Add password login

You'll learn how to register SqlOS, seed an owned client, and sign in through the hosted login UI.

Goal#

Your app starts an OAuth authorization-code flow at /sqlos/auth/authorize. SqlOS then renders the hosted email and password steps, and returns a short-lived authorization code to your registered callback. Your app exchanges that code at /sqlos/auth/token with PKCE.

This screenshot comes from the Todo demo with EnabledCredentialTypes = ["password"]. SqlOS asks for the email first so it can perform home realm discovery, then shows the password step above when local password auth is the only configured primary credential.

Steps#

1. Register SqlOS with password auth enabled (default):

builder.AddSqlOS<AppDbContext>(options =>
{
    options.AuthServer.SeedOwnedWebApp(
        "web",
        "My App",
        "https://localhost:5001/auth/callback");
    options.AuthServer.SeedAuthPage(page =>
    {
        page.PageTitle = "Sign in";
        page.EnablePasswordSignup = true;
        page.EnabledCredentialTypes = ["password"];
    });
});

2. Map routes after Build():

app.MapSqlOS();

3. Wire the client by following ASP.NET Core login. The sample uses the standard ASP.NET Core OAuth handler to create state and PKCE values, redirect through /authorize, validate the callback, and exchange the code at /token.

4. Verify: complete login, confirm the callback receives code and state, and confirm the middleware exchanges the code before your protected application page loads.

Expected outcome#

• Hosted login and signup pages render with your branding
• OAuth /authorize and /token endpoints respond on your origin
• Users and sessions appear in /sqlos/admin/auth/

Next steps#

• Auth branding for the hosted page and built-in email
• Email OTP for passwordless sign-in
• Social sign-in
• GitHub sign-in
• Headless auth for a custom SPA UI