public void ConfigureServices(IServiceCollection services)
    {
        services.AddAntiforgery(opt =>
        {
            ...
        });

        services.AddIdentityApiEndpoints<User>(opt => opt.SignIn.RequireConfirmedAccount = true)
            .AddRoles<Role>()
            .AddEntityFrameworkStores<AppDb>();
        services.Configure<IdentityOptions>();
        ...
    }

    public void Configure(IApplicationBuilder app)
    {
        ...
        app.UseAuthentication();
        app.UseAuthorization();
        app.UseAntiforgery();
        app.UseEndpoints(endpoints =>
        {
            endpoints.MapGroup("/api/user")
            .MapIdentityApi<User>()
            .WithMetadata(new RequireAntiforgeryTokenAttribute());
            endpoints.MapControllers().WithMetadata(new RequireAntiforgeryTokenAttribute());
        });
    }