ASP.NET Core Authentication Endpoints: Why I Built AuthEndpoints

AuthEndpoints 4 is a library that adds ready-made authentication endpoints on top of ASP.NET Core Identity. A single AddPasswordAuth and MapPasswordAuth pair covers sign-up, sign-in, 2FA, passkeys and password recovery. It targets .NET 10 and is compared with the built-in MapIdentityApi.

Key points

• AddPasswordAuth and MapPasswordAuth expose sign-up, sign-in, logout, email confirmation and password reset under /auth.
• Cookie is the default session; JWT with a rotating refresh token is the alternative.
• The library targets .NET 10 and uses EF Core for the user store; the current NuGet package is 4.0.2.
• Every Map* call throws at startup if its matching Add* call is missing.
• MapIdentityApi has no logout route, passkey endpoints or CSRF token route, which AuthEndpoints provides.
• Some setups from 3.x need a database migration, so read the upgrade guide before bumping the version.

ASP.NET Core ships the authentication plumbing (AddAuthentication, AddAuthorization, UseAuthentication and friends) but no actual login, register or password reset endpoints, so every team writes them from scratch. AuthEndpoints was created to fill that gap, and its 4.0.0 release came out on 15 October 2026, with 4.0.2 as the current NuGet package. It targets .NET 10 and uses EF Core for the user store.

The library does not replace ASP.NET Core Identity; Identity still handles users, password hashing and lockout. The new AddPasswordAuth and MapPasswordAuth pair exposes sign-up, sign-in, recovery, email confirmation and account management under /auth. Cookies are the default session, with JWT and a rotating refresh token as the alternative. Two-factor codes, passkeys, step-up re-authentication and GitHub or Google sign-in can be added or left out, and modules let you map only the routes you need. The author compares it with MapIdentityApi, noting that the built-in version has no logout route, no passkey endpoints and no CSRF token route.

Real-world use

• Adding sign-up, sign-in and password reset to a new ASP.NET Core Web API without writing the auth endpoints from scratch.
• Backends that serve SPAs or mobile clients needing JWT with refresh tokens instead of cookies.
• Internal line-of-business apps that must re-verify users before sensitive changes such as email or 2FA updates.

Why it matters

Instead of hand-writing login and password reset endpoints on ASP.NET Core, you can evaluate a modular library built on Identity. Since it is third-party code, you should review its security posture and maintenance before adopting it for production auth.

Related stories

• Making Stripe webhooks idempotent in ASP.NET CoreDVDEV Community: #csharp5 d ago
• A secure enterprise chat with React, .NET 10 and Microsoft FoundryDVDEV Community: #dotnet1 d ago
• ASP.NET Core Authentication & Authorization Explained: What to Use, When, and How to Ship It SafelyDVDEV Community: #aspnetcore1 d ago