115,"icon":116,"path":117,"stem":118,"children":119,"page":176},"Reference","i-lucide-book-open","\u002Fmodules","4.modules",[120,125,129,134,139,144,148,153,157,162,166,171],{"title":121,"path":122,"stem":123,"icon":124},"Endpoint reference","\u002Fmodules\u002Fendpoints","4.modules\u002F01.endpoints","i-lucide-route",{"title":126,"path":127,"stem":128,"icon":69},"Identity management module","\u002Fmodules\u002Fidentity-management","4.modules\u002F02.identity-management",{"title":130,"path":131,"stem":132,"icon":133},"Cookie sign-in module","\u002Fmodules\u002Fcookie-auth","4.modules\u002F03.cookie-auth","i-lucide-cookie",{"title":135,"path":136,"stem":137,"icon":138},"Identity bearer sign-in module","\u002Fmodules\u002Fbearer-auth","4.modules\u002F04.bearer-auth","i-lucide-key",{"title":140,"path":141,"stem":142,"icon":143},"JWT module","\u002Fmodules\u002Fjwt","4.modules\u002F05.jwt","i-lucide-fingerprint",{"title":145,"path":146,"stem":147,"icon":74},"Passkeys module","\u002Fmodules\u002Fpasskeys","4.modules\u002F06.passkeys",{"title":149,"path":150,"stem":151,"icon":152},"ReAuth module","\u002Fmodules\u002Freauth","4.modules\u002F07.reauth","i-lucide-shield-alert",{"title":154,"path":155,"stem":156,"icon":49},"External OAuth packages","\u002Fmodules\u002Fexternal-oauth","4.modules\u002F08.external-oauth",{"title":158,"path":159,"stem":160,"icon":161},"Configuration options","\u002Fmodules\u002Fconfiguration","4.modules\u002F09.configuration","i-lucide-settings",{"title":163,"path":164,"stem":165,"icon":84},"Antiforgery (CSRF) rules","\u002Fmodules\u002Fcsrf","4.modules\u002F10.csrf",{"title":167,"path":168,"stem":169,"icon":170},"Responses and errors","\u002Fmodules\u002Ferrors","4.modules\u002F11.errors","i-lucide-circle-alert",{"title":172,"path":173,"stem":174,"icon":175},"Rate-limit policies","\u002Fmodules\u002Frate-limits","4.modules\u002F12.rate-limits","i-lucide-gauge",false,{"title":178,"icon":179,"path":180,"stem":181,"children":182,"page":176},"Concepts","i-lucide-lightbulb","\u002Fconcepts","5.concepts",[183,188,193,198],{"title":184,"path":185,"stem":186,"icon":187},"AuthEndpoints compared with other options","\u002Fconcepts\u002Fcompare","5.concepts\u002F1.compare","i-lucide-git-compare",{"title":189,"path":190,"stem":191,"icon":192},"Stock Identity endpoints vs AuthEndpoints","\u002Fconcepts\u002Fstock-identity-vs-authendpoints","5.concepts\u002F2.stock-identity-vs-authendpoints","i-lucide-columns-2",{"title":194,"path":195,"stem":196,"icon":197},"Security model","\u002Fconcepts\u002Fsecurity-model","5.concepts\u002F3.security-model","i-lucide-shield",{"title":199,"path":200,"stem":201,"icon":202},"FAQ","\u002Fconcepts\u002Ffaq","5.concepts\u002F4.faq","i-lucide-circle-help",{"id":204,"title":149,"body":205,"description":741,"extension":742,"links":743,"meta":744,"navigation":745,"path":150,"seo":746,"stem":151,"__hash__":747},"docs\u002F4.modules\u002F07.reauth.md",{"type":206,"value":207,"toc":730},"minimark",[208,218,223,297,301,324,384,389,397,422,428,432,462,469,570,574,656,660,686,690,704,708,726],[209,210,211,212,217],"p",{},"ReAuth (step-up) confirms the user's identity before sensitive mutations. It is included when you map ",[213,214,216],"a",{"href":215},"\u002Fmodules\u002Fidentity-management\u002F","Identity management"," (with antiforgery in the management map).",[219,220,222],"h2",{"id":221},"schemes-and-header","Schemes and header",[224,225,226,239],"table",{},[227,228,229],"thead",{},[230,231,232,236],"tr",{},[233,234,235],"th",{},"Piece",[233,237,238],{},"Value",[240,241,242,259,269,283],"tbody",{},[230,243,244,248],{},[245,246,247],"td",{},"Cookie scheme",[245,249,250,254,255,258],{},[251,252,253],"code",{},"AuthEndpoints.ReAuth"," (default 5 minutes, ",[251,256,257],{},"ReAuth.Lifetime",")",[230,260,261,264],{},[245,262,263],{},"Bearer scheme",[245,265,266],{},[251,267,268],{},"AuthEndpoints.ReAuth.Bearer",[230,270,271,274],{},[245,272,273],{},"Header",[245,275,276,279,280],{},[251,277,278],{},"X-AuthEndpoints-Reauth"," with ",[251,281,282],{},"reauthToken",[230,284,285,288],{},[245,286,287],{},"Policy",[245,289,290,293,294,258],{},[251,291,292],{},"ReAuthPolicy"," (claim ",[251,295,296],{},"Reauth=true",[219,298,300],{"id":299},"routes","Routes",[209,302,303,304,307,308,311,312,315,316,319,320,323],{},"Mapped with management (facade under ",[251,305,306],{},"\u002Fidentity","). Both ",[251,309,310],{},"POST"," routes require authorization and the ",[251,313,314],{},"AuthEndpoints.ConfirmIdentity"," rate limit. ",[251,317,318],{},"MapIdentityManagementApi"," also adds antiforgery to both, so send ",[251,321,322],{},"RequestVerificationToken"," on each:",[224,325,326,339],{},[227,327,328],{},[230,329,330,333,336],{},[233,331,332],{},"Method",[233,334,335],{},"Path",[233,337,338],{},"Notes",[240,340,341,356,370],{},[230,342,343,348,353],{},[245,344,345],{},[251,346,347],{},"GET",[245,349,350],{},[251,351,352],{},"\u002Fmanage\u002FauthMethods",[245,354,355],{},"Available step-up methods",[230,357,358,362,367],{},[245,359,360],{},[251,361,310],{},[245,363,364],{},[251,365,366],{},"\u002FconfirmIdentity",[245,368,369],{},"Exactly one proof; CSRF when mapped via management",[230,371,372,376,381],{},[245,373,374],{},[251,375,310],{},[245,377,378],{},[251,379,380],{},"\u002FconfirmIdentity\u002FpasskeyOptions",[245,382,383],{},"WebAuthn options for passkey step-up; CSRF when mapped via management",[385,386,388],"h3",{"id":387},"confirmidentity-proof","ConfirmIdentity proof",[209,390,391,392,396],{},"Provide ",[393,394,395],"strong",{},"exactly one"," of:",[398,399,400,406,411,416],"ul",{},[401,402,403],"li",{},[251,404,405],{},"password",[401,407,408],{},[251,409,410],{},"twoFactorCode",[401,412,413],{},[251,414,415],{},"twoFactorRecoveryCode",[401,417,418,421],{},[251,419,420],{},"credentialJson"," (passkey assertion)",[209,423,424,425,427],{},"On success: ReAuth cookie for browser clients; ",[251,426,282],{}," for API clients using the header. Cookie and token share the same lifetime.",[219,429,431],{"id":430},"lifetime","Lifetime",[209,433,434,435,438,439,442,443,446,447,450,451,454,455,458,459,461],{},"Default is ",[393,436,437],{},"5 minutes",", non-persistent, no sliding expiration. Set ",[251,440,441],{},"AuthEndpointsOptions.ReAuth.Lifetime"," (a ",[251,444,445],{},"TimeSpan",") on the facade, or ",[251,448,449],{},"IOptions\u003CAuthEndpointsReAuthOptions>"," on a composable host. One value drives confirm ",[251,452,453],{},"ExpiresUtc",", cookie ",[251,456,457],{},"ExpireTimeSpan",", and ",[251,460,282],{}," expiry.",[209,463,464,465,468],{},"Valid range: 1 minute through 60 minutes. Startup rejects zero, negative, over 60 minutes, and ",[251,466,467],{},"InfiniteTimeSpan",".",[470,471,476],"pre",{"className":472,"code":473,"language":474,"meta":475,"style":475},"language-cs shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","builder.Services.AddAuthEndpoints\u003CAppUser, AppDbContext>(o =>\n{\n    o.ReAuth.Lifetime = TimeSpan.FromMinutes(2);\n});\n","cs","",[251,477,478,521,527,564],{"__ignoreMap":475},[479,480,483,487,490,493,495,499,502,506,509,512,515,518],"span",{"class":481,"line":482},"line",1,[479,484,486],{"class":485},"sTEyZ","builder",[479,488,468],{"class":489},"sMK4o",[479,491,492],{"class":485},"Services",[479,494,468],{"class":489},[479,496,498],{"class":497},"s2Zo4","AddAuthEndpoints",[479,500,501],{"class":489},"\u003C",[479,503,505],{"class":504},"sBMFI","AppUser",[479,507,508],{"class":489},",",[479,510,511],{"class":504}," AppDbContext",[479,513,514],{"class":489},">(",[479,516,517],{"class":504},"o",[479,519,520],{"class":489}," =>\n",[479,522,524],{"class":481,"line":523},2,[479,525,526],{"class":489},"{\n",[479,528,530,533,535,538,540,543,546,549,551,554,557,561],{"class":481,"line":529},3,[479,531,532],{"class":485},"    o",[479,534,468],{"class":489},[479,536,537],{"class":485},"ReAuth",[479,539,468],{"class":489},[479,541,542],{"class":485},"Lifetime ",[479,544,545],{"class":489},"=",[479,547,548],{"class":485}," TimeSpan",[479,550,468],{"class":489},[479,552,553],{"class":497},"FromMinutes",[479,555,556],{"class":489},"(",[479,558,560],{"class":559},"sbssI","2",[479,562,563],{"class":489},");\n",[479,565,567],{"class":481,"line":566},4,[479,568,569],{"class":489},"});\n",[219,571,573],{"id":572},"protecting-host-endpoints","Protecting host endpoints",[470,575,577],{"className":472,"code":576,"language":474,"meta":475,"style":475},"builder.Services.AddCookieAuthEndpoints(); \u002F\u002F or AddBearerAuthEndpoints — registers ReAuth schemes\n\napp.MapPost(\"\u002Fbilling\u002Fupdate\", handler)\n    .RequireAuthorization()\n    .RequireReauth();\n",[251,578,579,599,605,634,645],{"__ignoreMap":475},[479,580,581,583,585,587,589,592,595],{"class":481,"line":482},[479,582,486],{"class":485},[479,584,468],{"class":489},[479,586,492],{"class":485},[479,588,468],{"class":489},[479,590,591],{"class":497},"AddCookieAuthEndpoints",[479,593,594],{"class":489},"();",[479,596,598],{"class":597},"sHwdD"," \u002F\u002F or AddBearerAuthEndpoints — registers ReAuth schemes\n",[479,600,601],{"class":481,"line":523},[479,602,604],{"emptyLinePlaceholder":603},true,"\n",[479,606,607,610,612,615,617,620,624,626,628,631],{"class":481,"line":529},[479,608,609],{"class":485},"app",[479,611,468],{"class":489},[479,613,614],{"class":497},"MapPost",[479,616,556],{"class":489},[479,618,619],{"class":489},"\"",[479,621,623],{"class":622},"sfazB","\u002Fbilling\u002Fupdate",[479,625,619],{"class":489},[479,627,508],{"class":489},[479,629,630],{"class":485}," handler",[479,632,633],{"class":489},")\n",[479,635,636,639,642],{"class":481,"line":566},[479,637,638],{"class":489},"    .",[479,640,641],{"class":497},"RequireAuthorization",[479,643,644],{"class":489},"()\n",[479,646,648,650,653],{"class":481,"line":647},5,[479,649,638],{"class":489},[479,651,652],{"class":497},"RequireReauth",[479,654,655],{"class":489},"();\n",[219,657,659],{"id":658},"typical-client-flow","Typical client flow",[661,662,663,668,675,681],"ol",{},[401,664,665],{},[251,666,667],{},"GET \u002Fidentity\u002Fmanage\u002FauthMethods",[401,669,670,671,674],{},"Collect proof (password, 2FA, or passkey via ",[251,672,673],{},"POST \u002Fidentity\u002FconfirmIdentity\u002FpasskeyOptions"," with CSRF)",[401,676,677,680],{},[251,678,679],{},"POST \u002Fidentity\u002FconfirmIdentity"," with CSRF",[401,682,683,684],{},"Retry the sensitive action with ReAuth cookie and\u002For ",[251,685,278],{},[219,687,689],{"id":688},"where-reauth-is-required","Where ReAuth is required",[398,691,692,695,698],{},[401,693,694],{},"Manage 2FA \u002F info mutations",[401,696,697],{},"Passkey add, rename, delete, and creation options",[401,699,700,701],{},"Any host endpoint with ",[251,702,703],{},".RequireReauth()",[219,705,707],{"id":706},"related","Related",[398,709,710,714,720],{},[401,711,712],{},[213,713,216],{"href":215},[401,715,716],{},[213,717,719],{"href":718},"\u002Fmodules\u002Fpasskeys\u002F","Passkeys",[401,721,722],{},[213,723,725],{"href":724},"\u002Fcomposables\u002Frequirements\u002F","Composable requirements",[727,728,729],"style",{},"html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}",{"title":475,"searchDepth":482,"depth":523,"links":731},[732,733,736,737,738,739,740],{"id":221,"depth":523,"text":222},{"id":299,"depth":523,"text":300,"children":734},[735],{"id":387,"depth":529,"text":388},{"id":430,"depth":523,"text":431},{"id":572,"depth":523,"text":573},{"id":658,"depth":523,"text":659},{"id":688,"depth":523,"text":689},{"id":706,"depth":523,"text":707},"Step-up reauthentication for sensitive manage and passkey actions.","md",null,{},{"icon":152},{"title":149,"description":741},"C5jJPiB0ewVQEhri0fiGOmkeu7zNclFZktR16aP67gA",[749,751],{"title":145,"path":146,"stem":147,"description":750,"icon":74,"children":-1},"WebAuthn passwordless register\u002Flogin and credential management endpoints.",{"title":154,"path":155,"stem":156,"description":752,"icon":49,"children":-1},"Separate preview package for GitHub and Google OAuth login with Identity cookie or JWT completion.",1791123628633]