Customizing Endpoints

Overview

Every OpenID Connect / OAuth 2.0 endpoint exposed by IdentitySuite has a built-in default implementation that can be replaced individually, using the same single entry point used to customize models — the overload of AddIdentitySuiteServices that accepts an Action<IdentitySuiteOptions> delegate:

copy

builder.AddIdentitySuiteServices(options =>
{
    // OpenIddict layer — replace built-in endpoint handlers
    options.OpenIddictOptions.ServerEndpointOptions.TokenEndpoint = MyEndpoints.Token;
}, logger);

Looking to replace an entity, DbContext, store or manager instead of an endpoint? See the Customizing Models page.

OpenIddict — Server Endpoints

You can replace any endpoint individually by assigning a delegate to the corresponding property on options.OpenIddictOptions.ServerEndpointOptions.

The selection logic is straightforward: if the property is null the built-in handler runs; if it is set, your delegate is called instead and receives all the same services the default implementation would.

Property Route Description
AuthorizeEndpoint GET/POST /Connect/Authorize Validates the authorization request, checks the user session and decides whether to issue tokens or redirect to the login/consent page
ConsentEndpoint POST /Connect/Consent Processes the user's consent decision (accept or deny) and creates the resulting authorization
TokenEndpoint POST /Connect/Token Exchanges credentials, authorization codes or refresh tokens for access/identity tokens; the place to customize claims issued in tokens
UserInfoEndpoint GET/POST /Connect/UserInfo Returns claims about the authenticated user; override to add or filter claims returned to clients
LogoutGetEndpoint GET /Connect/Logout Initiates the end-session flow; stores client session data and redirects to the logout page
LogoutPostEndpoint POST /Connect/Logout Signs out the user and completes the OpenIddict end-session response
VerifyGetEndpoint GET /Connect/Verify Entry point for the Device Authorization flow — validates the user code and redirects to the verification page
VerifyPostEndpoint POST /Connect/Verify Processes the user's accept/deny action during device verification and issues the resulting token

The most common customization is the token endpoint, where you may want to enrich the claims added to the access token:

copy

options.OpenIddictOptions.ServerEndpointOptions.TokenEndpoint = MyEndpoints.Token;

// in MyEndpoints.cs
public static class MyEndpoints
{
    public static async Task<IResult> Token(
        HttpContext httpContext,
        IIdentitySuiteUserService userManager,
        IIdentitySuiteSignInService signInManager,
        IOpenIddictScopeManager scopeManager,
        IOpenIddictApplicationManager applicationManager,
        ILogger logger)
    {
        // your custom token issuance logic
    }
}

Complete Endpoint Customization Example

The IdentitySuite demo repository contains a fully working example that replaces all eight built-in endpoint handlers with custom implementations, demonstrating patterns for claims enrichment, consent logic and device verification.

View Demo Project on GitHub