diff --git a/Directory.Packages.props b/Directory.Packages.props
index 40606922e..af9639088 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -130,6 +130,7 @@
 		<PackageVersion Include="Xunit.SkippableFact" Version="1.5.23" />
 		
 		<PackageVersion Include="Yarp.ReverseProxy" Version="2.1.0" />
+		<PackageVersion Include="Verify.Xunit" Version="26.6.0" />
 
 		<!-- Transitive Dependencies -->
 		<!-- These packages are all transitive dependencies that would
diff --git a/bff/test/Bff.Blazor.Client.UnitTests/Bff.Blazor.Client.UnitTests.csproj b/bff/test/Bff.Blazor.Client.UnitTests/Bff.Blazor.Client.UnitTests.csproj
index 9d5cef101..40dccf34f 100644
--- a/bff/test/Bff.Blazor.Client.UnitTests/Bff.Blazor.Client.UnitTests.csproj
+++ b/bff/test/Bff.Blazor.Client.UnitTests/Bff.Blazor.Client.UnitTests.csproj
@@ -13,6 +13,9 @@
   <ItemGroup>
     <PackageReference Include="Microsoft.Extensions.TimeProvider.Testing" />
     <PackageReference Include="NSubstitute" />
+    <PackageReference Include="PublicApiGenerator" />
+    <PackageReference Include="Verify.Xunit" />
+
   </ItemGroup>
 
   <ItemGroup>
diff --git a/bff/test/Bff.Blazor.Client.UnitTests/PublicApiVerificationTests.VerifyPublicApi_Bff.verified.txt b/bff/test/Bff.Blazor.Client.UnitTests/PublicApiVerificationTests.VerifyPublicApi_Bff.verified.txt
new file mode 100644
index 000000000..0ed1a94a1
--- /dev/null
+++ b/bff/test/Bff.Blazor.Client.UnitTests/PublicApiVerificationTests.VerifyPublicApi_Bff.verified.txt
@@ -0,0 +1,406 @@
+namespace Duende.Bff
+{
+    public abstract class AccessTokenResult
+    {
+        protected AccessTokenResult() { }
+    }
+    [System.Runtime.CompilerServices.RequiredMember]
+    public class AccessTokenRetrievalContext
+    {
+        [System.Obsolete("Constructors of types with required members are not supported in this version of " +
+            "your compiler.", true)]
+        [System.Runtime.CompilerServices.CompilerFeatureRequired("RequiredMembers")]
+        public AccessTokenRetrievalContext() { }
+        [System.Runtime.CompilerServices.RequiredMember]
+        public System.Uri ApiAddress { get; set; }
+        [System.Runtime.CompilerServices.RequiredMember]
+        public Microsoft.AspNetCore.Http.HttpContext HttpContext { get; set; }
+        [System.Runtime.CompilerServices.RequiredMember]
+        public Microsoft.AspNetCore.Http.PathString LocalPath { get; set; }
+        [System.Runtime.CompilerServices.RequiredMember]
+        public Duende.Bff.BffRemoteApiEndpointMetadata Metadata { get; set; }
+        [System.Runtime.CompilerServices.RequiredMember]
+        public Duende.AccessTokenManagement.OpenIdConnect.UserTokenRequestParameters? UserTokenRequestParameters { get; set; }
+    }
+    public class AccessTokenRetrievalError : Duende.Bff.AccessTokenResult
+    {
+        public AccessTokenRetrievalError(string error) { }
+        public string Error { get; set; }
+    }
+    public enum AnonymousSessionResponse
+    {
+        Response401 = 0,
+        Response200 = 1,
+    }
+    public static class AuthenticationPropertiesExtensions
+    {
+        public static bool IsSilentLogin(this Microsoft.AspNetCore.Authentication.AuthenticationProperties props) { }
+    }
+    public static class AuthenticationTicketExtensions
+    {
+        public static Microsoft.AspNetCore.Authentication.AuthenticationTicket? Deserialize(this Duende.Bff.UserSession session, Microsoft.AspNetCore.DataProtection.IDataProtector protector, Microsoft.Extensions.Logging.ILogger logger) { }
+        public static System.DateTime? GetExpiration(this Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket) { }
+        public static System.DateTime GetIssued(this Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket) { }
+        public static string? GetSessionId(this Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket) { }
+        public static string GetSubjectId(this Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket) { }
+        public static string Serialize(this Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket, Microsoft.AspNetCore.DataProtection.IDataProtector protector) { }
+        public class Envelope
+        {
+            public Envelope() { }
+            public string Payload { get; set; }
+            public int Version { get; set; }
+        }
+    }
+    public class BearerTokenResult : Duende.Bff.AccessTokenResult
+    {
+        public BearerTokenResult(string accessToken) { }
+        public string AccessToken { get; }
+    }
+    [System.AttributeUsage(System.AttributeTargets.Class | System.AttributeTargets.Method)]
+    public class BffApiAttribute : System.Attribute, Duende.Bff.IBffApiEndpoint
+    {
+        public BffApiAttribute() { }
+    }
+    [System.AttributeUsage(System.AttributeTargets.Class | System.AttributeTargets.Method)]
+    public class BffApiSkipAntiforgeryAttribute : System.Attribute, Duende.Bff.IBffApiSkipAntiforgery
+    {
+        public BffApiSkipAntiforgeryAttribute() { }
+    }
+    [System.AttributeUsage(System.AttributeTargets.Class | System.AttributeTargets.Method)]
+    public class BffApiSkipResponseHandlingAttribute : System.Attribute, Duende.Bff.IBffApiSkipResponseHandling
+    {
+        public BffApiSkipResponseHandlingAttribute() { }
+    }
+    public class BffOpenIdConnectEvents : Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectEvents
+    {
+        protected readonly Microsoft.Extensions.Logging.ILogger<Duende.Bff.BffOpenIdConnectEvents> Logger;
+        public BffOpenIdConnectEvents(Microsoft.Extensions.Logging.ILogger<Duende.Bff.BffOpenIdConnectEvents> logger) { }
+        public override System.Threading.Tasks.Task AuthenticationFailed(Microsoft.AspNetCore.Authentication.OpenIdConnect.AuthenticationFailedContext context) { }
+        public override System.Threading.Tasks.Task MessageReceived(Microsoft.AspNetCore.Authentication.OpenIdConnect.MessageReceivedContext context) { }
+        public virtual System.Threading.Tasks.Task<bool> ProcessAuthenticationFailedAsync(Microsoft.AspNetCore.Authentication.OpenIdConnect.AuthenticationFailedContext context) { }
+        public virtual System.Threading.Tasks.Task<bool> ProcessMessageReceivedAsync(Microsoft.AspNetCore.Authentication.OpenIdConnect.MessageReceivedContext context) { }
+        public virtual System.Threading.Tasks.Task<bool> ProcessRedirectToIdentityProviderAsync(Microsoft.AspNetCore.Authentication.OpenIdConnect.RedirectContext context) { }
+        public override System.Threading.Tasks.Task RedirectToIdentityProvider(Microsoft.AspNetCore.Authentication.OpenIdConnect.RedirectContext context) { }
+    }
+    public class BffOptions
+    {
+        public BffOptions() { }
+        public Duende.Bff.AnonymousSessionResponse AnonymousSessionResponse { get; set; }
+        public string AntiForgeryHeaderName { get; set; }
+        public string AntiForgeryHeaderValue { get; set; }
+        public Microsoft.AspNetCore.Http.PathString BackChannelLogoutPath { get; }
+        public bool BackchannelLogoutAllUserSessions { get; set; }
+        public string? DPoPJsonWebKey { get; set; }
+        public System.Collections.Generic.ICollection<string> DiagnosticsEnvironments { get; set; }
+        public Microsoft.AspNetCore.Http.PathString DiagnosticsPath { get; }
+        public bool EnableSessionCleanup { get; set; }
+        public bool EnforceBffMiddleware { get; set; }
+        public string? LicenseKey { get; set; }
+        public Microsoft.AspNetCore.Http.PathString LoginPath { get; }
+        public Microsoft.AspNetCore.Http.PathString LogoutPath { get; }
+        public Microsoft.AspNetCore.Http.PathString ManagementBasePath { get; set; }
+        public bool RemoveSessionAfterRefreshTokenExpiration { get; set; }
+        public bool RequireLogoutSessionId { get; set; }
+        public bool RevokeRefreshTokenOnLogout { get; set; }
+        public System.TimeSpan SessionCleanupInterval { get; set; }
+        public Microsoft.AspNetCore.Http.PathString SilentLoginCallbackPath { get; }
+        public Microsoft.AspNetCore.Http.PathString SilentLoginPath { get; }
+        public Microsoft.AspNetCore.Http.PathString UserPath { get; }
+    }
+    public class BffRemoteApiEndpointMetadata : Duende.Bff.IBffApiEndpoint
+    {
+        public Duende.Bff.TokenType? RequiredTokenType;
+        public BffRemoteApiEndpointMetadata() { }
+        public System.Type AccessTokenRetriever { get; set; }
+        public Duende.Bff.BffUserAccessTokenParameters? BffUserAccessTokenParameters { get; set; }
+        public bool OptionalUserToken { get; set; }
+    }
+    public class BffUserAccessTokenParameters
+    {
+        public BffUserAccessTokenParameters(string? signInScheme = null, string? challengeScheme = null, bool forceRenewal = false, string? resource = null) { }
+        public Duende.AccessTokenManagement.OpenIdConnect.UserTokenRequestParameters ToUserAccessTokenRequestParameters() { }
+    }
+    public class ClaimRecord
+    {
+        public ClaimRecord() { }
+        public ClaimRecord(string type, object value) { }
+        [System.Text.Json.Serialization.JsonPropertyName("type")]
+        public string Type { get; init; }
+        [System.Text.Json.Serialization.JsonPropertyName("valueType")]
+        public string? ValueType { get; init; }
+        [System.Text.Json.Serialization.JsonPropertyName("value")]
+        public object Value { get; init; }
+    }
+    public static class Constants
+    {
+        public static class BffFlags
+        {
+            public const string SilentLogin = "bff-silent-login";
+        }
+        public static class ClaimTypes
+        {
+            public const string LogoutUrl = "bff:logout_url";
+            public const string SessionExpiresIn = "bff:session_expires_in";
+            public const string SessionState = "bff:session_state";
+        }
+        public static class ManagementEndpoints
+        {
+            public const string BackChannelLogout = "/backchannel";
+            public const string Diagnostics = "/diagnostics";
+            public const string Login = "/login";
+            public const string Logout = "/logout";
+            public const string SilentLogin = "/silent-login";
+            public const string SilentLoginCallback = "/silent-login-callback";
+            public const string User = "/user";
+        }
+        public static class RequestParameters
+        {
+            public const string ReturnUrl = "returnUrl";
+            public const string SlideCookie = "slide";
+        }
+        public static class Yarp
+        {
+            public const string AntiforgeryCheckMetadata = "Duende.Bff.Yarp.AntiforgeryCheck";
+            public const string OptionalUserTokenMetadata = "Duende.Bff.Yarp.OptionalUserToken";
+            public const string TokenTypeMetadata = "Duende.Bff.Yarp.TokenType";
+        }
+    }
+    public class DPoPTokenResult : Duende.Bff.AccessTokenResult
+    {
+        public DPoPTokenResult(string accessToken, string dpopJWK) { }
+        public string AccessToken { get; set; }
+        public string DPoPJsonWebKey { get; set; }
+    }
+    public class DefaultAccessTokenRetriever : Duende.Bff.IAccessTokenRetriever
+    {
+        protected readonly Microsoft.Extensions.Logging.ILogger<Duende.Bff.DefaultAccessTokenRetriever> Logger;
+        public DefaultAccessTokenRetriever(Microsoft.Extensions.Logging.ILogger<Duende.Bff.DefaultAccessTokenRetriever> logger) { }
+        public virtual System.Threading.Tasks.Task<Duende.Bff.AccessTokenResult> GetAccessToken(Duende.Bff.AccessTokenRetrievalContext context) { }
+    }
+    public class DefaultBackchannelLogoutService : Duende.Bff.IBackchannelLogoutService, Duende.Bff.IBffEndpointService
+    {
+        protected readonly Microsoft.AspNetCore.Authentication.IAuthenticationSchemeProvider AuthenticationSchemeProvider;
+        protected readonly Microsoft.Extensions.Logging.ILogger<Duende.Bff.DefaultBackchannelLogoutService> Logger;
+        protected readonly Microsoft.Extensions.Options.IOptionsMonitor<Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectOptions> OptionsMonitor;
+        protected readonly Duende.Bff.ISessionRevocationService UserSession;
+        public DefaultBackchannelLogoutService(Microsoft.AspNetCore.Authentication.IAuthenticationSchemeProvider authenticationSchemeProvider, Microsoft.Extensions.Options.IOptionsMonitor<Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectOptions> optionsMonitor, Duende.Bff.ISessionRevocationService userSession, Microsoft.Extensions.Logging.ILogger<Duende.Bff.DefaultBackchannelLogoutService> logger) { }
+        protected virtual System.Threading.Tasks.Task<Microsoft.IdentityModel.Tokens.TokenValidationParameters> GetTokenValidationParameters() { }
+        public virtual System.Threading.Tasks.Task ProcessRequestAsync(Microsoft.AspNetCore.Http.HttpContext context) { }
+        protected virtual System.Threading.Tasks.Task<System.Security.Claims.ClaimsIdentity?> ValidateJwt(string jwt) { }
+        protected virtual System.Threading.Tasks.Task<System.Security.Claims.ClaimsIdentity?> ValidateLogoutTokenAsync(string logoutToken) { }
+    }
+    public class DefaultDiagnosticsService : Duende.Bff.IBffEndpointService, Duende.Bff.IDiagnosticsService
+    {
+        protected readonly Microsoft.AspNetCore.Hosting.IWebHostEnvironment Environment;
+        protected readonly Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> Options;
+        public DefaultDiagnosticsService(Microsoft.AspNetCore.Hosting.IWebHostEnvironment environment, Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options) { }
+        public virtual System.Threading.Tasks.Task ProcessRequestAsync(Microsoft.AspNetCore.Http.HttpContext context) { }
+    }
+    public class DefaultLoginService : Duende.Bff.IBffEndpointService, Duende.Bff.ILoginService
+    {
+        protected readonly Microsoft.Extensions.Logging.ILogger Logger;
+        protected readonly Duende.Bff.BffOptions Options;
+        protected readonly Duende.Bff.IReturnUrlValidator ReturnUrlValidator;
+        public DefaultLoginService(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Duende.Bff.IReturnUrlValidator returnUrlValidator, Microsoft.Extensions.Logging.ILogger<Duende.Bff.DefaultLoginService> logger) { }
+        public virtual System.Threading.Tasks.Task ProcessRequestAsync(Microsoft.AspNetCore.Http.HttpContext context) { }
+    }
+    public class DefaultLogoutService : Duende.Bff.IBffEndpointService, Duende.Bff.ILogoutService
+    {
+        protected readonly Microsoft.AspNetCore.Authentication.IAuthenticationSchemeProvider AuthenticationSchemeProvider;
+        protected readonly Microsoft.Extensions.Logging.ILogger Logger;
+        protected readonly Duende.Bff.BffOptions Options;
+        protected readonly Duende.Bff.IReturnUrlValidator ReturnUrlValidator;
+        public DefaultLogoutService(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Microsoft.AspNetCore.Authentication.IAuthenticationSchemeProvider authenticationAuthenticationSchemeProviderProvider, Duende.Bff.IReturnUrlValidator returnUrlValidator, Microsoft.Extensions.Logging.ILogger<Duende.Bff.DefaultLogoutService> logger) { }
+        public virtual System.Threading.Tasks.Task ProcessRequestAsync(Microsoft.AspNetCore.Http.HttpContext context) { }
+    }
+    public class DefaultSilentLoginCallbackService : Duende.Bff.IBffEndpointService, Duende.Bff.ISilentLoginCallbackService
+    {
+        protected readonly Microsoft.Extensions.Logging.ILogger Logger;
+        protected readonly Duende.Bff.BffOptions Options;
+        public DefaultSilentLoginCallbackService(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Microsoft.Extensions.Logging.ILogger<Duende.Bff.DefaultSilentLoginCallbackService> logger) { }
+        public virtual System.Threading.Tasks.Task ProcessRequestAsync(Microsoft.AspNetCore.Http.HttpContext context) { }
+    }
+    public class DefaultSilentLoginService : Duende.Bff.IBffEndpointService, Duende.Bff.ISilentLoginService
+    {
+        protected readonly Microsoft.Extensions.Logging.ILogger Logger;
+        protected readonly Duende.Bff.BffOptions Options;
+        public DefaultSilentLoginService(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Microsoft.Extensions.Logging.ILogger<Duende.Bff.DefaultSilentLoginService> logger) { }
+        public virtual System.Threading.Tasks.Task ProcessRequestAsync(Microsoft.AspNetCore.Http.HttpContext context) { }
+    }
+    public class DefaultUserService : Duende.Bff.IBffEndpointService, Duende.Bff.IUserService
+    {
+        protected readonly Microsoft.Extensions.Logging.ILogger Logger;
+        protected readonly Duende.Bff.BffOptions Options;
+        public DefaultUserService(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Microsoft.Extensions.Logging.ILoggerFactory loggerFactory) { }
+        protected virtual System.Threading.Tasks.Task<System.Collections.Generic.IEnumerable<Duende.Bff.ClaimRecord>> GetManagementClaimsAsync(Microsoft.AspNetCore.Http.HttpContext context, Microsoft.AspNetCore.Authentication.AuthenticateResult authenticateResult) { }
+        protected virtual System.Threading.Tasks.Task<System.Collections.Generic.IEnumerable<Duende.Bff.ClaimRecord>> GetUserClaimsAsync(Microsoft.AspNetCore.Authentication.AuthenticateResult authenticateResult) { }
+        public virtual System.Threading.Tasks.Task ProcessRequestAsync(Microsoft.AspNetCore.Http.HttpContext context) { }
+    }
+    public interface IAccessTokenRetriever
+    {
+        System.Threading.Tasks.Task<Duende.Bff.AccessTokenResult> GetAccessToken(Duende.Bff.AccessTokenRetrievalContext context);
+    }
+    public interface IBackchannelLogoutService : Duende.Bff.IBffEndpointService { }
+    public interface IBffApiEndpoint { }
+    public interface IBffApiSkipAntiforgery { }
+    public interface IBffApiSkipResponseHandling { }
+    public interface IBffEndpointService
+    {
+        System.Threading.Tasks.Task ProcessRequestAsync(Microsoft.AspNetCore.Http.HttpContext context);
+    }
+    public interface IDiagnosticsService : Duende.Bff.IBffEndpointService { }
+    public interface ILoginService : Duende.Bff.IBffEndpointService { }
+    public interface ILogoutService : Duende.Bff.IBffEndpointService { }
+    public interface IReturnUrlValidator
+    {
+        System.Threading.Tasks.Task<bool> IsValidAsync(string returnUrl);
+    }
+    public interface IServerTicketStore : Microsoft.AspNetCore.Authentication.Cookies.ITicketStore
+    {
+        System.Threading.Tasks.Task<System.Collections.Generic.IReadOnlyCollection<Microsoft.AspNetCore.Authentication.AuthenticationTicket>> GetUserTicketsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken = default);
+    }
+    public interface ISessionRevocationService
+    {
+        System.Threading.Tasks.Task RevokeSessionsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken = default);
+    }
+    public interface ISilentLoginCallbackService : Duende.Bff.IBffEndpointService { }
+    public interface ISilentLoginService : Duende.Bff.IBffEndpointService { }
+    public interface IUserService : Duende.Bff.IBffEndpointService { }
+    public interface IUserSessionStore
+    {
+        System.Threading.Tasks.Task CreateUserSessionAsync(Duende.Bff.UserSession session, System.Threading.CancellationToken cancellationToken = default);
+        System.Threading.Tasks.Task DeleteUserSessionAsync(string key, System.Threading.CancellationToken cancellationToken = default);
+        System.Threading.Tasks.Task DeleteUserSessionsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken = default);
+        System.Threading.Tasks.Task<Duende.Bff.UserSession?> GetUserSessionAsync(string key, System.Threading.CancellationToken cancellationToken = default);
+        System.Threading.Tasks.Task<System.Collections.Generic.IReadOnlyCollection<Duende.Bff.UserSession>> GetUserSessionsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken = default);
+        System.Threading.Tasks.Task UpdateUserSessionAsync(string key, Duende.Bff.UserSessionUpdate session, System.Threading.CancellationToken cancellationToken = default);
+    }
+    public interface IUserSessionStoreCleanup
+    {
+        System.Threading.Tasks.Task DeleteExpiredSessionsAsync(System.Threading.CancellationToken cancellationToken = default);
+    }
+    public class InMemoryUserSessionStore : Duende.Bff.IUserSessionStore
+    {
+        public InMemoryUserSessionStore() { }
+        public System.Threading.Tasks.Task CreateUserSessionAsync(Duende.Bff.UserSession session, System.Threading.CancellationToken cancellationToken = default) { }
+        public System.Threading.Tasks.Task DeleteUserSessionAsync(string key, System.Threading.CancellationToken cancellationToken = default) { }
+        public System.Threading.Tasks.Task DeleteUserSessionsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken = default) { }
+        public System.Threading.Tasks.Task<Duende.Bff.UserSession?> GetUserSessionAsync(string key, System.Threading.CancellationToken cancellationToken = default) { }
+        public System.Threading.Tasks.Task<System.Collections.Generic.IReadOnlyCollection<Duende.Bff.UserSession>> GetUserSessionsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken = default) { }
+        public System.Threading.Tasks.Task UpdateUserSessionAsync(string key, Duende.Bff.UserSessionUpdate session, System.Threading.CancellationToken cancellationToken = default) { }
+    }
+    public class MissingDPopTokenError : Duende.Bff.AccessTokenRetrievalError
+    {
+        public MissingDPopTokenError(string error) { }
+    }
+    public class NoAccessTokenResult : Duende.Bff.AccessTokenResult
+    {
+        public NoAccessTokenResult() { }
+    }
+    public class NoAccessTokenReturnedError : Duende.Bff.AccessTokenRetrievalError
+    {
+        public NoAccessTokenReturnedError(string error) { }
+    }
+    public class NopSessionRevocationService : Duende.Bff.ISessionRevocationService
+    {
+        public NopSessionRevocationService(Microsoft.Extensions.Logging.ILogger<Duende.Bff.NopSessionRevocationService> logger) { }
+        public System.Threading.Tasks.Task RevokeSessionsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken = default) { }
+    }
+    public class PostConfigureApplicationCookieRevokeRefreshToken : Microsoft.Extensions.Options.IPostConfigureOptions<Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions>
+    {
+        public PostConfigureApplicationCookieRevokeRefreshToken(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> bffOptions, Microsoft.Extensions.Options.IOptions<Microsoft.AspNetCore.Authentication.AuthenticationOptions> authOptions, Microsoft.Extensions.Logging.ILogger<Duende.Bff.PostConfigureApplicationCookieRevokeRefreshToken> logger) { }
+        public void PostConfigure(string? name, Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions options) { }
+    }
+    public class PostConfigureApplicationCookieTicketStore : Microsoft.Extensions.Options.IPostConfigureOptions<Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions>
+    {
+        public PostConfigureApplicationCookieTicketStore(Microsoft.AspNetCore.Http.IHttpContextAccessor httpContextAccessor, Microsoft.Extensions.Options.IOptions<Microsoft.AspNetCore.Authentication.AuthenticationOptions> options) { }
+        public void PostConfigure(string? name, Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions options) { }
+    }
+    public class PostConfigureApplicationValidatePrincipal : Microsoft.Extensions.Options.IPostConfigureOptions<Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions>
+    {
+        public PostConfigureApplicationValidatePrincipal(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> bffOptions, Microsoft.Extensions.Options.IOptions<Microsoft.AspNetCore.Authentication.AuthenticationOptions> authOptions, Microsoft.Extensions.Logging.ILogger<Duende.Bff.PostConfigureApplicationValidatePrincipal> logger) { }
+        public void PostConfigure(string? name, Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions options) { }
+    }
+    public class PostConfigureOidcOptionsForSilentLogin : Microsoft.Extensions.Options.IPostConfigureOptions<Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectOptions>
+    {
+        public PostConfigureOidcOptionsForSilentLogin(Microsoft.Extensions.Options.IOptions<Microsoft.AspNetCore.Authentication.AuthenticationOptions> options, Microsoft.Extensions.Logging.ILoggerFactory logger) { }
+        public void PostConfigure(string? name, Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectOptions options) { }
+    }
+    public class PostConfigureSlidingExpirationCheck : Microsoft.Extensions.Options.IPostConfigureOptions<Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions>
+    {
+        public PostConfigureSlidingExpirationCheck(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> bffOptions, Microsoft.Extensions.Options.IOptions<Microsoft.AspNetCore.Authentication.AuthenticationOptions> authOptions, Microsoft.Extensions.Logging.ILogger<Duende.Bff.PostConfigureSlidingExpirationCheck> logger) { }
+        public void PostConfigure(string? name, Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions options) { }
+    }
+    public class ServerSideTicketStore : Duende.Bff.IServerTicketStore, Microsoft.AspNetCore.Authentication.Cookies.ITicketStore
+    {
+        public static string DataProtectorPurpose;
+        public ServerSideTicketStore(Duende.Bff.IUserSessionStore store, Microsoft.AspNetCore.DataProtection.IDataProtectionProvider dataProtectionProvider, Microsoft.Extensions.Logging.ILogger<Duende.Bff.ServerSideTicketStore> logger) { }
+        public System.Threading.Tasks.Task<System.Collections.Generic.IReadOnlyCollection<Microsoft.AspNetCore.Authentication.AuthenticationTicket>> GetUserTicketsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken) { }
+        public System.Threading.Tasks.Task RemoveAsync(string key) { }
+        public System.Threading.Tasks.Task RenewAsync(string key, Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket) { }
+        public System.Threading.Tasks.Task<Microsoft.AspNetCore.Authentication.AuthenticationTicket> RetrieveAsync(string key) { }
+        public System.Threading.Tasks.Task<string> StoreAsync(Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket) { }
+    }
+    public class SessionCleanupHost : Microsoft.Extensions.Hosting.IHostedService
+    {
+        public SessionCleanupHost(System.IServiceProvider serviceProvider, Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Microsoft.Extensions.Logging.ILogger<Duende.Bff.SessionCleanupHost> logger) { }
+        public System.Threading.Tasks.Task StartAsync(System.Threading.CancellationToken cancellationToken) { }
+        public System.Threading.Tasks.Task StopAsync(System.Threading.CancellationToken cancellationToken) { }
+    }
+    public class SessionRevocationService : Duende.Bff.ISessionRevocationService
+    {
+        public SessionRevocationService(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Duende.Bff.IServerTicketStore ticketStore, Duende.Bff.IUserSessionStore sessionStore, Duende.AccessTokenManagement.OpenIdConnect.IUserTokenEndpointService tokenEndpoint, Microsoft.Extensions.Logging.ILogger<Duende.Bff.SessionRevocationService> logger) { }
+        public System.Threading.Tasks.Task RevokeSessionsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken = default) { }
+    }
+    public class TicketStoreShim : Microsoft.AspNetCore.Authentication.Cookies.ITicketStore
+    {
+        public TicketStoreShim(Microsoft.AspNetCore.Http.IHttpContextAccessor httpContextAccessor) { }
+        public System.Threading.Tasks.Task RemoveAsync(string key) { }
+        public System.Threading.Tasks.Task RenewAsync(string key, Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket) { }
+        public System.Threading.Tasks.Task<Microsoft.AspNetCore.Authentication.AuthenticationTicket> RetrieveAsync(string key) { }
+        public System.Threading.Tasks.Task<string> StoreAsync(Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket) { }
+    }
+    public enum TokenType
+    {
+        User = 0,
+        Client = 1,
+        UserOrClient = 2,
+    }
+    public class UnexpectedAccessTokenError : Duende.Bff.AccessTokenRetrievalError
+    {
+        public UnexpectedAccessTokenError(string error) { }
+    }
+    public class UserSession : Duende.Bff.UserSessionUpdate
+    {
+        public UserSession() { }
+        public string Key { get; set; }
+        public Duende.Bff.UserSession Clone() { }
+        public void CopyTo(Duende.Bff.UserSession other) { }
+    }
+    public class UserSessionUpdate
+    {
+        public UserSessionUpdate() { }
+        public System.DateTime Created { get; set; }
+        public System.DateTime? Expires { get; set; }
+        public System.DateTime Renewed { get; set; }
+        public string? SessionId { get; set; }
+        public string SubjectId { get; set; }
+        public string Ticket { get; set; }
+        public void CopyTo(Duende.Bff.UserSessionUpdate other) { }
+    }
+    public class UserSessionsFilter
+    {
+        public UserSessionsFilter() { }
+        public string? SessionId { get; set; }
+        public string? SubjectId { get; init; }
+        public void Validate() { }
+    }
+}
+namespace Duende.Bff.Endpoints
+{
+    public class BffMiddleware
+    {
+        public BffMiddleware(Microsoft.AspNetCore.Http.RequestDelegate next, Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Microsoft.Extensions.Logging.ILogger<Duende.Bff.Endpoints.BffMiddleware> logger) { }
+        public System.Threading.Tasks.Task Invoke(Microsoft.AspNetCore.Http.HttpContext context) { }
+    }
+}
\ No newline at end of file
diff --git a/bff/test/Bff.Blazor.Client.UnitTests/PublicApiVerificationTests.VerifyPublicApi_Bff_Blazor_Client.verified.txt b/bff/test/Bff.Blazor.Client.UnitTests/PublicApiVerificationTests.VerifyPublicApi_Bff_Blazor_Client.verified.txt
new file mode 100644
index 000000000..7d39b4084
--- /dev/null
+++ b/bff/test/Bff.Blazor.Client.UnitTests/PublicApiVerificationTests.VerifyPublicApi_Bff_Blazor_Client.verified.txt
@@ -0,0 +1,38 @@
+namespace Duende.Bff.Blazor.Client
+{
+    public class AntiforgeryHandler : System.Net.Http.DelegatingHandler
+    {
+        public AntiforgeryHandler() { }
+        protected override System.Threading.Tasks.Task<System.Net.Http.HttpResponseMessage> SendAsync(System.Net.Http.HttpRequestMessage request, System.Threading.CancellationToken cancellationToken) { }
+    }
+    public class BffBlazorClientOptions
+    {
+        public BffBlazorClientOptions() { }
+        public string? RemoteApiBaseAddress { get; set; }
+        public string RemoteApiPath { get; set; }
+        public string? StateProviderBaseAddress { get; set; }
+        public int WebAssemblyStateProviderPollingDelay { get; set; }
+        public int WebAssemblyStateProviderPollingInterval { get; set; }
+    }
+    public static class Constants
+    {
+        public static class ClaimTypes
+        {
+            public const string LogoutUrl = "bff:logout_url";
+        }
+    }
+    public static class ServiceCollectionExtensions
+    {
+        public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddBffBlazorClient(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, System.Action<Duende.Bff.Blazor.Client.BffBlazorClientOptions>? configureAction = null) { }
+        public static Microsoft.Extensions.DependencyInjection.IHttpClientBuilder AddLocalApiHttpClient(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, string clientName, System.Action<System.Net.Http.HttpClient> configureClient) { }
+        public static Microsoft.Extensions.DependencyInjection.IHttpClientBuilder AddLocalApiHttpClient(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, string clientName, System.Action<System.IServiceProvider, System.Net.Http.HttpClient>? configureClient = null) { }
+        public static Microsoft.Extensions.DependencyInjection.IHttpClientBuilder AddLocalApiHttpClient<T>(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, System.Action<System.IServiceProvider, System.Net.Http.HttpClient>? configureClient = null)
+            where T :  class { }
+        public static Microsoft.Extensions.DependencyInjection.IHttpClientBuilder AddRemoteApiHttpClient(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, string clientName, System.Action<System.Net.Http.HttpClient> configureClient) { }
+        public static Microsoft.Extensions.DependencyInjection.IHttpClientBuilder AddRemoteApiHttpClient(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, string clientName, System.Action<System.IServiceProvider, System.Net.Http.HttpClient>? configureClient = null) { }
+        public static Microsoft.Extensions.DependencyInjection.IHttpClientBuilder AddRemoteApiHttpClient<T>(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, System.Action<System.Net.Http.HttpClient> configureClient)
+            where T :  class { }
+        public static Microsoft.Extensions.DependencyInjection.IHttpClientBuilder AddRemoteApiHttpClient<T>(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, System.Action<System.IServiceProvider, System.Net.Http.HttpClient>? configureClient = null)
+            where T :  class { }
+    }
+}
\ No newline at end of file
diff --git a/bff/test/Bff.Blazor.Client.UnitTests/PublicApiVerificationTests.VerifyPublicApi_Bff_Yarp.verified.txt b/bff/test/Bff.Blazor.Client.UnitTests/PublicApiVerificationTests.VerifyPublicApi_Bff_Yarp.verified.txt
new file mode 100644
index 000000000..219866e92
--- /dev/null
+++ b/bff/test/Bff.Blazor.Client.UnitTests/PublicApiVerificationTests.VerifyPublicApi_Bff_Yarp.verified.txt
@@ -0,0 +1,58 @@
+namespace Duende.Bff
+{
+    public sealed class ActivityPropagationHandler : System.Net.Http.DelegatingHandler
+    {
+        public ActivityPropagationHandler(System.Net.Http.HttpMessageHandler innerHandler) { }
+        protected override System.Threading.Tasks.Task<System.Net.Http.HttpResponseMessage> SendAsync(System.Net.Http.HttpRequestMessage request, System.Threading.CancellationToken cancellationToken) { }
+    }
+}
+namespace Duende.Bff.Yarp
+{
+    public class AccessTokenRequestTransform : Yarp.ReverseProxy.Transforms.RequestTransform
+    {
+        public AccessTokenRequestTransform(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Duende.AccessTokenManagement.IDPoPProofService proofService, Microsoft.Extensions.Logging.ILogger<Duende.Bff.Yarp.AccessTokenRequestTransform> logger) { }
+        public override System.Threading.Tasks.ValueTask ApplyAsync(Yarp.ReverseProxy.Transforms.RequestTransformContext context) { }
+    }
+    public class AccessTokenTransformProvider : Yarp.ReverseProxy.Transforms.Builder.ITransformProvider
+    {
+        public AccessTokenTransformProvider(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Microsoft.Extensions.Logging.ILogger<Duende.Bff.Yarp.AccessTokenTransformProvider> logger, Microsoft.Extensions.Logging.ILoggerFactory loggerFactory, Duende.AccessTokenManagement.IDPoPProofService dPoPProofService) { }
+        public void Apply(Yarp.ReverseProxy.Transforms.Builder.TransformBuilderContext transformBuildContext) { }
+        public void ValidateCluster(Yarp.ReverseProxy.Transforms.Builder.TransformClusterValidationContext context) { }
+        public void ValidateRoute(Yarp.ReverseProxy.Transforms.Builder.TransformRouteValidationContext context) { }
+    }
+    public class AntiforgeryMiddleware
+    {
+        public AntiforgeryMiddleware(Microsoft.AspNetCore.Http.RequestDelegate next, Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Microsoft.Extensions.Logging.ILogger<Duende.Bff.Yarp.AntiforgeryMiddleware> logger) { }
+        public System.Threading.Tasks.Task Invoke(Microsoft.AspNetCore.Http.HttpContext context) { }
+    }
+    public static class BffBuilderExtensions
+    {
+        public static Microsoft.AspNetCore.Builder.BffBuilder AddRemoteApis(this Microsoft.AspNetCore.Builder.BffBuilder builder) { }
+    }
+    public delegate void BffYarpTransformBuilder(string localPath, Yarp.ReverseProxy.Transforms.Builder.TransformBuilderContext context);
+    public static class DefaultBffYarpTransformerBuilders
+    {
+        public static Duende.Bff.Yarp.BffYarpTransformBuilder DirectProxyWithAccessToken;
+    }
+    public static class ProxyAppBuilderExtensions
+    {
+        public static Microsoft.AspNetCore.Builder.IApplicationBuilder UseAntiforgeryCheck(this Microsoft.AspNetCore.Builder.IApplicationBuilder yarpApp) { }
+    }
+    public static class ProxyConfigExtensions
+    {
+        public static Yarp.ReverseProxy.Configuration.ClusterConfig WithAccessToken(this Yarp.ReverseProxy.Configuration.ClusterConfig config, Duende.Bff.TokenType tokenType) { }
+        public static Yarp.ReverseProxy.Configuration.RouteConfig WithAccessToken(this Yarp.ReverseProxy.Configuration.RouteConfig config, Duende.Bff.TokenType tokenType) { }
+        public static Yarp.ReverseProxy.Configuration.RouteConfig WithAntiforgeryCheck(this Yarp.ReverseProxy.Configuration.RouteConfig config) { }
+        public static Yarp.ReverseProxy.Configuration.RouteConfig WithOptionalUserAccessToken(this Yarp.ReverseProxy.Configuration.RouteConfig config) { }
+    }
+    public static class ReverseProxyBuilderExtensions
+    {
+        public static Microsoft.Extensions.DependencyInjection.IReverseProxyBuilder AddBffExtensions(this Microsoft.Extensions.DependencyInjection.IReverseProxyBuilder builder) { }
+    }
+    public static class ReverseProxyEndpointConventionBuilderExtensions
+    {
+        public static Microsoft.AspNetCore.Builder.ReverseProxyConventionBuilder AsBffApiEndpoint(this Microsoft.AspNetCore.Builder.ReverseProxyConventionBuilder builder) { }
+        public static Microsoft.AspNetCore.Builder.ReverseProxyConventionBuilder MapBffReverseProxy(this Microsoft.AspNetCore.Routing.IEndpointRouteBuilder endpoints) { }
+        public static Microsoft.AspNetCore.Builder.ReverseProxyConventionBuilder MapBffReverseProxy(this Microsoft.AspNetCore.Routing.IEndpointRouteBuilder endpoints, System.Action<Microsoft.AspNetCore.Builder.IReverseProxyApplicationBuilder> configureAction) { }
+    }
+}
\ No newline at end of file
diff --git a/bff/test/Bff.Blazor.Client.UnitTests/PublicApiVerificationTests.cs b/bff/test/Bff.Blazor.Client.UnitTests/PublicApiVerificationTests.cs
new file mode 100644
index 000000000..2adf4a6fb
--- /dev/null
+++ b/bff/test/Bff.Blazor.Client.UnitTests/PublicApiVerificationTests.cs
@@ -0,0 +1,25 @@
+// Copyright (c) Duende Software. All rights reserved.
+// See LICENSE in the project root for license information.
+
+using Duende.Bff.Blazor.Client;
+using PublicApiGenerator;
+
+namespace Bff.Tests;
+
+public class PublicApiVerificationTests
+{
+
+
+    [Fact]
+    public async Task VerifyPublicApi_Bff_Blazor_Client()
+    {
+        var apiGeneratorOptions = new ApiGeneratorOptions
+        {
+            IncludeAssemblyAttributes = false
+        };
+        var publicApi = typeof(AntiforgeryHandler).Assembly.GeneratePublicApi(apiGeneratorOptions);
+        var settings = new VerifySettings();
+        await Verify(publicApi, settings);
+    }
+
+}
diff --git a/bff/test/Bff.Blazor.UnitTests/Bff.Blazor.UnitTests.csproj b/bff/test/Bff.Blazor.UnitTests/Bff.Blazor.UnitTests.csproj
index f7956ce5f..a992fad04 100644
--- a/bff/test/Bff.Blazor.UnitTests/Bff.Blazor.UnitTests.csproj
+++ b/bff/test/Bff.Blazor.UnitTests/Bff.Blazor.UnitTests.csproj
@@ -18,6 +18,9 @@
   <ItemGroup>
     <PackageReference Include="NSubstitute" />
     <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.Server" />
+    <PackageReference Include="PublicApiGenerator" />
+    <PackageReference Include="Verify.Xunit" />
+
   </ItemGroup>
 
   <ItemGroup>
diff --git a/bff/test/Bff.Blazor.UnitTests/PublicApiVerificationTests.VerifyPublicApi_Bff.verified.txt b/bff/test/Bff.Blazor.UnitTests/PublicApiVerificationTests.VerifyPublicApi_Bff.verified.txt
new file mode 100644
index 000000000..0ed1a94a1
--- /dev/null
+++ b/bff/test/Bff.Blazor.UnitTests/PublicApiVerificationTests.VerifyPublicApi_Bff.verified.txt
@@ -0,0 +1,406 @@
+namespace Duende.Bff
+{
+    public abstract class AccessTokenResult
+    {
+        protected AccessTokenResult() { }
+    }
+    [System.Runtime.CompilerServices.RequiredMember]
+    public class AccessTokenRetrievalContext
+    {
+        [System.Obsolete("Constructors of types with required members are not supported in this version of " +
+            "your compiler.", true)]
+        [System.Runtime.CompilerServices.CompilerFeatureRequired("RequiredMembers")]
+        public AccessTokenRetrievalContext() { }
+        [System.Runtime.CompilerServices.RequiredMember]
+        public System.Uri ApiAddress { get; set; }
+        [System.Runtime.CompilerServices.RequiredMember]
+        public Microsoft.AspNetCore.Http.HttpContext HttpContext { get; set; }
+        [System.Runtime.CompilerServices.RequiredMember]
+        public Microsoft.AspNetCore.Http.PathString LocalPath { get; set; }
+        [System.Runtime.CompilerServices.RequiredMember]
+        public Duende.Bff.BffRemoteApiEndpointMetadata Metadata { get; set; }
+        [System.Runtime.CompilerServices.RequiredMember]
+        public Duende.AccessTokenManagement.OpenIdConnect.UserTokenRequestParameters? UserTokenRequestParameters { get; set; }
+    }
+    public class AccessTokenRetrievalError : Duende.Bff.AccessTokenResult
+    {
+        public AccessTokenRetrievalError(string error) { }
+        public string Error { get; set; }
+    }
+    public enum AnonymousSessionResponse
+    {
+        Response401 = 0,
+        Response200 = 1,
+    }
+    public static class AuthenticationPropertiesExtensions
+    {
+        public static bool IsSilentLogin(this Microsoft.AspNetCore.Authentication.AuthenticationProperties props) { }
+    }
+    public static class AuthenticationTicketExtensions
+    {
+        public static Microsoft.AspNetCore.Authentication.AuthenticationTicket? Deserialize(this Duende.Bff.UserSession session, Microsoft.AspNetCore.DataProtection.IDataProtector protector, Microsoft.Extensions.Logging.ILogger logger) { }
+        public static System.DateTime? GetExpiration(this Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket) { }
+        public static System.DateTime GetIssued(this Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket) { }
+        public static string? GetSessionId(this Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket) { }
+        public static string GetSubjectId(this Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket) { }
+        public static string Serialize(this Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket, Microsoft.AspNetCore.DataProtection.IDataProtector protector) { }
+        public class Envelope
+        {
+            public Envelope() { }
+            public string Payload { get; set; }
+            public int Version { get; set; }
+        }
+    }
+    public class BearerTokenResult : Duende.Bff.AccessTokenResult
+    {
+        public BearerTokenResult(string accessToken) { }
+        public string AccessToken { get; }
+    }
+    [System.AttributeUsage(System.AttributeTargets.Class | System.AttributeTargets.Method)]
+    public class BffApiAttribute : System.Attribute, Duende.Bff.IBffApiEndpoint
+    {
+        public BffApiAttribute() { }
+    }
+    [System.AttributeUsage(System.AttributeTargets.Class | System.AttributeTargets.Method)]
+    public class BffApiSkipAntiforgeryAttribute : System.Attribute, Duende.Bff.IBffApiSkipAntiforgery
+    {
+        public BffApiSkipAntiforgeryAttribute() { }
+    }
+    [System.AttributeUsage(System.AttributeTargets.Class | System.AttributeTargets.Method)]
+    public class BffApiSkipResponseHandlingAttribute : System.Attribute, Duende.Bff.IBffApiSkipResponseHandling
+    {
+        public BffApiSkipResponseHandlingAttribute() { }
+    }
+    public class BffOpenIdConnectEvents : Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectEvents
+    {
+        protected readonly Microsoft.Extensions.Logging.ILogger<Duende.Bff.BffOpenIdConnectEvents> Logger;
+        public BffOpenIdConnectEvents(Microsoft.Extensions.Logging.ILogger<Duende.Bff.BffOpenIdConnectEvents> logger) { }
+        public override System.Threading.Tasks.Task AuthenticationFailed(Microsoft.AspNetCore.Authentication.OpenIdConnect.AuthenticationFailedContext context) { }
+        public override System.Threading.Tasks.Task MessageReceived(Microsoft.AspNetCore.Authentication.OpenIdConnect.MessageReceivedContext context) { }
+        public virtual System.Threading.Tasks.Task<bool> ProcessAuthenticationFailedAsync(Microsoft.AspNetCore.Authentication.OpenIdConnect.AuthenticationFailedContext context) { }
+        public virtual System.Threading.Tasks.Task<bool> ProcessMessageReceivedAsync(Microsoft.AspNetCore.Authentication.OpenIdConnect.MessageReceivedContext context) { }
+        public virtual System.Threading.Tasks.Task<bool> ProcessRedirectToIdentityProviderAsync(Microsoft.AspNetCore.Authentication.OpenIdConnect.RedirectContext context) { }
+        public override System.Threading.Tasks.Task RedirectToIdentityProvider(Microsoft.AspNetCore.Authentication.OpenIdConnect.RedirectContext context) { }
+    }
+    public class BffOptions
+    {
+        public BffOptions() { }
+        public Duende.Bff.AnonymousSessionResponse AnonymousSessionResponse { get; set; }
+        public string AntiForgeryHeaderName { get; set; }
+        public string AntiForgeryHeaderValue { get; set; }
+        public Microsoft.AspNetCore.Http.PathString BackChannelLogoutPath { get; }
+        public bool BackchannelLogoutAllUserSessions { get; set; }
+        public string? DPoPJsonWebKey { get; set; }
+        public System.Collections.Generic.ICollection<string> DiagnosticsEnvironments { get; set; }
+        public Microsoft.AspNetCore.Http.PathString DiagnosticsPath { get; }
+        public bool EnableSessionCleanup { get; set; }
+        public bool EnforceBffMiddleware { get; set; }
+        public string? LicenseKey { get; set; }
+        public Microsoft.AspNetCore.Http.PathString LoginPath { get; }
+        public Microsoft.AspNetCore.Http.PathString LogoutPath { get; }
+        public Microsoft.AspNetCore.Http.PathString ManagementBasePath { get; set; }
+        public bool RemoveSessionAfterRefreshTokenExpiration { get; set; }
+        public bool RequireLogoutSessionId { get; set; }
+        public bool RevokeRefreshTokenOnLogout { get; set; }
+        public System.TimeSpan SessionCleanupInterval { get; set; }
+        public Microsoft.AspNetCore.Http.PathString SilentLoginCallbackPath { get; }
+        public Microsoft.AspNetCore.Http.PathString SilentLoginPath { get; }
+        public Microsoft.AspNetCore.Http.PathString UserPath { get; }
+    }
+    public class BffRemoteApiEndpointMetadata : Duende.Bff.IBffApiEndpoint
+    {
+        public Duende.Bff.TokenType? RequiredTokenType;
+        public BffRemoteApiEndpointMetadata() { }
+        public System.Type AccessTokenRetriever { get; set; }
+        public Duende.Bff.BffUserAccessTokenParameters? BffUserAccessTokenParameters { get; set; }
+        public bool OptionalUserToken { get; set; }
+    }
+    public class BffUserAccessTokenParameters
+    {
+        public BffUserAccessTokenParameters(string? signInScheme = null, string? challengeScheme = null, bool forceRenewal = false, string? resource = null) { }
+        public Duende.AccessTokenManagement.OpenIdConnect.UserTokenRequestParameters ToUserAccessTokenRequestParameters() { }
+    }
+    public class ClaimRecord
+    {
+        public ClaimRecord() { }
+        public ClaimRecord(string type, object value) { }
+        [System.Text.Json.Serialization.JsonPropertyName("type")]
+        public string Type { get; init; }
+        [System.Text.Json.Serialization.JsonPropertyName("valueType")]
+        public string? ValueType { get; init; }
+        [System.Text.Json.Serialization.JsonPropertyName("value")]
+        public object Value { get; init; }
+    }
+    public static class Constants
+    {
+        public static class BffFlags
+        {
+            public const string SilentLogin = "bff-silent-login";
+        }
+        public static class ClaimTypes
+        {
+            public const string LogoutUrl = "bff:logout_url";
+            public const string SessionExpiresIn = "bff:session_expires_in";
+            public const string SessionState = "bff:session_state";
+        }
+        public static class ManagementEndpoints
+        {
+            public const string BackChannelLogout = "/backchannel";
+            public const string Diagnostics = "/diagnostics";
+            public const string Login = "/login";
+            public const string Logout = "/logout";
+            public const string SilentLogin = "/silent-login";
+            public const string SilentLoginCallback = "/silent-login-callback";
+            public const string User = "/user";
+        }
+        public static class RequestParameters
+        {
+            public const string ReturnUrl = "returnUrl";
+            public const string SlideCookie = "slide";
+        }
+        public static class Yarp
+        {
+            public const string AntiforgeryCheckMetadata = "Duende.Bff.Yarp.AntiforgeryCheck";
+            public const string OptionalUserTokenMetadata = "Duende.Bff.Yarp.OptionalUserToken";
+            public const string TokenTypeMetadata = "Duende.Bff.Yarp.TokenType";
+        }
+    }
+    public class DPoPTokenResult : Duende.Bff.AccessTokenResult
+    {
+        public DPoPTokenResult(string accessToken, string dpopJWK) { }
+        public string AccessToken { get; set; }
+        public string DPoPJsonWebKey { get; set; }
+    }
+    public class DefaultAccessTokenRetriever : Duende.Bff.IAccessTokenRetriever
+    {
+        protected readonly Microsoft.Extensions.Logging.ILogger<Duende.Bff.DefaultAccessTokenRetriever> Logger;
+        public DefaultAccessTokenRetriever(Microsoft.Extensions.Logging.ILogger<Duende.Bff.DefaultAccessTokenRetriever> logger) { }
+        public virtual System.Threading.Tasks.Task<Duende.Bff.AccessTokenResult> GetAccessToken(Duende.Bff.AccessTokenRetrievalContext context) { }
+    }
+    public class DefaultBackchannelLogoutService : Duende.Bff.IBackchannelLogoutService, Duende.Bff.IBffEndpointService
+    {
+        protected readonly Microsoft.AspNetCore.Authentication.IAuthenticationSchemeProvider AuthenticationSchemeProvider;
+        protected readonly Microsoft.Extensions.Logging.ILogger<Duende.Bff.DefaultBackchannelLogoutService> Logger;
+        protected readonly Microsoft.Extensions.Options.IOptionsMonitor<Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectOptions> OptionsMonitor;
+        protected readonly Duende.Bff.ISessionRevocationService UserSession;
+        public DefaultBackchannelLogoutService(Microsoft.AspNetCore.Authentication.IAuthenticationSchemeProvider authenticationSchemeProvider, Microsoft.Extensions.Options.IOptionsMonitor<Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectOptions> optionsMonitor, Duende.Bff.ISessionRevocationService userSession, Microsoft.Extensions.Logging.ILogger<Duende.Bff.DefaultBackchannelLogoutService> logger) { }
+        protected virtual System.Threading.Tasks.Task<Microsoft.IdentityModel.Tokens.TokenValidationParameters> GetTokenValidationParameters() { }
+        public virtual System.Threading.Tasks.Task ProcessRequestAsync(Microsoft.AspNetCore.Http.HttpContext context) { }
+        protected virtual System.Threading.Tasks.Task<System.Security.Claims.ClaimsIdentity?> ValidateJwt(string jwt) { }
+        protected virtual System.Threading.Tasks.Task<System.Security.Claims.ClaimsIdentity?> ValidateLogoutTokenAsync(string logoutToken) { }
+    }
+    public class DefaultDiagnosticsService : Duende.Bff.IBffEndpointService, Duende.Bff.IDiagnosticsService
+    {
+        protected readonly Microsoft.AspNetCore.Hosting.IWebHostEnvironment Environment;
+        protected readonly Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> Options;
+        public DefaultDiagnosticsService(Microsoft.AspNetCore.Hosting.IWebHostEnvironment environment, Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options) { }
+        public virtual System.Threading.Tasks.Task ProcessRequestAsync(Microsoft.AspNetCore.Http.HttpContext context) { }
+    }
+    public class DefaultLoginService : Duende.Bff.IBffEndpointService, Duende.Bff.ILoginService
+    {
+        protected readonly Microsoft.Extensions.Logging.ILogger Logger;
+        protected readonly Duende.Bff.BffOptions Options;
+        protected readonly Duende.Bff.IReturnUrlValidator ReturnUrlValidator;
+        public DefaultLoginService(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Duende.Bff.IReturnUrlValidator returnUrlValidator, Microsoft.Extensions.Logging.ILogger<Duende.Bff.DefaultLoginService> logger) { }
+        public virtual System.Threading.Tasks.Task ProcessRequestAsync(Microsoft.AspNetCore.Http.HttpContext context) { }
+    }
+    public class DefaultLogoutService : Duende.Bff.IBffEndpointService, Duende.Bff.ILogoutService
+    {
+        protected readonly Microsoft.AspNetCore.Authentication.IAuthenticationSchemeProvider AuthenticationSchemeProvider;
+        protected readonly Microsoft.Extensions.Logging.ILogger Logger;
+        protected readonly Duende.Bff.BffOptions Options;
+        protected readonly Duende.Bff.IReturnUrlValidator ReturnUrlValidator;
+        public DefaultLogoutService(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Microsoft.AspNetCore.Authentication.IAuthenticationSchemeProvider authenticationAuthenticationSchemeProviderProvider, Duende.Bff.IReturnUrlValidator returnUrlValidator, Microsoft.Extensions.Logging.ILogger<Duende.Bff.DefaultLogoutService> logger) { }
+        public virtual System.Threading.Tasks.Task ProcessRequestAsync(Microsoft.AspNetCore.Http.HttpContext context) { }
+    }
+    public class DefaultSilentLoginCallbackService : Duende.Bff.IBffEndpointService, Duende.Bff.ISilentLoginCallbackService
+    {
+        protected readonly Microsoft.Extensions.Logging.ILogger Logger;
+        protected readonly Duende.Bff.BffOptions Options;
+        public DefaultSilentLoginCallbackService(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Microsoft.Extensions.Logging.ILogger<Duende.Bff.DefaultSilentLoginCallbackService> logger) { }
+        public virtual System.Threading.Tasks.Task ProcessRequestAsync(Microsoft.AspNetCore.Http.HttpContext context) { }
+    }
+    public class DefaultSilentLoginService : Duende.Bff.IBffEndpointService, Duende.Bff.ISilentLoginService
+    {
+        protected readonly Microsoft.Extensions.Logging.ILogger Logger;
+        protected readonly Duende.Bff.BffOptions Options;
+        public DefaultSilentLoginService(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Microsoft.Extensions.Logging.ILogger<Duende.Bff.DefaultSilentLoginService> logger) { }
+        public virtual System.Threading.Tasks.Task ProcessRequestAsync(Microsoft.AspNetCore.Http.HttpContext context) { }
+    }
+    public class DefaultUserService : Duende.Bff.IBffEndpointService, Duende.Bff.IUserService
+    {
+        protected readonly Microsoft.Extensions.Logging.ILogger Logger;
+        protected readonly Duende.Bff.BffOptions Options;
+        public DefaultUserService(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Microsoft.Extensions.Logging.ILoggerFactory loggerFactory) { }
+        protected virtual System.Threading.Tasks.Task<System.Collections.Generic.IEnumerable<Duende.Bff.ClaimRecord>> GetManagementClaimsAsync(Microsoft.AspNetCore.Http.HttpContext context, Microsoft.AspNetCore.Authentication.AuthenticateResult authenticateResult) { }
+        protected virtual System.Threading.Tasks.Task<System.Collections.Generic.IEnumerable<Duende.Bff.ClaimRecord>> GetUserClaimsAsync(Microsoft.AspNetCore.Authentication.AuthenticateResult authenticateResult) { }
+        public virtual System.Threading.Tasks.Task ProcessRequestAsync(Microsoft.AspNetCore.Http.HttpContext context) { }
+    }
+    public interface IAccessTokenRetriever
+    {
+        System.Threading.Tasks.Task<Duende.Bff.AccessTokenResult> GetAccessToken(Duende.Bff.AccessTokenRetrievalContext context);
+    }
+    public interface IBackchannelLogoutService : Duende.Bff.IBffEndpointService { }
+    public interface IBffApiEndpoint { }
+    public interface IBffApiSkipAntiforgery { }
+    public interface IBffApiSkipResponseHandling { }
+    public interface IBffEndpointService
+    {
+        System.Threading.Tasks.Task ProcessRequestAsync(Microsoft.AspNetCore.Http.HttpContext context);
+    }
+    public interface IDiagnosticsService : Duende.Bff.IBffEndpointService { }
+    public interface ILoginService : Duende.Bff.IBffEndpointService { }
+    public interface ILogoutService : Duende.Bff.IBffEndpointService { }
+    public interface IReturnUrlValidator
+    {
+        System.Threading.Tasks.Task<bool> IsValidAsync(string returnUrl);
+    }
+    public interface IServerTicketStore : Microsoft.AspNetCore.Authentication.Cookies.ITicketStore
+    {
+        System.Threading.Tasks.Task<System.Collections.Generic.IReadOnlyCollection<Microsoft.AspNetCore.Authentication.AuthenticationTicket>> GetUserTicketsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken = default);
+    }
+    public interface ISessionRevocationService
+    {
+        System.Threading.Tasks.Task RevokeSessionsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken = default);
+    }
+    public interface ISilentLoginCallbackService : Duende.Bff.IBffEndpointService { }
+    public interface ISilentLoginService : Duende.Bff.IBffEndpointService { }
+    public interface IUserService : Duende.Bff.IBffEndpointService { }
+    public interface IUserSessionStore
+    {
+        System.Threading.Tasks.Task CreateUserSessionAsync(Duende.Bff.UserSession session, System.Threading.CancellationToken cancellationToken = default);
+        System.Threading.Tasks.Task DeleteUserSessionAsync(string key, System.Threading.CancellationToken cancellationToken = default);
+        System.Threading.Tasks.Task DeleteUserSessionsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken = default);
+        System.Threading.Tasks.Task<Duende.Bff.UserSession?> GetUserSessionAsync(string key, System.Threading.CancellationToken cancellationToken = default);
+        System.Threading.Tasks.Task<System.Collections.Generic.IReadOnlyCollection<Duende.Bff.UserSession>> GetUserSessionsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken = default);
+        System.Threading.Tasks.Task UpdateUserSessionAsync(string key, Duende.Bff.UserSessionUpdate session, System.Threading.CancellationToken cancellationToken = default);
+    }
+    public interface IUserSessionStoreCleanup
+    {
+        System.Threading.Tasks.Task DeleteExpiredSessionsAsync(System.Threading.CancellationToken cancellationToken = default);
+    }
+    public class InMemoryUserSessionStore : Duende.Bff.IUserSessionStore
+    {
+        public InMemoryUserSessionStore() { }
+        public System.Threading.Tasks.Task CreateUserSessionAsync(Duende.Bff.UserSession session, System.Threading.CancellationToken cancellationToken = default) { }
+        public System.Threading.Tasks.Task DeleteUserSessionAsync(string key, System.Threading.CancellationToken cancellationToken = default) { }
+        public System.Threading.Tasks.Task DeleteUserSessionsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken = default) { }
+        public System.Threading.Tasks.Task<Duende.Bff.UserSession?> GetUserSessionAsync(string key, System.Threading.CancellationToken cancellationToken = default) { }
+        public System.Threading.Tasks.Task<System.Collections.Generic.IReadOnlyCollection<Duende.Bff.UserSession>> GetUserSessionsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken = default) { }
+        public System.Threading.Tasks.Task UpdateUserSessionAsync(string key, Duende.Bff.UserSessionUpdate session, System.Threading.CancellationToken cancellationToken = default) { }
+    }
+    public class MissingDPopTokenError : Duende.Bff.AccessTokenRetrievalError
+    {
+        public MissingDPopTokenError(string error) { }
+    }
+    public class NoAccessTokenResult : Duende.Bff.AccessTokenResult
+    {
+        public NoAccessTokenResult() { }
+    }
+    public class NoAccessTokenReturnedError : Duende.Bff.AccessTokenRetrievalError
+    {
+        public NoAccessTokenReturnedError(string error) { }
+    }
+    public class NopSessionRevocationService : Duende.Bff.ISessionRevocationService
+    {
+        public NopSessionRevocationService(Microsoft.Extensions.Logging.ILogger<Duende.Bff.NopSessionRevocationService> logger) { }
+        public System.Threading.Tasks.Task RevokeSessionsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken = default) { }
+    }
+    public class PostConfigureApplicationCookieRevokeRefreshToken : Microsoft.Extensions.Options.IPostConfigureOptions<Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions>
+    {
+        public PostConfigureApplicationCookieRevokeRefreshToken(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> bffOptions, Microsoft.Extensions.Options.IOptions<Microsoft.AspNetCore.Authentication.AuthenticationOptions> authOptions, Microsoft.Extensions.Logging.ILogger<Duende.Bff.PostConfigureApplicationCookieRevokeRefreshToken> logger) { }
+        public void PostConfigure(string? name, Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions options) { }
+    }
+    public class PostConfigureApplicationCookieTicketStore : Microsoft.Extensions.Options.IPostConfigureOptions<Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions>
+    {
+        public PostConfigureApplicationCookieTicketStore(Microsoft.AspNetCore.Http.IHttpContextAccessor httpContextAccessor, Microsoft.Extensions.Options.IOptions<Microsoft.AspNetCore.Authentication.AuthenticationOptions> options) { }
+        public void PostConfigure(string? name, Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions options) { }
+    }
+    public class PostConfigureApplicationValidatePrincipal : Microsoft.Extensions.Options.IPostConfigureOptions<Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions>
+    {
+        public PostConfigureApplicationValidatePrincipal(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> bffOptions, Microsoft.Extensions.Options.IOptions<Microsoft.AspNetCore.Authentication.AuthenticationOptions> authOptions, Microsoft.Extensions.Logging.ILogger<Duende.Bff.PostConfigureApplicationValidatePrincipal> logger) { }
+        public void PostConfigure(string? name, Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions options) { }
+    }
+    public class PostConfigureOidcOptionsForSilentLogin : Microsoft.Extensions.Options.IPostConfigureOptions<Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectOptions>
+    {
+        public PostConfigureOidcOptionsForSilentLogin(Microsoft.Extensions.Options.IOptions<Microsoft.AspNetCore.Authentication.AuthenticationOptions> options, Microsoft.Extensions.Logging.ILoggerFactory logger) { }
+        public void PostConfigure(string? name, Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectOptions options) { }
+    }
+    public class PostConfigureSlidingExpirationCheck : Microsoft.Extensions.Options.IPostConfigureOptions<Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions>
+    {
+        public PostConfigureSlidingExpirationCheck(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> bffOptions, Microsoft.Extensions.Options.IOptions<Microsoft.AspNetCore.Authentication.AuthenticationOptions> authOptions, Microsoft.Extensions.Logging.ILogger<Duende.Bff.PostConfigureSlidingExpirationCheck> logger) { }
+        public void PostConfigure(string? name, Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions options) { }
+    }
+    public class ServerSideTicketStore : Duende.Bff.IServerTicketStore, Microsoft.AspNetCore.Authentication.Cookies.ITicketStore
+    {
+        public static string DataProtectorPurpose;
+        public ServerSideTicketStore(Duende.Bff.IUserSessionStore store, Microsoft.AspNetCore.DataProtection.IDataProtectionProvider dataProtectionProvider, Microsoft.Extensions.Logging.ILogger<Duende.Bff.ServerSideTicketStore> logger) { }
+        public System.Threading.Tasks.Task<System.Collections.Generic.IReadOnlyCollection<Microsoft.AspNetCore.Authentication.AuthenticationTicket>> GetUserTicketsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken) { }
+        public System.Threading.Tasks.Task RemoveAsync(string key) { }
+        public System.Threading.Tasks.Task RenewAsync(string key, Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket) { }
+        public System.Threading.Tasks.Task<Microsoft.AspNetCore.Authentication.AuthenticationTicket> RetrieveAsync(string key) { }
+        public System.Threading.Tasks.Task<string> StoreAsync(Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket) { }
+    }
+    public class SessionCleanupHost : Microsoft.Extensions.Hosting.IHostedService
+    {
+        public SessionCleanupHost(System.IServiceProvider serviceProvider, Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Microsoft.Extensions.Logging.ILogger<Duende.Bff.SessionCleanupHost> logger) { }
+        public System.Threading.Tasks.Task StartAsync(System.Threading.CancellationToken cancellationToken) { }
+        public System.Threading.Tasks.Task StopAsync(System.Threading.CancellationToken cancellationToken) { }
+    }
+    public class SessionRevocationService : Duende.Bff.ISessionRevocationService
+    {
+        public SessionRevocationService(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Duende.Bff.IServerTicketStore ticketStore, Duende.Bff.IUserSessionStore sessionStore, Duende.AccessTokenManagement.OpenIdConnect.IUserTokenEndpointService tokenEndpoint, Microsoft.Extensions.Logging.ILogger<Duende.Bff.SessionRevocationService> logger) { }
+        public System.Threading.Tasks.Task RevokeSessionsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken = default) { }
+    }
+    public class TicketStoreShim : Microsoft.AspNetCore.Authentication.Cookies.ITicketStore
+    {
+        public TicketStoreShim(Microsoft.AspNetCore.Http.IHttpContextAccessor httpContextAccessor) { }
+        public System.Threading.Tasks.Task RemoveAsync(string key) { }
+        public System.Threading.Tasks.Task RenewAsync(string key, Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket) { }
+        public System.Threading.Tasks.Task<Microsoft.AspNetCore.Authentication.AuthenticationTicket> RetrieveAsync(string key) { }
+        public System.Threading.Tasks.Task<string> StoreAsync(Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket) { }
+    }
+    public enum TokenType
+    {
+        User = 0,
+        Client = 1,
+        UserOrClient = 2,
+    }
+    public class UnexpectedAccessTokenError : Duende.Bff.AccessTokenRetrievalError
+    {
+        public UnexpectedAccessTokenError(string error) { }
+    }
+    public class UserSession : Duende.Bff.UserSessionUpdate
+    {
+        public UserSession() { }
+        public string Key { get; set; }
+        public Duende.Bff.UserSession Clone() { }
+        public void CopyTo(Duende.Bff.UserSession other) { }
+    }
+    public class UserSessionUpdate
+    {
+        public UserSessionUpdate() { }
+        public System.DateTime Created { get; set; }
+        public System.DateTime? Expires { get; set; }
+        public System.DateTime Renewed { get; set; }
+        public string? SessionId { get; set; }
+        public string SubjectId { get; set; }
+        public string Ticket { get; set; }
+        public void CopyTo(Duende.Bff.UserSessionUpdate other) { }
+    }
+    public class UserSessionsFilter
+    {
+        public UserSessionsFilter() { }
+        public string? SessionId { get; set; }
+        public string? SubjectId { get; init; }
+        public void Validate() { }
+    }
+}
+namespace Duende.Bff.Endpoints
+{
+    public class BffMiddleware
+    {
+        public BffMiddleware(Microsoft.AspNetCore.Http.RequestDelegate next, Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Microsoft.Extensions.Logging.ILogger<Duende.Bff.Endpoints.BffMiddleware> logger) { }
+        public System.Threading.Tasks.Task Invoke(Microsoft.AspNetCore.Http.HttpContext context) { }
+    }
+}
\ No newline at end of file
diff --git a/bff/test/Bff.Blazor.UnitTests/PublicApiVerificationTests.VerifyPublicApi_Bff_Blazor.verified.txt b/bff/test/Bff.Blazor.UnitTests/PublicApiVerificationTests.VerifyPublicApi_Bff_Blazor.verified.txt
new file mode 100644
index 000000000..d311bd394
--- /dev/null
+++ b/bff/test/Bff.Blazor.UnitTests/PublicApiVerificationTests.VerifyPublicApi_Bff_Blazor.verified.txt
@@ -0,0 +1,32 @@
+namespace Duende.Bff.Blazor
+{
+    public class AddServerManagementClaimsTransform : Microsoft.AspNetCore.Authentication.IClaimsTransformation
+    {
+        public AddServerManagementClaimsTransform(Microsoft.AspNetCore.Http.IHttpContextAccessor httpContextAccessor, Microsoft.Extensions.Options.IOptionsMonitor<Duende.Bff.BffOptions> options) { }
+        public System.Threading.Tasks.Task<System.Security.Claims.ClaimsPrincipal> TransformAsync(System.Security.Claims.ClaimsPrincipal principal) { }
+    }
+    public class BffBlazorServerOptions
+    {
+        public BffBlazorServerOptions() { }
+        public int ServerStateProviderPollingInterval { get; set; }
+    }
+    public static class BffBuilderExtensions
+    {
+        public static Microsoft.AspNetCore.Builder.BffBuilder AddBlazorServer(this Microsoft.AspNetCore.Builder.BffBuilder builder, System.Action<Duende.Bff.Blazor.BffBlazorServerOptions>? configureOptions = null) { }
+    }
+    public sealed class BffServerAuthenticationStateProvider : Microsoft.AspNetCore.Components.Server.RevalidatingServerAuthenticationStateProvider, System.IDisposable
+    {
+        public BffServerAuthenticationStateProvider(Duende.Bff.IUserSessionStore sessionStore, Microsoft.AspNetCore.Components.PersistentComponentState persistentComponentState, Microsoft.AspNetCore.Components.NavigationManager navigation, Microsoft.Extensions.Options.IOptions<Duende.Bff.Blazor.BffBlazorServerOptions> blazorOptions, Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> bffOptions, Microsoft.Extensions.Logging.ILoggerFactory loggerFactory) { }
+        protected override System.TimeSpan RevalidationInterval { get; }
+        public void Dispose() { }
+        protected override System.Threading.Tasks.Task<bool> ValidateAuthenticationStateAsync(Microsoft.AspNetCore.Components.Authorization.AuthenticationState authenticationState, System.Threading.CancellationToken cancellationToken) { }
+    }
+    public class ServerSideTokenStore : Duende.AccessTokenManagement.OpenIdConnect.IUserTokenStore
+    {
+        public ServerSideTokenStore(Duende.AccessTokenManagement.OpenIdConnect.IStoreTokensInAuthenticationProperties tokensInAuthProperties, Duende.Bff.IUserSessionStore sessionStore, Microsoft.AspNetCore.DataProtection.IDataProtectionProvider dataProtectionProvider, Microsoft.Extensions.Logging.ILogger<Duende.Bff.Blazor.ServerSideTokenStore> logger, Microsoft.AspNetCore.Components.Authorization.AuthenticationStateProvider authenticationStateProvider) { }
+        public System.Threading.Tasks.Task ClearTokenAsync(System.Security.Claims.ClaimsPrincipal user, Duende.AccessTokenManagement.OpenIdConnect.UserTokenRequestParameters? parameters = null) { }
+        public System.Threading.Tasks.Task<Duende.AccessTokenManagement.OpenIdConnect.UserToken> GetTokenAsync(System.Security.Claims.ClaimsPrincipal user, Duende.AccessTokenManagement.OpenIdConnect.UserTokenRequestParameters? parameters = null) { }
+        public System.Threading.Tasks.Task StoreTokenAsync(System.Security.Claims.ClaimsPrincipal user, Duende.AccessTokenManagement.OpenIdConnect.UserToken token, Duende.AccessTokenManagement.OpenIdConnect.UserTokenRequestParameters? parameters = null) { }
+        protected System.Threading.Tasks.Task UpdateTicket(System.Security.Claims.ClaimsPrincipal user, System.Action<Microsoft.AspNetCore.Authentication.AuthenticationTicket> updateAction) { }
+    }
+}
\ No newline at end of file
diff --git a/bff/test/Bff.Blazor.UnitTests/PublicApiVerificationTests.VerifyPublicApi_Bff_Yarp.verified.txt b/bff/test/Bff.Blazor.UnitTests/PublicApiVerificationTests.VerifyPublicApi_Bff_Yarp.verified.txt
new file mode 100644
index 000000000..219866e92
--- /dev/null
+++ b/bff/test/Bff.Blazor.UnitTests/PublicApiVerificationTests.VerifyPublicApi_Bff_Yarp.verified.txt
@@ -0,0 +1,58 @@
+namespace Duende.Bff
+{
+    public sealed class ActivityPropagationHandler : System.Net.Http.DelegatingHandler
+    {
+        public ActivityPropagationHandler(System.Net.Http.HttpMessageHandler innerHandler) { }
+        protected override System.Threading.Tasks.Task<System.Net.Http.HttpResponseMessage> SendAsync(System.Net.Http.HttpRequestMessage request, System.Threading.CancellationToken cancellationToken) { }
+    }
+}
+namespace Duende.Bff.Yarp
+{
+    public class AccessTokenRequestTransform : Yarp.ReverseProxy.Transforms.RequestTransform
+    {
+        public AccessTokenRequestTransform(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Duende.AccessTokenManagement.IDPoPProofService proofService, Microsoft.Extensions.Logging.ILogger<Duende.Bff.Yarp.AccessTokenRequestTransform> logger) { }
+        public override System.Threading.Tasks.ValueTask ApplyAsync(Yarp.ReverseProxy.Transforms.RequestTransformContext context) { }
+    }
+    public class AccessTokenTransformProvider : Yarp.ReverseProxy.Transforms.Builder.ITransformProvider
+    {
+        public AccessTokenTransformProvider(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Microsoft.Extensions.Logging.ILogger<Duende.Bff.Yarp.AccessTokenTransformProvider> logger, Microsoft.Extensions.Logging.ILoggerFactory loggerFactory, Duende.AccessTokenManagement.IDPoPProofService dPoPProofService) { }
+        public void Apply(Yarp.ReverseProxy.Transforms.Builder.TransformBuilderContext transformBuildContext) { }
+        public void ValidateCluster(Yarp.ReverseProxy.Transforms.Builder.TransformClusterValidationContext context) { }
+        public void ValidateRoute(Yarp.ReverseProxy.Transforms.Builder.TransformRouteValidationContext context) { }
+    }
+    public class AntiforgeryMiddleware
+    {
+        public AntiforgeryMiddleware(Microsoft.AspNetCore.Http.RequestDelegate next, Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Microsoft.Extensions.Logging.ILogger<Duende.Bff.Yarp.AntiforgeryMiddleware> logger) { }
+        public System.Threading.Tasks.Task Invoke(Microsoft.AspNetCore.Http.HttpContext context) { }
+    }
+    public static class BffBuilderExtensions
+    {
+        public static Microsoft.AspNetCore.Builder.BffBuilder AddRemoteApis(this Microsoft.AspNetCore.Builder.BffBuilder builder) { }
+    }
+    public delegate void BffYarpTransformBuilder(string localPath, Yarp.ReverseProxy.Transforms.Builder.TransformBuilderContext context);
+    public static class DefaultBffYarpTransformerBuilders
+    {
+        public static Duende.Bff.Yarp.BffYarpTransformBuilder DirectProxyWithAccessToken;
+    }
+    public static class ProxyAppBuilderExtensions
+    {
+        public static Microsoft.AspNetCore.Builder.IApplicationBuilder UseAntiforgeryCheck(this Microsoft.AspNetCore.Builder.IApplicationBuilder yarpApp) { }
+    }
+    public static class ProxyConfigExtensions
+    {
+        public static Yarp.ReverseProxy.Configuration.ClusterConfig WithAccessToken(this Yarp.ReverseProxy.Configuration.ClusterConfig config, Duende.Bff.TokenType tokenType) { }
+        public static Yarp.ReverseProxy.Configuration.RouteConfig WithAccessToken(this Yarp.ReverseProxy.Configuration.RouteConfig config, Duende.Bff.TokenType tokenType) { }
+        public static Yarp.ReverseProxy.Configuration.RouteConfig WithAntiforgeryCheck(this Yarp.ReverseProxy.Configuration.RouteConfig config) { }
+        public static Yarp.ReverseProxy.Configuration.RouteConfig WithOptionalUserAccessToken(this Yarp.ReverseProxy.Configuration.RouteConfig config) { }
+    }
+    public static class ReverseProxyBuilderExtensions
+    {
+        public static Microsoft.Extensions.DependencyInjection.IReverseProxyBuilder AddBffExtensions(this Microsoft.Extensions.DependencyInjection.IReverseProxyBuilder builder) { }
+    }
+    public static class ReverseProxyEndpointConventionBuilderExtensions
+    {
+        public static Microsoft.AspNetCore.Builder.ReverseProxyConventionBuilder AsBffApiEndpoint(this Microsoft.AspNetCore.Builder.ReverseProxyConventionBuilder builder) { }
+        public static Microsoft.AspNetCore.Builder.ReverseProxyConventionBuilder MapBffReverseProxy(this Microsoft.AspNetCore.Routing.IEndpointRouteBuilder endpoints) { }
+        public static Microsoft.AspNetCore.Builder.ReverseProxyConventionBuilder MapBffReverseProxy(this Microsoft.AspNetCore.Routing.IEndpointRouteBuilder endpoints, System.Action<Microsoft.AspNetCore.Builder.IReverseProxyApplicationBuilder> configureAction) { }
+    }
+}
\ No newline at end of file
diff --git a/bff/test/Bff.Blazor.UnitTests/PublicApiVerificationTests.cs b/bff/test/Bff.Blazor.UnitTests/PublicApiVerificationTests.cs
new file mode 100644
index 000000000..ad5475147
--- /dev/null
+++ b/bff/test/Bff.Blazor.UnitTests/PublicApiVerificationTests.cs
@@ -0,0 +1,22 @@
+// Copyright (c) Duende Software. All rights reserved.
+// See LICENSE in the project root for license information.
+
+using Duende.Bff.Blazor;
+using PublicApiGenerator;
+
+namespace Bff.Tests;
+
+public class PublicApiVerificationTests
+{
+    [Fact]
+    public async Task VerifyPublicApi_Bff_Blazor()
+    {
+        var apiGeneratorOptions = new ApiGeneratorOptions
+        {
+            IncludeAssemblyAttributes = false
+        };
+        var publicApi = typeof(BffBlazorServerOptions).Assembly.GeneratePublicApi(apiGeneratorOptions);
+        var settings = new VerifySettings();
+        await Verify(publicApi, settings);
+    }
+}
diff --git a/bff/test/Bff.EntityFramework.Tests/Bff.EntityFramework.Tests.csproj b/bff/test/Bff.EntityFramework.Tests/Bff.EntityFramework.Tests.csproj
index ed94e774e..d26c1736b 100644
--- a/bff/test/Bff.EntityFramework.Tests/Bff.EntityFramework.Tests.csproj
+++ b/bff/test/Bff.EntityFramework.Tests/Bff.EntityFramework.Tests.csproj
@@ -7,8 +7,9 @@
 
   <ItemGroup>
     <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" />
+    <PackageReference Include="PublicApiGenerator" />
+    <PackageReference Include="Verify.Xunit" />
   </ItemGroup>
-
   <ItemGroup>
     <ProjectReference Include="..\..\src\Bff.EntityFramework\Bff.EntityFramework.csproj" />
   </ItemGroup>
diff --git a/bff/test/Bff.EntityFramework.Tests/PublicApiVerificationTests.VerifyPublicApi_Bff.verified.txt b/bff/test/Bff.EntityFramework.Tests/PublicApiVerificationTests.VerifyPublicApi_Bff.verified.txt
new file mode 100644
index 000000000..0ed1a94a1
--- /dev/null
+++ b/bff/test/Bff.EntityFramework.Tests/PublicApiVerificationTests.VerifyPublicApi_Bff.verified.txt
@@ -0,0 +1,406 @@
+namespace Duende.Bff
+{
+    public abstract class AccessTokenResult
+    {
+        protected AccessTokenResult() { }
+    }
+    [System.Runtime.CompilerServices.RequiredMember]
+    public class AccessTokenRetrievalContext
+    {
+        [System.Obsolete("Constructors of types with required members are not supported in this version of " +
+            "your compiler.", true)]
+        [System.Runtime.CompilerServices.CompilerFeatureRequired("RequiredMembers")]
+        public AccessTokenRetrievalContext() { }
+        [System.Runtime.CompilerServices.RequiredMember]
+        public System.Uri ApiAddress { get; set; }
+        [System.Runtime.CompilerServices.RequiredMember]
+        public Microsoft.AspNetCore.Http.HttpContext HttpContext { get; set; }
+        [System.Runtime.CompilerServices.RequiredMember]
+        public Microsoft.AspNetCore.Http.PathString LocalPath { get; set; }
+        [System.Runtime.CompilerServices.RequiredMember]
+        public Duende.Bff.BffRemoteApiEndpointMetadata Metadata { get; set; }
+        [System.Runtime.CompilerServices.RequiredMember]
+        public Duende.AccessTokenManagement.OpenIdConnect.UserTokenRequestParameters? UserTokenRequestParameters { get; set; }
+    }
+    public class AccessTokenRetrievalError : Duende.Bff.AccessTokenResult
+    {
+        public AccessTokenRetrievalError(string error) { }
+        public string Error { get; set; }
+    }
+    public enum AnonymousSessionResponse
+    {
+        Response401 = 0,
+        Response200 = 1,
+    }
+    public static class AuthenticationPropertiesExtensions
+    {
+        public static bool IsSilentLogin(this Microsoft.AspNetCore.Authentication.AuthenticationProperties props) { }
+    }
+    public static class AuthenticationTicketExtensions
+    {
+        public static Microsoft.AspNetCore.Authentication.AuthenticationTicket? Deserialize(this Duende.Bff.UserSession session, Microsoft.AspNetCore.DataProtection.IDataProtector protector, Microsoft.Extensions.Logging.ILogger logger) { }
+        public static System.DateTime? GetExpiration(this Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket) { }
+        public static System.DateTime GetIssued(this Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket) { }
+        public static string? GetSessionId(this Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket) { }
+        public static string GetSubjectId(this Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket) { }
+        public static string Serialize(this Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket, Microsoft.AspNetCore.DataProtection.IDataProtector protector) { }
+        public class Envelope
+        {
+            public Envelope() { }
+            public string Payload { get; set; }
+            public int Version { get; set; }
+        }
+    }
+    public class BearerTokenResult : Duende.Bff.AccessTokenResult
+    {
+        public BearerTokenResult(string accessToken) { }
+        public string AccessToken { get; }
+    }
+    [System.AttributeUsage(System.AttributeTargets.Class | System.AttributeTargets.Method)]
+    public class BffApiAttribute : System.Attribute, Duende.Bff.IBffApiEndpoint
+    {
+        public BffApiAttribute() { }
+    }
+    [System.AttributeUsage(System.AttributeTargets.Class | System.AttributeTargets.Method)]
+    public class BffApiSkipAntiforgeryAttribute : System.Attribute, Duende.Bff.IBffApiSkipAntiforgery
+    {
+        public BffApiSkipAntiforgeryAttribute() { }
+    }
+    [System.AttributeUsage(System.AttributeTargets.Class | System.AttributeTargets.Method)]
+    public class BffApiSkipResponseHandlingAttribute : System.Attribute, Duende.Bff.IBffApiSkipResponseHandling
+    {
+        public BffApiSkipResponseHandlingAttribute() { }
+    }
+    public class BffOpenIdConnectEvents : Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectEvents
+    {
+        protected readonly Microsoft.Extensions.Logging.ILogger<Duende.Bff.BffOpenIdConnectEvents> Logger;
+        public BffOpenIdConnectEvents(Microsoft.Extensions.Logging.ILogger<Duende.Bff.BffOpenIdConnectEvents> logger) { }
+        public override System.Threading.Tasks.Task AuthenticationFailed(Microsoft.AspNetCore.Authentication.OpenIdConnect.AuthenticationFailedContext context) { }
+        public override System.Threading.Tasks.Task MessageReceived(Microsoft.AspNetCore.Authentication.OpenIdConnect.MessageReceivedContext context) { }
+        public virtual System.Threading.Tasks.Task<bool> ProcessAuthenticationFailedAsync(Microsoft.AspNetCore.Authentication.OpenIdConnect.AuthenticationFailedContext context) { }
+        public virtual System.Threading.Tasks.Task<bool> ProcessMessageReceivedAsync(Microsoft.AspNetCore.Authentication.OpenIdConnect.MessageReceivedContext context) { }
+        public virtual System.Threading.Tasks.Task<bool> ProcessRedirectToIdentityProviderAsync(Microsoft.AspNetCore.Authentication.OpenIdConnect.RedirectContext context) { }
+        public override System.Threading.Tasks.Task RedirectToIdentityProvider(Microsoft.AspNetCore.Authentication.OpenIdConnect.RedirectContext context) { }
+    }
+    public class BffOptions
+    {
+        public BffOptions() { }
+        public Duende.Bff.AnonymousSessionResponse AnonymousSessionResponse { get; set; }
+        public string AntiForgeryHeaderName { get; set; }
+        public string AntiForgeryHeaderValue { get; set; }
+        public Microsoft.AspNetCore.Http.PathString BackChannelLogoutPath { get; }
+        public bool BackchannelLogoutAllUserSessions { get; set; }
+        public string? DPoPJsonWebKey { get; set; }
+        public System.Collections.Generic.ICollection<string> DiagnosticsEnvironments { get; set; }
+        public Microsoft.AspNetCore.Http.PathString DiagnosticsPath { get; }
+        public bool EnableSessionCleanup { get; set; }
+        public bool EnforceBffMiddleware { get; set; }
+        public string? LicenseKey { get; set; }
+        public Microsoft.AspNetCore.Http.PathString LoginPath { get; }
+        public Microsoft.AspNetCore.Http.PathString LogoutPath { get; }
+        public Microsoft.AspNetCore.Http.PathString ManagementBasePath { get; set; }
+        public bool RemoveSessionAfterRefreshTokenExpiration { get; set; }
+        public bool RequireLogoutSessionId { get; set; }
+        public bool RevokeRefreshTokenOnLogout { get; set; }
+        public System.TimeSpan SessionCleanupInterval { get; set; }
+        public Microsoft.AspNetCore.Http.PathString SilentLoginCallbackPath { get; }
+        public Microsoft.AspNetCore.Http.PathString SilentLoginPath { get; }
+        public Microsoft.AspNetCore.Http.PathString UserPath { get; }
+    }
+    public class BffRemoteApiEndpointMetadata : Duende.Bff.IBffApiEndpoint
+    {
+        public Duende.Bff.TokenType? RequiredTokenType;
+        public BffRemoteApiEndpointMetadata() { }
+        public System.Type AccessTokenRetriever { get; set; }
+        public Duende.Bff.BffUserAccessTokenParameters? BffUserAccessTokenParameters { get; set; }
+        public bool OptionalUserToken { get; set; }
+    }
+    public class BffUserAccessTokenParameters
+    {
+        public BffUserAccessTokenParameters(string? signInScheme = null, string? challengeScheme = null, bool forceRenewal = false, string? resource = null) { }
+        public Duende.AccessTokenManagement.OpenIdConnect.UserTokenRequestParameters ToUserAccessTokenRequestParameters() { }
+    }
+    public class ClaimRecord
+    {
+        public ClaimRecord() { }
+        public ClaimRecord(string type, object value) { }
+        [System.Text.Json.Serialization.JsonPropertyName("type")]
+        public string Type { get; init; }
+        [System.Text.Json.Serialization.JsonPropertyName("valueType")]
+        public string? ValueType { get; init; }
+        [System.Text.Json.Serialization.JsonPropertyName("value")]
+        public object Value { get; init; }
+    }
+    public static class Constants
+    {
+        public static class BffFlags
+        {
+            public const string SilentLogin = "bff-silent-login";
+        }
+        public static class ClaimTypes
+        {
+            public const string LogoutUrl = "bff:logout_url";
+            public const string SessionExpiresIn = "bff:session_expires_in";
+            public const string SessionState = "bff:session_state";
+        }
+        public static class ManagementEndpoints
+        {
+            public const string BackChannelLogout = "/backchannel";
+            public const string Diagnostics = "/diagnostics";
+            public const string Login = "/login";
+            public const string Logout = "/logout";
+            public const string SilentLogin = "/silent-login";
+            public const string SilentLoginCallback = "/silent-login-callback";
+            public const string User = "/user";
+        }
+        public static class RequestParameters
+        {
+            public const string ReturnUrl = "returnUrl";
+            public const string SlideCookie = "slide";
+        }
+        public static class Yarp
+        {
+            public const string AntiforgeryCheckMetadata = "Duende.Bff.Yarp.AntiforgeryCheck";
+            public const string OptionalUserTokenMetadata = "Duende.Bff.Yarp.OptionalUserToken";
+            public const string TokenTypeMetadata = "Duende.Bff.Yarp.TokenType";
+        }
+    }
+    public class DPoPTokenResult : Duende.Bff.AccessTokenResult
+    {
+        public DPoPTokenResult(string accessToken, string dpopJWK) { }
+        public string AccessToken { get; set; }
+        public string DPoPJsonWebKey { get; set; }
+    }
+    public class DefaultAccessTokenRetriever : Duende.Bff.IAccessTokenRetriever
+    {
+        protected readonly Microsoft.Extensions.Logging.ILogger<Duende.Bff.DefaultAccessTokenRetriever> Logger;
+        public DefaultAccessTokenRetriever(Microsoft.Extensions.Logging.ILogger<Duende.Bff.DefaultAccessTokenRetriever> logger) { }
+        public virtual System.Threading.Tasks.Task<Duende.Bff.AccessTokenResult> GetAccessToken(Duende.Bff.AccessTokenRetrievalContext context) { }
+    }
+    public class DefaultBackchannelLogoutService : Duende.Bff.IBackchannelLogoutService, Duende.Bff.IBffEndpointService
+    {
+        protected readonly Microsoft.AspNetCore.Authentication.IAuthenticationSchemeProvider AuthenticationSchemeProvider;
+        protected readonly Microsoft.Extensions.Logging.ILogger<Duende.Bff.DefaultBackchannelLogoutService> Logger;
+        protected readonly Microsoft.Extensions.Options.IOptionsMonitor<Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectOptions> OptionsMonitor;
+        protected readonly Duende.Bff.ISessionRevocationService UserSession;
+        public DefaultBackchannelLogoutService(Microsoft.AspNetCore.Authentication.IAuthenticationSchemeProvider authenticationSchemeProvider, Microsoft.Extensions.Options.IOptionsMonitor<Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectOptions> optionsMonitor, Duende.Bff.ISessionRevocationService userSession, Microsoft.Extensions.Logging.ILogger<Duende.Bff.DefaultBackchannelLogoutService> logger) { }
+        protected virtual System.Threading.Tasks.Task<Microsoft.IdentityModel.Tokens.TokenValidationParameters> GetTokenValidationParameters() { }
+        public virtual System.Threading.Tasks.Task ProcessRequestAsync(Microsoft.AspNetCore.Http.HttpContext context) { }
+        protected virtual System.Threading.Tasks.Task<System.Security.Claims.ClaimsIdentity?> ValidateJwt(string jwt) { }
+        protected virtual System.Threading.Tasks.Task<System.Security.Claims.ClaimsIdentity?> ValidateLogoutTokenAsync(string logoutToken) { }
+    }
+    public class DefaultDiagnosticsService : Duende.Bff.IBffEndpointService, Duende.Bff.IDiagnosticsService
+    {
+        protected readonly Microsoft.AspNetCore.Hosting.IWebHostEnvironment Environment;
+        protected readonly Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> Options;
+        public DefaultDiagnosticsService(Microsoft.AspNetCore.Hosting.IWebHostEnvironment environment, Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options) { }
+        public virtual System.Threading.Tasks.Task ProcessRequestAsync(Microsoft.AspNetCore.Http.HttpContext context) { }
+    }
+    public class DefaultLoginService : Duende.Bff.IBffEndpointService, Duende.Bff.ILoginService
+    {
+        protected readonly Microsoft.Extensions.Logging.ILogger Logger;
+        protected readonly Duende.Bff.BffOptions Options;
+        protected readonly Duende.Bff.IReturnUrlValidator ReturnUrlValidator;
+        public DefaultLoginService(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Duende.Bff.IReturnUrlValidator returnUrlValidator, Microsoft.Extensions.Logging.ILogger<Duende.Bff.DefaultLoginService> logger) { }
+        public virtual System.Threading.Tasks.Task ProcessRequestAsync(Microsoft.AspNetCore.Http.HttpContext context) { }
+    }
+    public class DefaultLogoutService : Duende.Bff.IBffEndpointService, Duende.Bff.ILogoutService
+    {
+        protected readonly Microsoft.AspNetCore.Authentication.IAuthenticationSchemeProvider AuthenticationSchemeProvider;
+        protected readonly Microsoft.Extensions.Logging.ILogger Logger;
+        protected readonly Duende.Bff.BffOptions Options;
+        protected readonly Duende.Bff.IReturnUrlValidator ReturnUrlValidator;
+        public DefaultLogoutService(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Microsoft.AspNetCore.Authentication.IAuthenticationSchemeProvider authenticationAuthenticationSchemeProviderProvider, Duende.Bff.IReturnUrlValidator returnUrlValidator, Microsoft.Extensions.Logging.ILogger<Duende.Bff.DefaultLogoutService> logger) { }
+        public virtual System.Threading.Tasks.Task ProcessRequestAsync(Microsoft.AspNetCore.Http.HttpContext context) { }
+    }
+    public class DefaultSilentLoginCallbackService : Duende.Bff.IBffEndpointService, Duende.Bff.ISilentLoginCallbackService
+    {
+        protected readonly Microsoft.Extensions.Logging.ILogger Logger;
+        protected readonly Duende.Bff.BffOptions Options;
+        public DefaultSilentLoginCallbackService(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Microsoft.Extensions.Logging.ILogger<Duende.Bff.DefaultSilentLoginCallbackService> logger) { }
+        public virtual System.Threading.Tasks.Task ProcessRequestAsync(Microsoft.AspNetCore.Http.HttpContext context) { }
+    }
+    public class DefaultSilentLoginService : Duende.Bff.IBffEndpointService, Duende.Bff.ISilentLoginService
+    {
+        protected readonly Microsoft.Extensions.Logging.ILogger Logger;
+        protected readonly Duende.Bff.BffOptions Options;
+        public DefaultSilentLoginService(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Microsoft.Extensions.Logging.ILogger<Duende.Bff.DefaultSilentLoginService> logger) { }
+        public virtual System.Threading.Tasks.Task ProcessRequestAsync(Microsoft.AspNetCore.Http.HttpContext context) { }
+    }
+    public class DefaultUserService : Duende.Bff.IBffEndpointService, Duende.Bff.IUserService
+    {
+        protected readonly Microsoft.Extensions.Logging.ILogger Logger;
+        protected readonly Duende.Bff.BffOptions Options;
+        public DefaultUserService(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Microsoft.Extensions.Logging.ILoggerFactory loggerFactory) { }
+        protected virtual System.Threading.Tasks.Task<System.Collections.Generic.IEnumerable<Duende.Bff.ClaimRecord>> GetManagementClaimsAsync(Microsoft.AspNetCore.Http.HttpContext context, Microsoft.AspNetCore.Authentication.AuthenticateResult authenticateResult) { }
+        protected virtual System.Threading.Tasks.Task<System.Collections.Generic.IEnumerable<Duende.Bff.ClaimRecord>> GetUserClaimsAsync(Microsoft.AspNetCore.Authentication.AuthenticateResult authenticateResult) { }
+        public virtual System.Threading.Tasks.Task ProcessRequestAsync(Microsoft.AspNetCore.Http.HttpContext context) { }
+    }
+    public interface IAccessTokenRetriever
+    {
+        System.Threading.Tasks.Task<Duende.Bff.AccessTokenResult> GetAccessToken(Duende.Bff.AccessTokenRetrievalContext context);
+    }
+    public interface IBackchannelLogoutService : Duende.Bff.IBffEndpointService { }
+    public interface IBffApiEndpoint { }
+    public interface IBffApiSkipAntiforgery { }
+    public interface IBffApiSkipResponseHandling { }
+    public interface IBffEndpointService
+    {
+        System.Threading.Tasks.Task ProcessRequestAsync(Microsoft.AspNetCore.Http.HttpContext context);
+    }
+    public interface IDiagnosticsService : Duende.Bff.IBffEndpointService { }
+    public interface ILoginService : Duende.Bff.IBffEndpointService { }
+    public interface ILogoutService : Duende.Bff.IBffEndpointService { }
+    public interface IReturnUrlValidator
+    {
+        System.Threading.Tasks.Task<bool> IsValidAsync(string returnUrl);
+    }
+    public interface IServerTicketStore : Microsoft.AspNetCore.Authentication.Cookies.ITicketStore
+    {
+        System.Threading.Tasks.Task<System.Collections.Generic.IReadOnlyCollection<Microsoft.AspNetCore.Authentication.AuthenticationTicket>> GetUserTicketsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken = default);
+    }
+    public interface ISessionRevocationService
+    {
+        System.Threading.Tasks.Task RevokeSessionsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken = default);
+    }
+    public interface ISilentLoginCallbackService : Duende.Bff.IBffEndpointService { }
+    public interface ISilentLoginService : Duende.Bff.IBffEndpointService { }
+    public interface IUserService : Duende.Bff.IBffEndpointService { }
+    public interface IUserSessionStore
+    {
+        System.Threading.Tasks.Task CreateUserSessionAsync(Duende.Bff.UserSession session, System.Threading.CancellationToken cancellationToken = default);
+        System.Threading.Tasks.Task DeleteUserSessionAsync(string key, System.Threading.CancellationToken cancellationToken = default);
+        System.Threading.Tasks.Task DeleteUserSessionsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken = default);
+        System.Threading.Tasks.Task<Duende.Bff.UserSession?> GetUserSessionAsync(string key, System.Threading.CancellationToken cancellationToken = default);
+        System.Threading.Tasks.Task<System.Collections.Generic.IReadOnlyCollection<Duende.Bff.UserSession>> GetUserSessionsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken = default);
+        System.Threading.Tasks.Task UpdateUserSessionAsync(string key, Duende.Bff.UserSessionUpdate session, System.Threading.CancellationToken cancellationToken = default);
+    }
+    public interface IUserSessionStoreCleanup
+    {
+        System.Threading.Tasks.Task DeleteExpiredSessionsAsync(System.Threading.CancellationToken cancellationToken = default);
+    }
+    public class InMemoryUserSessionStore : Duende.Bff.IUserSessionStore
+    {
+        public InMemoryUserSessionStore() { }
+        public System.Threading.Tasks.Task CreateUserSessionAsync(Duende.Bff.UserSession session, System.Threading.CancellationToken cancellationToken = default) { }
+        public System.Threading.Tasks.Task DeleteUserSessionAsync(string key, System.Threading.CancellationToken cancellationToken = default) { }
+        public System.Threading.Tasks.Task DeleteUserSessionsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken = default) { }
+        public System.Threading.Tasks.Task<Duende.Bff.UserSession?> GetUserSessionAsync(string key, System.Threading.CancellationToken cancellationToken = default) { }
+        public System.Threading.Tasks.Task<System.Collections.Generic.IReadOnlyCollection<Duende.Bff.UserSession>> GetUserSessionsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken = default) { }
+        public System.Threading.Tasks.Task UpdateUserSessionAsync(string key, Duende.Bff.UserSessionUpdate session, System.Threading.CancellationToken cancellationToken = default) { }
+    }
+    public class MissingDPopTokenError : Duende.Bff.AccessTokenRetrievalError
+    {
+        public MissingDPopTokenError(string error) { }
+    }
+    public class NoAccessTokenResult : Duende.Bff.AccessTokenResult
+    {
+        public NoAccessTokenResult() { }
+    }
+    public class NoAccessTokenReturnedError : Duende.Bff.AccessTokenRetrievalError
+    {
+        public NoAccessTokenReturnedError(string error) { }
+    }
+    public class NopSessionRevocationService : Duende.Bff.ISessionRevocationService
+    {
+        public NopSessionRevocationService(Microsoft.Extensions.Logging.ILogger<Duende.Bff.NopSessionRevocationService> logger) { }
+        public System.Threading.Tasks.Task RevokeSessionsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken = default) { }
+    }
+    public class PostConfigureApplicationCookieRevokeRefreshToken : Microsoft.Extensions.Options.IPostConfigureOptions<Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions>
+    {
+        public PostConfigureApplicationCookieRevokeRefreshToken(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> bffOptions, Microsoft.Extensions.Options.IOptions<Microsoft.AspNetCore.Authentication.AuthenticationOptions> authOptions, Microsoft.Extensions.Logging.ILogger<Duende.Bff.PostConfigureApplicationCookieRevokeRefreshToken> logger) { }
+        public void PostConfigure(string? name, Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions options) { }
+    }
+    public class PostConfigureApplicationCookieTicketStore : Microsoft.Extensions.Options.IPostConfigureOptions<Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions>
+    {
+        public PostConfigureApplicationCookieTicketStore(Microsoft.AspNetCore.Http.IHttpContextAccessor httpContextAccessor, Microsoft.Extensions.Options.IOptions<Microsoft.AspNetCore.Authentication.AuthenticationOptions> options) { }
+        public void PostConfigure(string? name, Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions options) { }
+    }
+    public class PostConfigureApplicationValidatePrincipal : Microsoft.Extensions.Options.IPostConfigureOptions<Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions>
+    {
+        public PostConfigureApplicationValidatePrincipal(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> bffOptions, Microsoft.Extensions.Options.IOptions<Microsoft.AspNetCore.Authentication.AuthenticationOptions> authOptions, Microsoft.Extensions.Logging.ILogger<Duende.Bff.PostConfigureApplicationValidatePrincipal> logger) { }
+        public void PostConfigure(string? name, Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions options) { }
+    }
+    public class PostConfigureOidcOptionsForSilentLogin : Microsoft.Extensions.Options.IPostConfigureOptions<Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectOptions>
+    {
+        public PostConfigureOidcOptionsForSilentLogin(Microsoft.Extensions.Options.IOptions<Microsoft.AspNetCore.Authentication.AuthenticationOptions> options, Microsoft.Extensions.Logging.ILoggerFactory logger) { }
+        public void PostConfigure(string? name, Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectOptions options) { }
+    }
+    public class PostConfigureSlidingExpirationCheck : Microsoft.Extensions.Options.IPostConfigureOptions<Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions>
+    {
+        public PostConfigureSlidingExpirationCheck(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> bffOptions, Microsoft.Extensions.Options.IOptions<Microsoft.AspNetCore.Authentication.AuthenticationOptions> authOptions, Microsoft.Extensions.Logging.ILogger<Duende.Bff.PostConfigureSlidingExpirationCheck> logger) { }
+        public void PostConfigure(string? name, Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions options) { }
+    }
+    public class ServerSideTicketStore : Duende.Bff.IServerTicketStore, Microsoft.AspNetCore.Authentication.Cookies.ITicketStore
+    {
+        public static string DataProtectorPurpose;
+        public ServerSideTicketStore(Duende.Bff.IUserSessionStore store, Microsoft.AspNetCore.DataProtection.IDataProtectionProvider dataProtectionProvider, Microsoft.Extensions.Logging.ILogger<Duende.Bff.ServerSideTicketStore> logger) { }
+        public System.Threading.Tasks.Task<System.Collections.Generic.IReadOnlyCollection<Microsoft.AspNetCore.Authentication.AuthenticationTicket>> GetUserTicketsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken) { }
+        public System.Threading.Tasks.Task RemoveAsync(string key) { }
+        public System.Threading.Tasks.Task RenewAsync(string key, Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket) { }
+        public System.Threading.Tasks.Task<Microsoft.AspNetCore.Authentication.AuthenticationTicket> RetrieveAsync(string key) { }
+        public System.Threading.Tasks.Task<string> StoreAsync(Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket) { }
+    }
+    public class SessionCleanupHost : Microsoft.Extensions.Hosting.IHostedService
+    {
+        public SessionCleanupHost(System.IServiceProvider serviceProvider, Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Microsoft.Extensions.Logging.ILogger<Duende.Bff.SessionCleanupHost> logger) { }
+        public System.Threading.Tasks.Task StartAsync(System.Threading.CancellationToken cancellationToken) { }
+        public System.Threading.Tasks.Task StopAsync(System.Threading.CancellationToken cancellationToken) { }
+    }
+    public class SessionRevocationService : Duende.Bff.ISessionRevocationService
+    {
+        public SessionRevocationService(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Duende.Bff.IServerTicketStore ticketStore, Duende.Bff.IUserSessionStore sessionStore, Duende.AccessTokenManagement.OpenIdConnect.IUserTokenEndpointService tokenEndpoint, Microsoft.Extensions.Logging.ILogger<Duende.Bff.SessionRevocationService> logger) { }
+        public System.Threading.Tasks.Task RevokeSessionsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken = default) { }
+    }
+    public class TicketStoreShim : Microsoft.AspNetCore.Authentication.Cookies.ITicketStore
+    {
+        public TicketStoreShim(Microsoft.AspNetCore.Http.IHttpContextAccessor httpContextAccessor) { }
+        public System.Threading.Tasks.Task RemoveAsync(string key) { }
+        public System.Threading.Tasks.Task RenewAsync(string key, Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket) { }
+        public System.Threading.Tasks.Task<Microsoft.AspNetCore.Authentication.AuthenticationTicket> RetrieveAsync(string key) { }
+        public System.Threading.Tasks.Task<string> StoreAsync(Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket) { }
+    }
+    public enum TokenType
+    {
+        User = 0,
+        Client = 1,
+        UserOrClient = 2,
+    }
+    public class UnexpectedAccessTokenError : Duende.Bff.AccessTokenRetrievalError
+    {
+        public UnexpectedAccessTokenError(string error) { }
+    }
+    public class UserSession : Duende.Bff.UserSessionUpdate
+    {
+        public UserSession() { }
+        public string Key { get; set; }
+        public Duende.Bff.UserSession Clone() { }
+        public void CopyTo(Duende.Bff.UserSession other) { }
+    }
+    public class UserSessionUpdate
+    {
+        public UserSessionUpdate() { }
+        public System.DateTime Created { get; set; }
+        public System.DateTime? Expires { get; set; }
+        public System.DateTime Renewed { get; set; }
+        public string? SessionId { get; set; }
+        public string SubjectId { get; set; }
+        public string Ticket { get; set; }
+        public void CopyTo(Duende.Bff.UserSessionUpdate other) { }
+    }
+    public class UserSessionsFilter
+    {
+        public UserSessionsFilter() { }
+        public string? SessionId { get; set; }
+        public string? SubjectId { get; init; }
+        public void Validate() { }
+    }
+}
+namespace Duende.Bff.Endpoints
+{
+    public class BffMiddleware
+    {
+        public BffMiddleware(Microsoft.AspNetCore.Http.RequestDelegate next, Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Microsoft.Extensions.Logging.ILogger<Duende.Bff.Endpoints.BffMiddleware> logger) { }
+        public System.Threading.Tasks.Task Invoke(Microsoft.AspNetCore.Http.HttpContext context) { }
+    }
+}
\ No newline at end of file
diff --git a/bff/test/Bff.EntityFramework.Tests/PublicApiVerificationTests.VerifyPublicApi_Bff_Yarp.verified.txt b/bff/test/Bff.EntityFramework.Tests/PublicApiVerificationTests.VerifyPublicApi_Bff_Yarp.verified.txt
new file mode 100644
index 000000000..219866e92
--- /dev/null
+++ b/bff/test/Bff.EntityFramework.Tests/PublicApiVerificationTests.VerifyPublicApi_Bff_Yarp.verified.txt
@@ -0,0 +1,58 @@
+namespace Duende.Bff
+{
+    public sealed class ActivityPropagationHandler : System.Net.Http.DelegatingHandler
+    {
+        public ActivityPropagationHandler(System.Net.Http.HttpMessageHandler innerHandler) { }
+        protected override System.Threading.Tasks.Task<System.Net.Http.HttpResponseMessage> SendAsync(System.Net.Http.HttpRequestMessage request, System.Threading.CancellationToken cancellationToken) { }
+    }
+}
+namespace Duende.Bff.Yarp
+{
+    public class AccessTokenRequestTransform : Yarp.ReverseProxy.Transforms.RequestTransform
+    {
+        public AccessTokenRequestTransform(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Duende.AccessTokenManagement.IDPoPProofService proofService, Microsoft.Extensions.Logging.ILogger<Duende.Bff.Yarp.AccessTokenRequestTransform> logger) { }
+        public override System.Threading.Tasks.ValueTask ApplyAsync(Yarp.ReverseProxy.Transforms.RequestTransformContext context) { }
+    }
+    public class AccessTokenTransformProvider : Yarp.ReverseProxy.Transforms.Builder.ITransformProvider
+    {
+        public AccessTokenTransformProvider(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Microsoft.Extensions.Logging.ILogger<Duende.Bff.Yarp.AccessTokenTransformProvider> logger, Microsoft.Extensions.Logging.ILoggerFactory loggerFactory, Duende.AccessTokenManagement.IDPoPProofService dPoPProofService) { }
+        public void Apply(Yarp.ReverseProxy.Transforms.Builder.TransformBuilderContext transformBuildContext) { }
+        public void ValidateCluster(Yarp.ReverseProxy.Transforms.Builder.TransformClusterValidationContext context) { }
+        public void ValidateRoute(Yarp.ReverseProxy.Transforms.Builder.TransformRouteValidationContext context) { }
+    }
+    public class AntiforgeryMiddleware
+    {
+        public AntiforgeryMiddleware(Microsoft.AspNetCore.Http.RequestDelegate next, Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Microsoft.Extensions.Logging.ILogger<Duende.Bff.Yarp.AntiforgeryMiddleware> logger) { }
+        public System.Threading.Tasks.Task Invoke(Microsoft.AspNetCore.Http.HttpContext context) { }
+    }
+    public static class BffBuilderExtensions
+    {
+        public static Microsoft.AspNetCore.Builder.BffBuilder AddRemoteApis(this Microsoft.AspNetCore.Builder.BffBuilder builder) { }
+    }
+    public delegate void BffYarpTransformBuilder(string localPath, Yarp.ReverseProxy.Transforms.Builder.TransformBuilderContext context);
+    public static class DefaultBffYarpTransformerBuilders
+    {
+        public static Duende.Bff.Yarp.BffYarpTransformBuilder DirectProxyWithAccessToken;
+    }
+    public static class ProxyAppBuilderExtensions
+    {
+        public static Microsoft.AspNetCore.Builder.IApplicationBuilder UseAntiforgeryCheck(this Microsoft.AspNetCore.Builder.IApplicationBuilder yarpApp) { }
+    }
+    public static class ProxyConfigExtensions
+    {
+        public static Yarp.ReverseProxy.Configuration.ClusterConfig WithAccessToken(this Yarp.ReverseProxy.Configuration.ClusterConfig config, Duende.Bff.TokenType tokenType) { }
+        public static Yarp.ReverseProxy.Configuration.RouteConfig WithAccessToken(this Yarp.ReverseProxy.Configuration.RouteConfig config, Duende.Bff.TokenType tokenType) { }
+        public static Yarp.ReverseProxy.Configuration.RouteConfig WithAntiforgeryCheck(this Yarp.ReverseProxy.Configuration.RouteConfig config) { }
+        public static Yarp.ReverseProxy.Configuration.RouteConfig WithOptionalUserAccessToken(this Yarp.ReverseProxy.Configuration.RouteConfig config) { }
+    }
+    public static class ReverseProxyBuilderExtensions
+    {
+        public static Microsoft.Extensions.DependencyInjection.IReverseProxyBuilder AddBffExtensions(this Microsoft.Extensions.DependencyInjection.IReverseProxyBuilder builder) { }
+    }
+    public static class ReverseProxyEndpointConventionBuilderExtensions
+    {
+        public static Microsoft.AspNetCore.Builder.ReverseProxyConventionBuilder AsBffApiEndpoint(this Microsoft.AspNetCore.Builder.ReverseProxyConventionBuilder builder) { }
+        public static Microsoft.AspNetCore.Builder.ReverseProxyConventionBuilder MapBffReverseProxy(this Microsoft.AspNetCore.Routing.IEndpointRouteBuilder endpoints) { }
+        public static Microsoft.AspNetCore.Builder.ReverseProxyConventionBuilder MapBffReverseProxy(this Microsoft.AspNetCore.Routing.IEndpointRouteBuilder endpoints, System.Action<Microsoft.AspNetCore.Builder.IReverseProxyApplicationBuilder> configureAction) { }
+    }
+}
\ No newline at end of file
diff --git a/bff/test/Bff.EntityFramework.Tests/PublicApiVerificationTests.cs b/bff/test/Bff.EntityFramework.Tests/PublicApiVerificationTests.cs
new file mode 100644
index 000000000..8ee0dc65b
--- /dev/null
+++ b/bff/test/Bff.EntityFramework.Tests/PublicApiVerificationTests.cs
@@ -0,0 +1,21 @@
+// Copyright (c) Duende Software. All rights reserved.
+// See LICENSE in the project root for license information.
+
+using Duende.Bff.EntityFramework;
+using PublicApiGenerator;
+
+namespace Bff.Tests;
+
+public class PublicApiVerificationTests
+{
+    public async Task VerifyPublicApi_Bff_EntityFramework()
+    {
+        var apiGeneratorOptions = new ApiGeneratorOptions
+        {
+            IncludeAssemblyAttributes = false
+        };
+        var publicApi = typeof(ISessionDbContext).Assembly.GeneratePublicApi(apiGeneratorOptions);
+        var settings = new VerifySettings();
+        await Verify(publicApi, settings);
+    }
+}
diff --git a/bff/test/Bff.Tests/Bff.Tests.csproj b/bff/test/Bff.Tests/Bff.Tests.csproj
index dca988cc0..ca59118d0 100644
--- a/bff/test/Bff.Tests/Bff.Tests.csproj
+++ b/bff/test/Bff.Tests/Bff.Tests.csproj
@@ -11,6 +11,8 @@
     <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" />
     <PackageReference Include="Microsoft.AspNetCore.TestHost" />
     <PackageReference Include="Microsoft.Extensions.TimeProvider.Testing" />
+    <PackageReference Include="PublicApiGenerator" />
+    <PackageReference Include="Verify.Xunit" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/bff/test/Bff.Tests/PublicApiVerificationTests.VerifyPublicApi_Bff.verified.txt b/bff/test/Bff.Tests/PublicApiVerificationTests.VerifyPublicApi_Bff.verified.txt
new file mode 100644
index 000000000..0ed1a94a1
--- /dev/null
+++ b/bff/test/Bff.Tests/PublicApiVerificationTests.VerifyPublicApi_Bff.verified.txt
@@ -0,0 +1,406 @@
+namespace Duende.Bff
+{
+    public abstract class AccessTokenResult
+    {
+        protected AccessTokenResult() { }
+    }
+    [System.Runtime.CompilerServices.RequiredMember]
+    public class AccessTokenRetrievalContext
+    {
+        [System.Obsolete("Constructors of types with required members are not supported in this version of " +
+            "your compiler.", true)]
+        [System.Runtime.CompilerServices.CompilerFeatureRequired("RequiredMembers")]
+        public AccessTokenRetrievalContext() { }
+        [System.Runtime.CompilerServices.RequiredMember]
+        public System.Uri ApiAddress { get; set; }
+        [System.Runtime.CompilerServices.RequiredMember]
+        public Microsoft.AspNetCore.Http.HttpContext HttpContext { get; set; }
+        [System.Runtime.CompilerServices.RequiredMember]
+        public Microsoft.AspNetCore.Http.PathString LocalPath { get; set; }
+        [System.Runtime.CompilerServices.RequiredMember]
+        public Duende.Bff.BffRemoteApiEndpointMetadata Metadata { get; set; }
+        [System.Runtime.CompilerServices.RequiredMember]
+        public Duende.AccessTokenManagement.OpenIdConnect.UserTokenRequestParameters? UserTokenRequestParameters { get; set; }
+    }
+    public class AccessTokenRetrievalError : Duende.Bff.AccessTokenResult
+    {
+        public AccessTokenRetrievalError(string error) { }
+        public string Error { get; set; }
+    }
+    public enum AnonymousSessionResponse
+    {
+        Response401 = 0,
+        Response200 = 1,
+    }
+    public static class AuthenticationPropertiesExtensions
+    {
+        public static bool IsSilentLogin(this Microsoft.AspNetCore.Authentication.AuthenticationProperties props) { }
+    }
+    public static class AuthenticationTicketExtensions
+    {
+        public static Microsoft.AspNetCore.Authentication.AuthenticationTicket? Deserialize(this Duende.Bff.UserSession session, Microsoft.AspNetCore.DataProtection.IDataProtector protector, Microsoft.Extensions.Logging.ILogger logger) { }
+        public static System.DateTime? GetExpiration(this Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket) { }
+        public static System.DateTime GetIssued(this Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket) { }
+        public static string? GetSessionId(this Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket) { }
+        public static string GetSubjectId(this Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket) { }
+        public static string Serialize(this Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket, Microsoft.AspNetCore.DataProtection.IDataProtector protector) { }
+        public class Envelope
+        {
+            public Envelope() { }
+            public string Payload { get; set; }
+            public int Version { get; set; }
+        }
+    }
+    public class BearerTokenResult : Duende.Bff.AccessTokenResult
+    {
+        public BearerTokenResult(string accessToken) { }
+        public string AccessToken { get; }
+    }
+    [System.AttributeUsage(System.AttributeTargets.Class | System.AttributeTargets.Method)]
+    public class BffApiAttribute : System.Attribute, Duende.Bff.IBffApiEndpoint
+    {
+        public BffApiAttribute() { }
+    }
+    [System.AttributeUsage(System.AttributeTargets.Class | System.AttributeTargets.Method)]
+    public class BffApiSkipAntiforgeryAttribute : System.Attribute, Duende.Bff.IBffApiSkipAntiforgery
+    {
+        public BffApiSkipAntiforgeryAttribute() { }
+    }
+    [System.AttributeUsage(System.AttributeTargets.Class | System.AttributeTargets.Method)]
+    public class BffApiSkipResponseHandlingAttribute : System.Attribute, Duende.Bff.IBffApiSkipResponseHandling
+    {
+        public BffApiSkipResponseHandlingAttribute() { }
+    }
+    public class BffOpenIdConnectEvents : Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectEvents
+    {
+        protected readonly Microsoft.Extensions.Logging.ILogger<Duende.Bff.BffOpenIdConnectEvents> Logger;
+        public BffOpenIdConnectEvents(Microsoft.Extensions.Logging.ILogger<Duende.Bff.BffOpenIdConnectEvents> logger) { }
+        public override System.Threading.Tasks.Task AuthenticationFailed(Microsoft.AspNetCore.Authentication.OpenIdConnect.AuthenticationFailedContext context) { }
+        public override System.Threading.Tasks.Task MessageReceived(Microsoft.AspNetCore.Authentication.OpenIdConnect.MessageReceivedContext context) { }
+        public virtual System.Threading.Tasks.Task<bool> ProcessAuthenticationFailedAsync(Microsoft.AspNetCore.Authentication.OpenIdConnect.AuthenticationFailedContext context) { }
+        public virtual System.Threading.Tasks.Task<bool> ProcessMessageReceivedAsync(Microsoft.AspNetCore.Authentication.OpenIdConnect.MessageReceivedContext context) { }
+        public virtual System.Threading.Tasks.Task<bool> ProcessRedirectToIdentityProviderAsync(Microsoft.AspNetCore.Authentication.OpenIdConnect.RedirectContext context) { }
+        public override System.Threading.Tasks.Task RedirectToIdentityProvider(Microsoft.AspNetCore.Authentication.OpenIdConnect.RedirectContext context) { }
+    }
+    public class BffOptions
+    {
+        public BffOptions() { }
+        public Duende.Bff.AnonymousSessionResponse AnonymousSessionResponse { get; set; }
+        public string AntiForgeryHeaderName { get; set; }
+        public string AntiForgeryHeaderValue { get; set; }
+        public Microsoft.AspNetCore.Http.PathString BackChannelLogoutPath { get; }
+        public bool BackchannelLogoutAllUserSessions { get; set; }
+        public string? DPoPJsonWebKey { get; set; }
+        public System.Collections.Generic.ICollection<string> DiagnosticsEnvironments { get; set; }
+        public Microsoft.AspNetCore.Http.PathString DiagnosticsPath { get; }
+        public bool EnableSessionCleanup { get; set; }
+        public bool EnforceBffMiddleware { get; set; }
+        public string? LicenseKey { get; set; }
+        public Microsoft.AspNetCore.Http.PathString LoginPath { get; }
+        public Microsoft.AspNetCore.Http.PathString LogoutPath { get; }
+        public Microsoft.AspNetCore.Http.PathString ManagementBasePath { get; set; }
+        public bool RemoveSessionAfterRefreshTokenExpiration { get; set; }
+        public bool RequireLogoutSessionId { get; set; }
+        public bool RevokeRefreshTokenOnLogout { get; set; }
+        public System.TimeSpan SessionCleanupInterval { get; set; }
+        public Microsoft.AspNetCore.Http.PathString SilentLoginCallbackPath { get; }
+        public Microsoft.AspNetCore.Http.PathString SilentLoginPath { get; }
+        public Microsoft.AspNetCore.Http.PathString UserPath { get; }
+    }
+    public class BffRemoteApiEndpointMetadata : Duende.Bff.IBffApiEndpoint
+    {
+        public Duende.Bff.TokenType? RequiredTokenType;
+        public BffRemoteApiEndpointMetadata() { }
+        public System.Type AccessTokenRetriever { get; set; }
+        public Duende.Bff.BffUserAccessTokenParameters? BffUserAccessTokenParameters { get; set; }
+        public bool OptionalUserToken { get; set; }
+    }
+    public class BffUserAccessTokenParameters
+    {
+        public BffUserAccessTokenParameters(string? signInScheme = null, string? challengeScheme = null, bool forceRenewal = false, string? resource = null) { }
+        public Duende.AccessTokenManagement.OpenIdConnect.UserTokenRequestParameters ToUserAccessTokenRequestParameters() { }
+    }
+    public class ClaimRecord
+    {
+        public ClaimRecord() { }
+        public ClaimRecord(string type, object value) { }
+        [System.Text.Json.Serialization.JsonPropertyName("type")]
+        public string Type { get; init; }
+        [System.Text.Json.Serialization.JsonPropertyName("valueType")]
+        public string? ValueType { get; init; }
+        [System.Text.Json.Serialization.JsonPropertyName("value")]
+        public object Value { get; init; }
+    }
+    public static class Constants
+    {
+        public static class BffFlags
+        {
+            public const string SilentLogin = "bff-silent-login";
+        }
+        public static class ClaimTypes
+        {
+            public const string LogoutUrl = "bff:logout_url";
+            public const string SessionExpiresIn = "bff:session_expires_in";
+            public const string SessionState = "bff:session_state";
+        }
+        public static class ManagementEndpoints
+        {
+            public const string BackChannelLogout = "/backchannel";
+            public const string Diagnostics = "/diagnostics";
+            public const string Login = "/login";
+            public const string Logout = "/logout";
+            public const string SilentLogin = "/silent-login";
+            public const string SilentLoginCallback = "/silent-login-callback";
+            public const string User = "/user";
+        }
+        public static class RequestParameters
+        {
+            public const string ReturnUrl = "returnUrl";
+            public const string SlideCookie = "slide";
+        }
+        public static class Yarp
+        {
+            public const string AntiforgeryCheckMetadata = "Duende.Bff.Yarp.AntiforgeryCheck";
+            public const string OptionalUserTokenMetadata = "Duende.Bff.Yarp.OptionalUserToken";
+            public const string TokenTypeMetadata = "Duende.Bff.Yarp.TokenType";
+        }
+    }
+    public class DPoPTokenResult : Duende.Bff.AccessTokenResult
+    {
+        public DPoPTokenResult(string accessToken, string dpopJWK) { }
+        public string AccessToken { get; set; }
+        public string DPoPJsonWebKey { get; set; }
+    }
+    public class DefaultAccessTokenRetriever : Duende.Bff.IAccessTokenRetriever
+    {
+        protected readonly Microsoft.Extensions.Logging.ILogger<Duende.Bff.DefaultAccessTokenRetriever> Logger;
+        public DefaultAccessTokenRetriever(Microsoft.Extensions.Logging.ILogger<Duende.Bff.DefaultAccessTokenRetriever> logger) { }
+        public virtual System.Threading.Tasks.Task<Duende.Bff.AccessTokenResult> GetAccessToken(Duende.Bff.AccessTokenRetrievalContext context) { }
+    }
+    public class DefaultBackchannelLogoutService : Duende.Bff.IBackchannelLogoutService, Duende.Bff.IBffEndpointService
+    {
+        protected readonly Microsoft.AspNetCore.Authentication.IAuthenticationSchemeProvider AuthenticationSchemeProvider;
+        protected readonly Microsoft.Extensions.Logging.ILogger<Duende.Bff.DefaultBackchannelLogoutService> Logger;
+        protected readonly Microsoft.Extensions.Options.IOptionsMonitor<Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectOptions> OptionsMonitor;
+        protected readonly Duende.Bff.ISessionRevocationService UserSession;
+        public DefaultBackchannelLogoutService(Microsoft.AspNetCore.Authentication.IAuthenticationSchemeProvider authenticationSchemeProvider, Microsoft.Extensions.Options.IOptionsMonitor<Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectOptions> optionsMonitor, Duende.Bff.ISessionRevocationService userSession, Microsoft.Extensions.Logging.ILogger<Duende.Bff.DefaultBackchannelLogoutService> logger) { }
+        protected virtual System.Threading.Tasks.Task<Microsoft.IdentityModel.Tokens.TokenValidationParameters> GetTokenValidationParameters() { }
+        public virtual System.Threading.Tasks.Task ProcessRequestAsync(Microsoft.AspNetCore.Http.HttpContext context) { }
+        protected virtual System.Threading.Tasks.Task<System.Security.Claims.ClaimsIdentity?> ValidateJwt(string jwt) { }
+        protected virtual System.Threading.Tasks.Task<System.Security.Claims.ClaimsIdentity?> ValidateLogoutTokenAsync(string logoutToken) { }
+    }
+    public class DefaultDiagnosticsService : Duende.Bff.IBffEndpointService, Duende.Bff.IDiagnosticsService
+    {
+        protected readonly Microsoft.AspNetCore.Hosting.IWebHostEnvironment Environment;
+        protected readonly Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> Options;
+        public DefaultDiagnosticsService(Microsoft.AspNetCore.Hosting.IWebHostEnvironment environment, Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options) { }
+        public virtual System.Threading.Tasks.Task ProcessRequestAsync(Microsoft.AspNetCore.Http.HttpContext context) { }
+    }
+    public class DefaultLoginService : Duende.Bff.IBffEndpointService, Duende.Bff.ILoginService
+    {
+        protected readonly Microsoft.Extensions.Logging.ILogger Logger;
+        protected readonly Duende.Bff.BffOptions Options;
+        protected readonly Duende.Bff.IReturnUrlValidator ReturnUrlValidator;
+        public DefaultLoginService(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Duende.Bff.IReturnUrlValidator returnUrlValidator, Microsoft.Extensions.Logging.ILogger<Duende.Bff.DefaultLoginService> logger) { }
+        public virtual System.Threading.Tasks.Task ProcessRequestAsync(Microsoft.AspNetCore.Http.HttpContext context) { }
+    }
+    public class DefaultLogoutService : Duende.Bff.IBffEndpointService, Duende.Bff.ILogoutService
+    {
+        protected readonly Microsoft.AspNetCore.Authentication.IAuthenticationSchemeProvider AuthenticationSchemeProvider;
+        protected readonly Microsoft.Extensions.Logging.ILogger Logger;
+        protected readonly Duende.Bff.BffOptions Options;
+        protected readonly Duende.Bff.IReturnUrlValidator ReturnUrlValidator;
+        public DefaultLogoutService(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Microsoft.AspNetCore.Authentication.IAuthenticationSchemeProvider authenticationAuthenticationSchemeProviderProvider, Duende.Bff.IReturnUrlValidator returnUrlValidator, Microsoft.Extensions.Logging.ILogger<Duende.Bff.DefaultLogoutService> logger) { }
+        public virtual System.Threading.Tasks.Task ProcessRequestAsync(Microsoft.AspNetCore.Http.HttpContext context) { }
+    }
+    public class DefaultSilentLoginCallbackService : Duende.Bff.IBffEndpointService, Duende.Bff.ISilentLoginCallbackService
+    {
+        protected readonly Microsoft.Extensions.Logging.ILogger Logger;
+        protected readonly Duende.Bff.BffOptions Options;
+        public DefaultSilentLoginCallbackService(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Microsoft.Extensions.Logging.ILogger<Duende.Bff.DefaultSilentLoginCallbackService> logger) { }
+        public virtual System.Threading.Tasks.Task ProcessRequestAsync(Microsoft.AspNetCore.Http.HttpContext context) { }
+    }
+    public class DefaultSilentLoginService : Duende.Bff.IBffEndpointService, Duende.Bff.ISilentLoginService
+    {
+        protected readonly Microsoft.Extensions.Logging.ILogger Logger;
+        protected readonly Duende.Bff.BffOptions Options;
+        public DefaultSilentLoginService(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Microsoft.Extensions.Logging.ILogger<Duende.Bff.DefaultSilentLoginService> logger) { }
+        public virtual System.Threading.Tasks.Task ProcessRequestAsync(Microsoft.AspNetCore.Http.HttpContext context) { }
+    }
+    public class DefaultUserService : Duende.Bff.IBffEndpointService, Duende.Bff.IUserService
+    {
+        protected readonly Microsoft.Extensions.Logging.ILogger Logger;
+        protected readonly Duende.Bff.BffOptions Options;
+        public DefaultUserService(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Microsoft.Extensions.Logging.ILoggerFactory loggerFactory) { }
+        protected virtual System.Threading.Tasks.Task<System.Collections.Generic.IEnumerable<Duende.Bff.ClaimRecord>> GetManagementClaimsAsync(Microsoft.AspNetCore.Http.HttpContext context, Microsoft.AspNetCore.Authentication.AuthenticateResult authenticateResult) { }
+        protected virtual System.Threading.Tasks.Task<System.Collections.Generic.IEnumerable<Duende.Bff.ClaimRecord>> GetUserClaimsAsync(Microsoft.AspNetCore.Authentication.AuthenticateResult authenticateResult) { }
+        public virtual System.Threading.Tasks.Task ProcessRequestAsync(Microsoft.AspNetCore.Http.HttpContext context) { }
+    }
+    public interface IAccessTokenRetriever
+    {
+        System.Threading.Tasks.Task<Duende.Bff.AccessTokenResult> GetAccessToken(Duende.Bff.AccessTokenRetrievalContext context);
+    }
+    public interface IBackchannelLogoutService : Duende.Bff.IBffEndpointService { }
+    public interface IBffApiEndpoint { }
+    public interface IBffApiSkipAntiforgery { }
+    public interface IBffApiSkipResponseHandling { }
+    public interface IBffEndpointService
+    {
+        System.Threading.Tasks.Task ProcessRequestAsync(Microsoft.AspNetCore.Http.HttpContext context);
+    }
+    public interface IDiagnosticsService : Duende.Bff.IBffEndpointService { }
+    public interface ILoginService : Duende.Bff.IBffEndpointService { }
+    public interface ILogoutService : Duende.Bff.IBffEndpointService { }
+    public interface IReturnUrlValidator
+    {
+        System.Threading.Tasks.Task<bool> IsValidAsync(string returnUrl);
+    }
+    public interface IServerTicketStore : Microsoft.AspNetCore.Authentication.Cookies.ITicketStore
+    {
+        System.Threading.Tasks.Task<System.Collections.Generic.IReadOnlyCollection<Microsoft.AspNetCore.Authentication.AuthenticationTicket>> GetUserTicketsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken = default);
+    }
+    public interface ISessionRevocationService
+    {
+        System.Threading.Tasks.Task RevokeSessionsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken = default);
+    }
+    public interface ISilentLoginCallbackService : Duende.Bff.IBffEndpointService { }
+    public interface ISilentLoginService : Duende.Bff.IBffEndpointService { }
+    public interface IUserService : Duende.Bff.IBffEndpointService { }
+    public interface IUserSessionStore
+    {
+        System.Threading.Tasks.Task CreateUserSessionAsync(Duende.Bff.UserSession session, System.Threading.CancellationToken cancellationToken = default);
+        System.Threading.Tasks.Task DeleteUserSessionAsync(string key, System.Threading.CancellationToken cancellationToken = default);
+        System.Threading.Tasks.Task DeleteUserSessionsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken = default);
+        System.Threading.Tasks.Task<Duende.Bff.UserSession?> GetUserSessionAsync(string key, System.Threading.CancellationToken cancellationToken = default);
+        System.Threading.Tasks.Task<System.Collections.Generic.IReadOnlyCollection<Duende.Bff.UserSession>> GetUserSessionsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken = default);
+        System.Threading.Tasks.Task UpdateUserSessionAsync(string key, Duende.Bff.UserSessionUpdate session, System.Threading.CancellationToken cancellationToken = default);
+    }
+    public interface IUserSessionStoreCleanup
+    {
+        System.Threading.Tasks.Task DeleteExpiredSessionsAsync(System.Threading.CancellationToken cancellationToken = default);
+    }
+    public class InMemoryUserSessionStore : Duende.Bff.IUserSessionStore
+    {
+        public InMemoryUserSessionStore() { }
+        public System.Threading.Tasks.Task CreateUserSessionAsync(Duende.Bff.UserSession session, System.Threading.CancellationToken cancellationToken = default) { }
+        public System.Threading.Tasks.Task DeleteUserSessionAsync(string key, System.Threading.CancellationToken cancellationToken = default) { }
+        public System.Threading.Tasks.Task DeleteUserSessionsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken = default) { }
+        public System.Threading.Tasks.Task<Duende.Bff.UserSession?> GetUserSessionAsync(string key, System.Threading.CancellationToken cancellationToken = default) { }
+        public System.Threading.Tasks.Task<System.Collections.Generic.IReadOnlyCollection<Duende.Bff.UserSession>> GetUserSessionsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken = default) { }
+        public System.Threading.Tasks.Task UpdateUserSessionAsync(string key, Duende.Bff.UserSessionUpdate session, System.Threading.CancellationToken cancellationToken = default) { }
+    }
+    public class MissingDPopTokenError : Duende.Bff.AccessTokenRetrievalError
+    {
+        public MissingDPopTokenError(string error) { }
+    }
+    public class NoAccessTokenResult : Duende.Bff.AccessTokenResult
+    {
+        public NoAccessTokenResult() { }
+    }
+    public class NoAccessTokenReturnedError : Duende.Bff.AccessTokenRetrievalError
+    {
+        public NoAccessTokenReturnedError(string error) { }
+    }
+    public class NopSessionRevocationService : Duende.Bff.ISessionRevocationService
+    {
+        public NopSessionRevocationService(Microsoft.Extensions.Logging.ILogger<Duende.Bff.NopSessionRevocationService> logger) { }
+        public System.Threading.Tasks.Task RevokeSessionsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken = default) { }
+    }
+    public class PostConfigureApplicationCookieRevokeRefreshToken : Microsoft.Extensions.Options.IPostConfigureOptions<Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions>
+    {
+        public PostConfigureApplicationCookieRevokeRefreshToken(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> bffOptions, Microsoft.Extensions.Options.IOptions<Microsoft.AspNetCore.Authentication.AuthenticationOptions> authOptions, Microsoft.Extensions.Logging.ILogger<Duende.Bff.PostConfigureApplicationCookieRevokeRefreshToken> logger) { }
+        public void PostConfigure(string? name, Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions options) { }
+    }
+    public class PostConfigureApplicationCookieTicketStore : Microsoft.Extensions.Options.IPostConfigureOptions<Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions>
+    {
+        public PostConfigureApplicationCookieTicketStore(Microsoft.AspNetCore.Http.IHttpContextAccessor httpContextAccessor, Microsoft.Extensions.Options.IOptions<Microsoft.AspNetCore.Authentication.AuthenticationOptions> options) { }
+        public void PostConfigure(string? name, Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions options) { }
+    }
+    public class PostConfigureApplicationValidatePrincipal : Microsoft.Extensions.Options.IPostConfigureOptions<Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions>
+    {
+        public PostConfigureApplicationValidatePrincipal(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> bffOptions, Microsoft.Extensions.Options.IOptions<Microsoft.AspNetCore.Authentication.AuthenticationOptions> authOptions, Microsoft.Extensions.Logging.ILogger<Duende.Bff.PostConfigureApplicationValidatePrincipal> logger) { }
+        public void PostConfigure(string? name, Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions options) { }
+    }
+    public class PostConfigureOidcOptionsForSilentLogin : Microsoft.Extensions.Options.IPostConfigureOptions<Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectOptions>
+    {
+        public PostConfigureOidcOptionsForSilentLogin(Microsoft.Extensions.Options.IOptions<Microsoft.AspNetCore.Authentication.AuthenticationOptions> options, Microsoft.Extensions.Logging.ILoggerFactory logger) { }
+        public void PostConfigure(string? name, Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectOptions options) { }
+    }
+    public class PostConfigureSlidingExpirationCheck : Microsoft.Extensions.Options.IPostConfigureOptions<Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions>
+    {
+        public PostConfigureSlidingExpirationCheck(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> bffOptions, Microsoft.Extensions.Options.IOptions<Microsoft.AspNetCore.Authentication.AuthenticationOptions> authOptions, Microsoft.Extensions.Logging.ILogger<Duende.Bff.PostConfigureSlidingExpirationCheck> logger) { }
+        public void PostConfigure(string? name, Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationOptions options) { }
+    }
+    public class ServerSideTicketStore : Duende.Bff.IServerTicketStore, Microsoft.AspNetCore.Authentication.Cookies.ITicketStore
+    {
+        public static string DataProtectorPurpose;
+        public ServerSideTicketStore(Duende.Bff.IUserSessionStore store, Microsoft.AspNetCore.DataProtection.IDataProtectionProvider dataProtectionProvider, Microsoft.Extensions.Logging.ILogger<Duende.Bff.ServerSideTicketStore> logger) { }
+        public System.Threading.Tasks.Task<System.Collections.Generic.IReadOnlyCollection<Microsoft.AspNetCore.Authentication.AuthenticationTicket>> GetUserTicketsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken) { }
+        public System.Threading.Tasks.Task RemoveAsync(string key) { }
+        public System.Threading.Tasks.Task RenewAsync(string key, Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket) { }
+        public System.Threading.Tasks.Task<Microsoft.AspNetCore.Authentication.AuthenticationTicket> RetrieveAsync(string key) { }
+        public System.Threading.Tasks.Task<string> StoreAsync(Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket) { }
+    }
+    public class SessionCleanupHost : Microsoft.Extensions.Hosting.IHostedService
+    {
+        public SessionCleanupHost(System.IServiceProvider serviceProvider, Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Microsoft.Extensions.Logging.ILogger<Duende.Bff.SessionCleanupHost> logger) { }
+        public System.Threading.Tasks.Task StartAsync(System.Threading.CancellationToken cancellationToken) { }
+        public System.Threading.Tasks.Task StopAsync(System.Threading.CancellationToken cancellationToken) { }
+    }
+    public class SessionRevocationService : Duende.Bff.ISessionRevocationService
+    {
+        public SessionRevocationService(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Duende.Bff.IServerTicketStore ticketStore, Duende.Bff.IUserSessionStore sessionStore, Duende.AccessTokenManagement.OpenIdConnect.IUserTokenEndpointService tokenEndpoint, Microsoft.Extensions.Logging.ILogger<Duende.Bff.SessionRevocationService> logger) { }
+        public System.Threading.Tasks.Task RevokeSessionsAsync(Duende.Bff.UserSessionsFilter filter, System.Threading.CancellationToken cancellationToken = default) { }
+    }
+    public class TicketStoreShim : Microsoft.AspNetCore.Authentication.Cookies.ITicketStore
+    {
+        public TicketStoreShim(Microsoft.AspNetCore.Http.IHttpContextAccessor httpContextAccessor) { }
+        public System.Threading.Tasks.Task RemoveAsync(string key) { }
+        public System.Threading.Tasks.Task RenewAsync(string key, Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket) { }
+        public System.Threading.Tasks.Task<Microsoft.AspNetCore.Authentication.AuthenticationTicket> RetrieveAsync(string key) { }
+        public System.Threading.Tasks.Task<string> StoreAsync(Microsoft.AspNetCore.Authentication.AuthenticationTicket ticket) { }
+    }
+    public enum TokenType
+    {
+        User = 0,
+        Client = 1,
+        UserOrClient = 2,
+    }
+    public class UnexpectedAccessTokenError : Duende.Bff.AccessTokenRetrievalError
+    {
+        public UnexpectedAccessTokenError(string error) { }
+    }
+    public class UserSession : Duende.Bff.UserSessionUpdate
+    {
+        public UserSession() { }
+        public string Key { get; set; }
+        public Duende.Bff.UserSession Clone() { }
+        public void CopyTo(Duende.Bff.UserSession other) { }
+    }
+    public class UserSessionUpdate
+    {
+        public UserSessionUpdate() { }
+        public System.DateTime Created { get; set; }
+        public System.DateTime? Expires { get; set; }
+        public System.DateTime Renewed { get; set; }
+        public string? SessionId { get; set; }
+        public string SubjectId { get; set; }
+        public string Ticket { get; set; }
+        public void CopyTo(Duende.Bff.UserSessionUpdate other) { }
+    }
+    public class UserSessionsFilter
+    {
+        public UserSessionsFilter() { }
+        public string? SessionId { get; set; }
+        public string? SubjectId { get; init; }
+        public void Validate() { }
+    }
+}
+namespace Duende.Bff.Endpoints
+{
+    public class BffMiddleware
+    {
+        public BffMiddleware(Microsoft.AspNetCore.Http.RequestDelegate next, Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Microsoft.Extensions.Logging.ILogger<Duende.Bff.Endpoints.BffMiddleware> logger) { }
+        public System.Threading.Tasks.Task Invoke(Microsoft.AspNetCore.Http.HttpContext context) { }
+    }
+}
\ No newline at end of file
diff --git a/bff/test/Bff.Tests/PublicApiVerificationTests.VerifyPublicApi_Bff_Yarp.verified.txt b/bff/test/Bff.Tests/PublicApiVerificationTests.VerifyPublicApi_Bff_Yarp.verified.txt
new file mode 100644
index 000000000..219866e92
--- /dev/null
+++ b/bff/test/Bff.Tests/PublicApiVerificationTests.VerifyPublicApi_Bff_Yarp.verified.txt
@@ -0,0 +1,58 @@
+namespace Duende.Bff
+{
+    public sealed class ActivityPropagationHandler : System.Net.Http.DelegatingHandler
+    {
+        public ActivityPropagationHandler(System.Net.Http.HttpMessageHandler innerHandler) { }
+        protected override System.Threading.Tasks.Task<System.Net.Http.HttpResponseMessage> SendAsync(System.Net.Http.HttpRequestMessage request, System.Threading.CancellationToken cancellationToken) { }
+    }
+}
+namespace Duende.Bff.Yarp
+{
+    public class AccessTokenRequestTransform : Yarp.ReverseProxy.Transforms.RequestTransform
+    {
+        public AccessTokenRequestTransform(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Duende.AccessTokenManagement.IDPoPProofService proofService, Microsoft.Extensions.Logging.ILogger<Duende.Bff.Yarp.AccessTokenRequestTransform> logger) { }
+        public override System.Threading.Tasks.ValueTask ApplyAsync(Yarp.ReverseProxy.Transforms.RequestTransformContext context) { }
+    }
+    public class AccessTokenTransformProvider : Yarp.ReverseProxy.Transforms.Builder.ITransformProvider
+    {
+        public AccessTokenTransformProvider(Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Microsoft.Extensions.Logging.ILogger<Duende.Bff.Yarp.AccessTokenTransformProvider> logger, Microsoft.Extensions.Logging.ILoggerFactory loggerFactory, Duende.AccessTokenManagement.IDPoPProofService dPoPProofService) { }
+        public void Apply(Yarp.ReverseProxy.Transforms.Builder.TransformBuilderContext transformBuildContext) { }
+        public void ValidateCluster(Yarp.ReverseProxy.Transforms.Builder.TransformClusterValidationContext context) { }
+        public void ValidateRoute(Yarp.ReverseProxy.Transforms.Builder.TransformRouteValidationContext context) { }
+    }
+    public class AntiforgeryMiddleware
+    {
+        public AntiforgeryMiddleware(Microsoft.AspNetCore.Http.RequestDelegate next, Microsoft.Extensions.Options.IOptions<Duende.Bff.BffOptions> options, Microsoft.Extensions.Logging.ILogger<Duende.Bff.Yarp.AntiforgeryMiddleware> logger) { }
+        public System.Threading.Tasks.Task Invoke(Microsoft.AspNetCore.Http.HttpContext context) { }
+    }
+    public static class BffBuilderExtensions
+    {
+        public static Microsoft.AspNetCore.Builder.BffBuilder AddRemoteApis(this Microsoft.AspNetCore.Builder.BffBuilder builder) { }
+    }
+    public delegate void BffYarpTransformBuilder(string localPath, Yarp.ReverseProxy.Transforms.Builder.TransformBuilderContext context);
+    public static class DefaultBffYarpTransformerBuilders
+    {
+        public static Duende.Bff.Yarp.BffYarpTransformBuilder DirectProxyWithAccessToken;
+    }
+    public static class ProxyAppBuilderExtensions
+    {
+        public static Microsoft.AspNetCore.Builder.IApplicationBuilder UseAntiforgeryCheck(this Microsoft.AspNetCore.Builder.IApplicationBuilder yarpApp) { }
+    }
+    public static class ProxyConfigExtensions
+    {
+        public static Yarp.ReverseProxy.Configuration.ClusterConfig WithAccessToken(this Yarp.ReverseProxy.Configuration.ClusterConfig config, Duende.Bff.TokenType tokenType) { }
+        public static Yarp.ReverseProxy.Configuration.RouteConfig WithAccessToken(this Yarp.ReverseProxy.Configuration.RouteConfig config, Duende.Bff.TokenType tokenType) { }
+        public static Yarp.ReverseProxy.Configuration.RouteConfig WithAntiforgeryCheck(this Yarp.ReverseProxy.Configuration.RouteConfig config) { }
+        public static Yarp.ReverseProxy.Configuration.RouteConfig WithOptionalUserAccessToken(this Yarp.ReverseProxy.Configuration.RouteConfig config) { }
+    }
+    public static class ReverseProxyBuilderExtensions
+    {
+        public static Microsoft.Extensions.DependencyInjection.IReverseProxyBuilder AddBffExtensions(this Microsoft.Extensions.DependencyInjection.IReverseProxyBuilder builder) { }
+    }
+    public static class ReverseProxyEndpointConventionBuilderExtensions
+    {
+        public static Microsoft.AspNetCore.Builder.ReverseProxyConventionBuilder AsBffApiEndpoint(this Microsoft.AspNetCore.Builder.ReverseProxyConventionBuilder builder) { }
+        public static Microsoft.AspNetCore.Builder.ReverseProxyConventionBuilder MapBffReverseProxy(this Microsoft.AspNetCore.Routing.IEndpointRouteBuilder endpoints) { }
+        public static Microsoft.AspNetCore.Builder.ReverseProxyConventionBuilder MapBffReverseProxy(this Microsoft.AspNetCore.Routing.IEndpointRouteBuilder endpoints, System.Action<Microsoft.AspNetCore.Builder.IReverseProxyApplicationBuilder> configureAction) { }
+    }
+}
\ No newline at end of file
diff --git a/bff/test/Bff.Tests/PublicApiVerificationTests.cs b/bff/test/Bff.Tests/PublicApiVerificationTests.cs
new file mode 100644
index 000000000..cdddd45c7
--- /dev/null
+++ b/bff/test/Bff.Tests/PublicApiVerificationTests.cs
@@ -0,0 +1,74 @@
+// Copyright (c) Duende Software. All rights reserved.
+// See LICENSE in the project root for license information.
+
+using Duende.Bff.Yarp;
+using Microsoft.AspNetCore.Builder;
+using PublicApiGenerator;
+
+namespace Bff.Tests;
+
+public class PublicApiVerificationTests
+{
+
+    [Fact]
+    public async Task VerifyPublicApi_Bff()
+    {
+        var apiGeneratorOptions = new ApiGeneratorOptions
+        {
+            IncludeAssemblyAttributes = false
+        };
+        var publicApi = typeof(BffBuilder).Assembly.GeneratePublicApi(apiGeneratorOptions);
+        var settings = new VerifySettings();
+        await Verify(publicApi, settings);
+    }
+
+    [Fact]
+    public async Task VerifyPublicApi_Bff_Yarp()
+    {
+        var apiGeneratorOptions = new ApiGeneratorOptions
+        {
+            IncludeAssemblyAttributes = false
+        };
+        var publicApi = typeof(AccessTokenRequestTransform).Assembly.GeneratePublicApi(apiGeneratorOptions);
+        var settings = new VerifySettings();
+        await Verify(publicApi, settings);
+    }
+}
+//    [Fact]
+//    public async Task VerifyPublicApi_Bff_EntityFramework()
+//    {
+//        var apiGeneratorOptions = new ApiGeneratorOptions
+//        {
+//            IncludeAssemblyAttributes = false
+//        };
+//        var publicApi = typeof(ISessionDbContext).Assembly.GeneratePublicApi(apiGeneratorOptions);
+//        var settings = new VerifySettings();
+//        await Verify(publicApi, settings);
+//    }
+
+//    [Fact]
+//    public async Task VerifyPublicApi_Bff_Blazor()
+//    {
+//        var apiGeneratorOptions = new ApiGeneratorOptions
+//        {
+//            IncludeAssemblyAttributes = false
+//        };
+//        var publicApi = typeof(BffBlazorServerOptions).Assembly.GeneratePublicApi(apiGeneratorOptions);
+//        var settings = new VerifySettings();
+//        await Verify(publicApi, settings);
+//    }
+
+
+//    [Fact]
+//    public async Task VerifyPublicApi_Bff_Blazor_Client()
+//    {
+//        var apiGeneratorOptions = new ApiGeneratorOptions
+//        {
+//            IncludeAssemblyAttributes = false
+//        };
+//        var publicApi = typeof(AntiForgeryHandler).Assembly.GeneratePublicApi(apiGeneratorOptions);
+//        var settings = new VerifySettings();
+//        await Verify(publicApi, settings);
+//    }
+
+//}