---
title: "Standard addresses · Agent Wranglers"
url: https://agentwranglers.se/playbook/website/standard-addresses
updated: 2026-10-20
licence: "All rights reserved"
---

# Standard addresses

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

> Fixed addresses under /.well-known/ that browsers, password managers, privacy tools and agents look for, and which ones a small site needs.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/standard-addresses`.

## Recommended

- [Serve standard files at fixed addresses](https://agentwranglers.se/playbook/website/standard-addresses/well-known-overview): Serve files under `/.well-known/` at their exact paths, with the right content types and no sign-in. Open them to other sites where they are meant for agents.
- [List your APIs in one file](https://agentwranglers.se/playbook/website/standard-addresses/api-catalog): List your public APIs and machine-readable files at `/.well-known/api-catalog`, as an RFC 9727 linkset (a JSON list of links).
- [Require encrypted mail delivery](https://agentwranglers.se/playbook/website/standard-addresses/mta-sts): If the domain receives email, publish an MTA-STS policy, so other mail servers deliver to it only over checked TLS.

## Optional

- [Point to the change-password page](https://agentwranglers.se/playbook/website/standard-addresses/change-password): If people have accounts, redirect `/.well-known/change-password` to the page where they change their password.
- [List the sites that share passkeys](https://agentwranglers.se/playbook/website/standard-addresses/webauthn): If you accept passkeys across several of your domains, list the related origins in `/.well-known/webauthn`.
- [Point to the passkey pages](https://agentwranglers.se/playbook/website/standard-addresses/passkey-endpoints): If people can sign in with passkeys, publish `/.well-known/passkey-endpoints` with the pages where they add and manage them.
- [Publish identity provider settings](https://agentwranglers.se/playbook/website/standard-addresses/openid-configuration): If you are an OpenID identity provider, publish discovery data at `/.well-known/openid-configuration`.
- [Publish OAuth server settings](https://agentwranglers.se/playbook/website/standard-addresses/oauth-authorization-server): If you run an OAuth authorisation server, publish its details at `/.well-known/oauth-authorization-server`.
- [Explain how to get API access](https://agentwranglers.se/playbook/website/standard-addresses/oauth-protected-resource): If an API needs OAuth, describe how to get access at `/.well-known/oauth-protected-resource`.
- [Say you honour privacy signals](https://agentwranglers.se/playbook/website/standard-addresses/gpc-json): If you honour Global Privacy Control, a browser signal that means "don't sell or share my data", say so in `/.well-known/gpc.json`.
- [Answer account lookups](https://agentwranglers.se/playbook/website/standard-addresses/webfinger): If you have accounts that others look up, answer `/.well-known/webfinger` queries.
- [Open links in your iOS app](https://agentwranglers.se/playbook/website/standard-addresses/apple-app-site-association): If you have an iOS app, publish `/.well-known/apple-app-site-association` so links open in it.
- [Open links in your Android app](https://agentwranglers.se/playbook/website/standard-addresses/assetlinks-json): If you have an Android app, publish `/.well-known/assetlinks.json` so links open in it.
- [Describe a federated server](https://agentwranglers.se/playbook/website/standard-addresses/nodeinfo): If you run a federated server, such as a Mastodon-style social server, publish `/.well-known/nodeinfo`.
- [Limit prefetch proxies only if needed](https://agentwranglers.se/playbook/website/standard-addresses/traffic-advice): Publish `/.well-known/traffic-advice` only to limit private prefetch proxies, which load pages early for privacy browsers. Leaving it out welcomes them.

- Previous: [Hosting and network](https://agentwranglers.se/playbook/website/hosting-and-network)
- Next: [Ready for AI agents](https://agentwranglers.se/playbook/website/ready-for-ai-agents)
- [All chapters](https://agentwranglers.se/playbook/website)