FAQ

What is /.well-known/webauthn?

A JSON allowlist of origins permitted to use your RP ID for Related Origin Requests (passkey reuse across your domains).

What is /.well-known/passkey-endpoints?

A separate well-known document (W3C draft) advertising enroll/manage URLs so password managers can deep-link into your passkey flows. It does not replace related origins.

Who should ship first — related-origins or passkey-endpoints?

Ship related origins first when the immediate need is cross-origin RP ID reuse. Add passkey-endpoints when you have real enroll/manage URLs that return 200. Endpoints without working pages create broken deep links. Many production setups eventually host both on the same RP ID domain; progressive rollout is fine if you do not advertise dead URLs. See the progressive use case.

Can http://localhost appear in related origins?

Local development often uses http://localhost or loopback with WebAuthn under special browser rules, but production related-origins lists are https origins on your real brands. Do not paste localhost into a production well-known document you deploy to customers. Keep a separate local RP / override for engineering machines; regenerate a production pack without localhost before go-live.

Does a label-count warning mean the browser hard-rejects?

Not necessarily. This tool warns when distinct registrable labels exceed the common ≤5 budget browsers process for related origins. It is not a full Public Suffix List implementation and not a guarantee of acceptance or rejection. Treat the warning as a planning signal: trim low-value origins or split RP IDs rather than ignoring an over-budget list.

Why a dual pack?

Teams often need both files on the same RP ID domain. Generating them together reduces mismatched RP IDs and forgotten Content-Type rules for extensionless paths.

Is this a replacement for passkeys.dev?

No. passkeys.dev documents ROR and offers a validator. This site focuses on generating a deployable dual file pack plus a Pages headers recipe. After deploy, you can still paste JSON into the validator if you want a second opinion.

Do you upload my domains?

No. Generation is local. See Privacy.