1 · Your signing identity
Your manifest is signed with an ed25519 key. The key is generated locally and identifies you as did:key:….
⚠ Back up the private key now. It exists only in this browser tab. Losing it means losing control of this identity; anyone who has it can sign in your name.
2 · Provider details
Who is offering the licenses, and where agents send requests.
The URL where Consumer agents POST signed license requests. If you don't run one yet, point it at a page describing how to reach you — you can re-issue the manifest any time.
3 · License types
Each license type says what is permitted, under which terms document, at which (optional, non-binding) price.
4 · Catalog
What is being licensed. Small providers list items inline; larger ones point to a catalog endpoint.
5 · Sign & publish
The manifest is wrapped in a Signed Envelope, then checked against the protocol's own acceptance rules before you download it.
Publish it: upload the file to your domain at
https://yourdomain.com/.well-known/proofmeta.json
served as Content-Type: application/json, UTF-8, no byte-order mark. That's it — any agent can now discover and verify your terms.
Recommended: allow cross-origin reads, so browser-based tools (like the Verifier) can fetch the file:
CORS snippets — nginx · Apache · Vercel · Netlify / Cloudflare Pages
# nginx
location = /.well-known/proofmeta.json {
default_type application/json;
add_header Access-Control-Allow-Origin "*";
}
# Apache (.htaccess)
<Files "proofmeta.json">
Header set Access-Control-Allow-Origin "*"
</Files>
# Vercel (vercel.json → "headers")
{ "source": "/.well-known/proofmeta.json",
"headers": [{ "key": "Access-Control-Allow-Origin", "value": "*" }] }
# Netlify / Cloudflare Pages (_headers)
/.well-known/proofmeta.json
Access-Control-Allow-Origin: *