AuthEndpoints

AuthEndpoints is an ASP.NET Core library of ready-made auth API endpoints on top of ASP.NET Core Identity. It fits a single-backend API serving a SPA with first-party email/password, cookies, JWT, and/or passkeys.

• Ready-made endpoints for registration, login, password reset, 2FA, and session/token flows
• Opinionated quick start with AddAuthEndpoints / UseAuthEndpoints / MapAuthEndpoints
• Account lifecycle: register, confirm email, forgot/reset password, manage info and 2FA, step-up ReAuth
• Sign-in stacks you choose: cookie sessions, Identity bearer tokens, or Simple JWT
• Passkeys (WebAuthn) for passwordless register and login
• Built-in hardening: rate limiting, antiforgery, lockout-aware login, hashed JWT refresh tokens with reuse detection
• Optional package AuthEndpoints.External.OAuth for GitHub/Google OAuth

Getting started

Requires .NET 10, ASP.NET Core Identity, and EF Core.

dotnet add package AuthEndpoints --version 3.0.0-rc.3

builder.Services.AddDbContext<AppDbContext>(/* your provider */);

builder.Services.AddAuthEndpoints<AppUser, AppDbContext>(o =>
{
    o.Passkeys.ServerDomain = "example.com"; // required in Production
});

builder.Services.AddTransient<IEmailSender<AppUser>, MyEmailSender>();

var app = builder.Build();

app.UseAuthEndpoints();
app.MapAuthEndpoints<AppUser>();

app.Run();

Documentation

For configuration, composable modules, route tables, and production guidance, see the AuthEndpoints documentation.

Contribute

Issues and pull requests are welcome. Open an issue at madeyoga/AuthEndpoints to report bugs or propose changes.

License

This project is licensed under the MIT License.