1 · Who you are
The name agents will see, and the site the policy covers. Everything you publish there falls under it unless you add items in Advanced mode later.
2 · What agents may do
Four common policies. Each one is a fixed set of protocol scope tags plus a plain-language terms text you can edit before publishing. Need something else? Switch to Advanced.
3 · Your key
The policy is signed with a key that is created here, in your browser. The key is your identity; keep its backup to change the policy later under the same identity.
4 · Create and publish
You get three files to upload and one key backup to keep. The manifest is checked against the protocol's own acceptance rules before anything is offered for download.
Publish it: upload .well-known/proofmeta.json, the terms file and requests.html to your site, keeping the paths. Do not upload the key. Platform notes:
1 · Your signing identity
Your manifest is signed with an ed25519 key. The key is generated locally and identifies you as did:key:….
⚠ Back up the private key now. It exists only in this browser tab. Losing it means losing control of this identity; anyone who has it can sign in your name. With a passphrase the backup is encrypted (PBKDF2 + AES-GCM) and still opens in the CLI.
2 · Provider details
Who is offering the licenses, and where agents send requests.
The URL where Consumer agents POST signed license requests. If you don't run one yet, point it at a page describing how to reach you — you can re-issue the manifest any time.
3 · License types
Each license type says what is permitted, under which terms document, at which (optional, non-binding) price.
4 · Catalog
What is being licensed. Small providers list items inline; larger ones point to a catalog endpoint.
5 · Sign & publish
The manifest is wrapped in a Signed Envelope, then checked against the protocol's own acceptance rules before you download it.
Publish it: upload the file to your domain at
https://yourdomain.com/.well-known/proofmeta.json
served as Content-Type: application/json, UTF-8, no byte-order mark. That's it — any agent can now discover and verify your terms.
Recommended: allow cross-origin reads, so browser-based tools (like the Verifier) can fetch the file:
CORS snippets — nginx · Apache · Vercel · Netlify / Cloudflare Pages
# nginx
location = /.well-known/proofmeta.json {
default_type application/json;
add_header Access-Control-Allow-Origin "*";
}
# Apache (.htaccess)
<Files "proofmeta.json">
Header set Access-Control-Allow-Origin "*"
</Files>
# Vercel (vercel.json → "headers")
{ "source": "/.well-known/proofmeta.json",
"headers": [{ "key": "Access-Control-Allow-Origin", "value": "*" }] }
# Netlify / Cloudflare Pages (_headers)
/.well-known/proofmeta.json
Access-Control-Allow-Origin: *