Start here
Getting Started
Choose the shortest SqlOS path for your .NET application.
net9.0)Run the Todo sample with SQL Server, hosted login, and FGA already wired.
Install the package and declare one application with UseSingleApplication.
Use ASP.NET Core OAuth, PKCE, a secure cookie, and revoking logout.
Compare the runnable .NET, browser, mobile, and CLI examples.
Running the sample is the fastest evaluation. Adding SqlOS to your application is the canonical integration path. Do not begin with SAML, headless auth, FGA modeling, CIMD, or DCR unless one of those is already a product requirement.
For a typical .NET B2B SaaS product, start with:
DbContext backed by SQL Server;The core registration is intentionally small:
builder.AddSqlOS<AppDbContext>(
db => db.UseSqlServer(connectionString),
options =>
{
options.UseSingleApplication("Acme", app =>
{
app.Origin = publicOrigin;
app.Audience = $"{publicOrigin}/api";
});
options.Dashboard.AuthMode = SqlOSDashboardAuthMode.Password;
options.Dashboard.Password = dashboardPassword;
});UseSingleApplication creates one first-party PKCE client, a callback at {Origin}/auth/callback, standard OpenID scopes, and matching AuthPage branding. Advanced public-client registration and resource indicators remain off until you opt in.
AddSqlOS does not automatically bind an SqlOS configuration section. Read values from builder.Configuration, your secret store, or environment variables and assign them in the options callback as shown above.
Complete Run the Todo sample or Add SqlOS to an app.
Let the framework own PKCE, correlation state, the callback, and your application cookie with Sign in an ASP.NET Core app.
Validate bearer tokens for one exact audience with Protect an API.
When role checks stop being enough, use EF Core authorization.
Continue into invitations, social login, SAML SSO, MFA, audit logs, or calendar integration.
When the host starts, SqlOS initializes and upgrades its own tables, automatically creates and protects a signing key when none exists, and applies settings and startup seeds. Your EF migrations continue to own your application tables. app.MapSqlOS() maps the OAuth, hosted login, and admin API routes; the dashboard middleware is registered by AddSqlOS.
Default paths:
| Path | Purpose |
|---|---|
/sqlos | Embedded dashboard |
/sqlos/auth | OAuth server and hosted login |
/sqlos/admin/auth | Auth administration |
/sqlos/admin/fga | Authorization administration |
Create email-bound, one-time organization invitations.
Configure Google, Microsoft, GitHub, Apple, or custom OIDC.
Connect an organization to a SAML identity provider.
Capture application and SqlOS governance events.
For the complete task directory, see Guides. Use Example applications when you want a complete source path instead of an isolated integration step, and use the reference section after you know which service or endpoint you need.