v3.4.1

AuthEndpoints

Passkey register with RequireConfirmedAccount off and no useCookies or useSessionCookies flag used to throw response has already started. IdentityPasskeySignInCompleter calls SignInAsync, which writes the Identity bearer token body, and then wrote credentialId as a second body.

Register now keeps a single body:

• Cookie sign-in (useCookies or useSessionCookies) returns 200 with credentialId and sets the application cookie.
• Identity bearer sign-in returns 200 with AccessTokenResponse. The body has no credentialId.
• JwtPasskeySignInCompleter returns the JWT /create shape: { "accessToken", "tokenType" } and the refresh cookie. Cookie query flags stay ignored. The body has no credentialId.

When sign-in is not allowed, register still returns 200 with credentialId and does not issue a session or tokens. Login behavior is unchanged. This release adds no database migration.

Upgrading from 3.4.0

• Bearer and JWT passkey register clients should read the token response. Cookie register returns credentialId.
• No host change is required for the crash fix.

Packages

• AuthEndpoints 3.4.1
• AuthEndpoints.External.OAuth 3.0.0-preview.5
• AuthEndpoints.OAuth.GitHub and AuthEndpoints.OAuth.Google unchanged at 3.0.0-preview.4

Links

• GitHub release
• Compare
• Passkeys
• Register with a passkey