---
title: "Serve standard files at fixed addresses · Agent Wranglers"
url: https://agentwranglers.se/playbook/website/standard-addresses/well-known-overview
updated: 2026-10-20
licence: "All rights reserved"
---

# Serve standard files at fixed addresses

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Recommended
- Chapter: [Standard addresses](https://agentwranglers.se/playbook/website/standard-addresses)
- Rule: Serve files under `/.well-known/` at their exact paths, with the right content types and no sign-in. Open them to other sites where they are meant for agents.
- How: Serve each file at its exact registered path, with its content type and no redirect to a sign-in page. Add `Access-Control-Allow-Origin: *` (CORS, which lets other sites read it) on files meant for agents and other sites. Answer 404 for every name you do not publish. Never fall back to the home page, as single-page apps often do, because clients then read HTML as data. IANA keeps the list of registered names. `security.txt` is covered in the [security chapter](https://agentwranglers.se/playbook/website/security/security-txt).
- Check: Fetch each file without cookies. Each returns 200 with the right type, and CORS where intended. A made-up name such as `/.well-known/no-such-file` returns 404.

Example:

```nginx
location ^~ /.well-known/ {
  add_header Access-Control-Allow-Origin "*" always;
}
location = /.well-known/api-catalog {
  default_type application/linkset+json;
  add_header Access-Control-Allow-Origin "*" always;
}
```

```sh
curl -sI https://example.com/.well-known/api-catalog
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/standard-addresses/well-known-overview`.

- Next: [Point to the change-password page](https://agentwranglers.se/playbook/website/standard-addresses/change-password)
- [Standard addresses](https://agentwranglers.se/playbook/website/standard-addresses)