---
title: "List the sites that share passkeys · Agent Wranglers"
url: https://agentwranglers.se/playbook/website/standard-addresses/webauthn
updated: 2026-10-20
licence: "All rights reserved"
---

# List the sites that share passkeys

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Optional
- Chapter: [Standard addresses](https://agentwranglers.se/playbook/website/standard-addresses)
- Rule: If you accept passkeys across several of your domains, list the related origins in `/.well-known/webauthn`.
- How: Serve a JSON file with an `origins` list, as WebAuthn Level 3 Related Origin Requests sets out. Serve it on the host that is your relying party ID, as `application/json`. Browsers only promise to accept five distinct site names in the list, so keep it short.
- Check: `curl -sI https://example.com/.well-known/webauthn` returns 200 as `application/json`. A passkey made on one listed origin signs in on another.

Example:

```json
{
  "origins": [
    "https://example.com",
    "https://shop.example.com"
  ]
}
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/standard-addresses/webauthn`.

- Previous: [Point to the change-password page](https://agentwranglers.se/playbook/website/standard-addresses/change-password)
- Next: [Point to the passkey pages](https://agentwranglers.se/playbook/website/standard-addresses/passkey-endpoints)
- [Standard addresses](https://agentwranglers.se/playbook/website/standard-addresses)