Email & password
Sign-up and sign-in with PBKDF2-HMAC-SHA256 hashing and per-password salts — swap for Argon2id if you prefer. The endpoints ship with the library; you never hand-write them.
Auth for .NET
Self-hostable authentication, in your own app
Klassd.Auth is a code-first authentication core for .NET — email/password, passwordless codes, passkeys, rotating sessions, social login & SSO, account linking, MFA and more. One MapKlassdAuth() call ships the whole HTTP API.
Get started on GitHub →Passwordless codes
One-time codes over email or SMS — fixed-time compare, TTL and attempt lockout, no account enumeration. Bring your own sender or drop in the Twilio package for SMS.
Passkeys (WebAuthn)
Phishing-resistant FIDO2 sign-in built on Fido2NetLib, including usernameless/discoverable login. The ceremony challenge rides a stateless, DataProtection-protected cookie — multi-node safe, no shared cache.
Sessions done right
A short-lived, stateless access JWT plus an opaque, rotating refresh token. Reuse of a rotated refresh token is detected and revokes the session defensively.
Social login & SSO
OIDC (Microsoft Entra ID, Google) and OAuth 2.0 (GitHub, Facebook, Instagram, TikTok) external login, with a clean seam for adding your own provider.
Account linking
An account is one identity with many login methods. A passwordless user can add a password or link Facebook; unlink is guarded so the last method can never be removed. Opt-in auto-link only on a verified email.
MFA (TOTP)
Enroll a TOTP authenticator: the core generates a secret and an otpauth:// URI for the QR code, then verifies six-digit codes at sign-in.
Email verification
Send a verification link and consume single-use tokens. Tokens are hashed, TTL-bound and persisted by the storage adapter, so they survive restarts and scale across nodes.
Per-user typed metadata
Store app-specific data as one JSON document accessed through typed sections — so two apps (CMS + Workflows) never collide. Roles ride the same mechanism.
Pluggable storage
The core depends only on IUserStore / ISessionStore / IUserMetadataStore. Bind a database with a Data.* adapter — SQLite, PostgreSQL or MongoDB — using raw drivers, no EF/ORM.
Multi-tenancy
Serve many tenants from one database: every identity lookup is scoped to the tenant and the access token carries it as a tnt claim, so the same email can exist independently per tenant. Defaults to a single "public" tenant — single-tenant apps change nothing.
Drop-in cookie sign-in
For Blazor / server-rendered apps, add cookie delivery and the external-SSO seam with one call. Optional loopback bypass means no login on localhost / port-forward.
RS256 + JWKS by default
With a database adapter, signing defaults to rotating RS256 — keys persisted and auto-rotated — publishing JWKS and an OpenID discovery doc so resource servers validate via discovery. HS256 shared-secret is an opt-out.
Admin dashboard
A drop-in Blazor admin UI to maintain users — list/search, create, enable/disable, set password, edit roles, manage linked methods, and delete or anonymize. It can also run an import (file or live DB) as a background job with live progress. One MapKlassdAuthDashboard() call.
Automation webhooks
Inbound HMAC-signed webhooks let a customer-service tool disable, delete or anonymize a user — so a support ticket can be automated end-to-end, with replay protection and an audit log.
Custom claims & sessions
Add claims to every access token with an enricher (fresh on each refresh), or merge into a live session — the SuperTokens MergeIntoAccessTokenPayload equivalent, resolvable straight from the request. Arrays become real JSON claims.
Override anything
Every core service is an interface with a delegating decorator — wrap it, change one method, call base for the rest. The same model as SuperTokens recipe-function overrides, with session-create and third-party post-sign-in hooks that hand you the session.
Migrate from Auth0 / SuperTokens
Import an existing user base — bcrypt/argon2 passwords verify at login (no forced reset), plus social links, roles, metadata and TOTP. From a JSON export or by reading a SuperTokens core DB directly. Idempotent, dry-runnable, and can fold several databases into one multi-tenant instance.
The whole host is a few lines
Add the core, pick a storage adapter, and map the API. The endpoints are shipped by the library and the schema is created at startup — you don't hand-write any of it.
builder.Services
.AddKlassdAuth(new SessionConfig { SigningKey = "<32+ byte secret>" })
.UseSqlite("Data Source=klassd-auth.db"); // or .UsePostgres(...) / .UseMongoDb(...)
var app = builder.Build();
app.MapKlassdAuth(); // mounts the full HTTP API; schema is created automatically at startup
app.Run();# Klassd.Auth is in beta — install the prerelease packages
dotnet add package Klassd.Auth.Core --prerelease
dotnet add package Klassd.Auth.Data.Sqlite --prerelease
dotnet add package Klassd.Auth.AspNetCore --prerelease