How to deploy the dual well-known pack

1. Choose one RP ID

Pick a single relying party ID (usually your primary domain, e.g. example.com). Both files must be hosted on that domain.

2. Generate both JSON files

Use the generator. Download webauthn and passkey-endpoints (no .json extension in the live path). If endpoints are not ready, generate related origins alone — see the progressive use case.

3. Place files

Do not redirect these URLs. Response must be HTTP 200 with Content-Type: application/json.

4. Cloudflare Pages _headers

Copy the recipe from the tool into a root _headers file in the same Pages project that serves the RP ID domain (or your custom-domain Pages site).

5. Extensionless path pitfalls (Pages + Nginx)

Browsers and static hosts often treat extensionless files as HTML. On Pages, the copied _headers rules force application/json. On Nginx outside Cloudflare, set an explicit default_type application/json; (or a location that sets Content-Type) for those two paths — otherwise you may get text/html or a SPA fallback even when the bytes are JSON.

6. Point WebAuthn calls at the RP ID

On every related origin, use the same rpId in credentials.create / credentials.get.

7. Optional validate

After deploy, you can paste the related-origins JSON into passkeys.dev Related Origins Validator to check label counts — that tool validates; this site generates the deploy pack.