ASP.NET Core Identity for APIs

@shop = https://localhost:7212

### Register (200 with an empty body on success, 400 ValidationProblem with DuplicateEmail or password errors)
POST {{shop}}/account/register
Content-Type: application/json

{ "email": "[email protected]", "password": "long-passphrase-for-ana-2026" }

### Log in with bearer tokens
POST {{shop}}/account/login
Content-Type: application/json

{ "email": "[email protected]", "password": "long-passphrase-for-ana-2026" }

### Response:
### { "tokenType": "Bearer", "accessToken": "CfDJ8...", "expiresIn": 3600, "refreshToken": "CfDJ8..." }

### Log in with a cookie instead (browser front end on the same site)
POST {{shop}}/account/login?useCookies=true
Content-Type: application/json

{ "email": "[email protected]", "password": "long-passphrase-for-ana-2026" }

### Use the access token
GET {{shop}}/orders/mine
Authorization: Bearer <access-token>

### Get a new pair before the hour is up
POST {{shop}}/account/refresh
Content-Type: application/json

{ "refreshToken": "<refresh-token>" }

using System.Security.Claims;
using Microsoft.AspNetCore.Identity;

public static class PasskeyEndpoints
{
    public static RouteGroupBuilder MapPasskeys(this IEndpointRouteBuilder app)
    {
        var group = app.MapGroup("/account/passkeys");

        // 1. Signed-in user asks for options, passes them to navigator.credentials.create().
        group.MapPost("/creation-options", async (ClaimsPrincipal principal, UserManager<ShopUser> users, SignInManager<ShopUser> signIn) =>
        {
            var user = await users.GetUserAsync(principal);
            if (user is null) return Results.Unauthorized();
            var optionsJson = await signIn.MakePasskeyCreationOptionsAsync(new PasskeyUserEntity
            {
                Id = await users.GetUserIdAsync(user),
                Name = await users.GetUserNameAsync(user) ?? user.Email ?? "user",
                DisplayName = user.DisplayName ?? user.Email ?? "user",
            });
            return Results.Content(optionsJson, "application/json");
        }).RequireAuthorization();

        // 2. Browser posts the credential back; Identity verifies it against the stored challenge.
        group.MapPost("/", async (PasskeyCredential body, ClaimsPrincipal principal, UserManager<ShopUser> users, SignInManager<ShopUser> signIn) =>
        {
            var user = await users.GetUserAsync(principal);
            if (user is null) return Results.Unauthorized();
            var attestation = await signIn.PerformPasskeyAttestationAsync(body.CredentialJson);
            if (!attestation.Succeeded)
                return Results.Problem(attestation.Failure?.Message, statusCode: StatusCodes.Status400BadRequest);
            var saved = await users.AddOrUpdatePasskeyAsync(user, attestation.Passkey);
            return saved.Succeeded ? Results.NoContent() : Results.Problem("Could not save the passkey.");
        }).RequireAuthorization();

        // 3. Anonymous sign-in: options for navigator.credentials.get(), then verify and issue the cookie.
        group.MapPost("/request-options", async (SignInManager<ShopUser> signIn) =>
            Results.Content(await signIn.MakePasskeyRequestOptionsAsync(user: null), "application/json"));

        group.MapPost("/sign-in", async (PasskeyCredential body, SignInManager<ShopUser> signIn) =>
        {
            var result = await signIn.PasskeySignInAsync(body.CredentialJson);
            return result.Succeeded ? Results.NoContent() : Results.Unauthorized();
        });

        return group;
    }
}

public sealed record PasskeyCredential(string CredentialJson);

public sealed class ShopUser : IdentityUser
{
    public string? DisplayName { get; set; }
}

using Microsoft.AspNetCore.Identity;

var builder = WebApplication.CreateBuilder(args);

// New hashes use 210,000 PBKDF2 iterations; old hashes still verify and are upgraded on next login.
builder.Services.Configure<PasswordHasherOptions>(options => options.IterationCount = 210_000);
builder.Services.AddIdentityCore<IdentityUser>(); // registers IPasswordHasher<IdentityUser>

var app = builder.Build();

var oldHasher = new PasswordHasher<IdentityUser>();
var newHasher = app.Services.GetRequiredService<IPasswordHasher<IdentityUser>>();
var user = new IdentityUser("[email protected]");

string storedHash = oldHasher.HashPassword(user, "long-passphrase-for-ana-2026");
var result = newHasher.VerifyHashedPassword(user, storedHash, "long-passphrase-for-ana-2026");

Console.WriteLine(result); // SuccessRehashNeeded: UserManager stores a new hash after this sign-in