Well-Known URIs

Standard, agreed-upon paths under /.well-known/.

• Recommended Well-known URIs — The /.well-known/ path prefix is a standardised place to publish site-level metadata. RFC 8615 defines it; IANA keeps the registry of allowed names.
• Optional /.well-known/change-password — A standard redirect endpoint that points password managers and users at your real change-password page. Only applicable if the site has user accounts — sites without logins have nothing to point at and should not implement it.
• Optional /.well-known/openid-configuration — A JSON discovery document that describes an OpenID Connect provider's endpoints and capabilities. Only required if you are an OIDC identity provider.
• Recommended /.well-known/api-catalog — RFC 9727 publishes a machine-readable index of the APIs and resources a host exposes. Served as a Linkset (RFC 9264) JSON document, discoverable via the api-catalog link relation.
• Optional /.well-known/webfinger — WebFinger (RFC 7033) resolves an account identifier such as acct:user@example.com to a set of links. The Fediverse uses it to discover ActivityPub actors.
• Optional /.well-known/apple-app-site-association — A JSON file that tells iOS, iPadOS and macOS which Apple apps may handle which URLs on your domain. Required for Universal Links and several other Apple features.
• Optional /.well-known/assetlinks.json — Android's Digital Asset Links file proves that an Android app and a web domain are owned by the same entity. It powers App Links and Smart Lock for Passwords.
• Optional /.well-known/nodeinfo — A discovery URI for federated platforms. It returns links to NodeInfo documents that describe the software, version and basic statistics of a server.