Standard addresses Optional

Point to the passkey pages

If people can sign in with passkeys, publish /.well-known/passkey-endpoints with the pages where they add and manage them.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

Serve JSON with enroll (the page that creates a passkey) and manage (the page that lists them), as application/json. Serve it on the host that is your relying party ID. Password managers use it to offer a passkey upgrade. It is a W3C Working Draft, so check the latest version.

Example

{
  "enroll": "https://example.com/account/passkeys/new",
  "manage": "https://example.com/account/passkeys"
}

How to check

curl -s https://example.com/.well-known/passkey-endpoints returns JSON, and both URLs in it answer 200 after sign-in.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/standard-addresses/passkey-endpoints.