Agent Wranglers

Standard addresses Optional

List the sites that share passkeys

If you accept passkeys across several of your domains, list the related origins in /.well-known/webauthn.

By Erik Bergstedt, Agent Wranglers. Updated .

How to do it

Serve a JSON file with an origins list, as WebAuthn Level 3 Related Origin Requests sets out. Serve it on the host that is your relying party ID, as application/json. Browsers only promise to accept five distinct site names in the list, so keep it short.

Example

{
  "origins": [
    "https://example.com",
    "https://shop.example.com"
  ]
}

How to check

curl -sI https://example.com/.well-known/webauthn returns 200 as application/json. A passkey made on one listed origin signs in on another.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/standard-addresses/webauthn.