.well-known/wayid.toml

WayID uses the IETF RFC 8615 .well-known standard for website ownership verification. By placing a wayid.toml file at a well-known URI on your domain, you prove that you control the website.

How it works

1. On the WayID dashboard, add your website as a social link.
2. WayID generates a verification token (format: wayid-verify-{16-hex-chars}).
3. You create a file at https://yourdomain.com/.well-known/wayid.toml with the token.
4. WayID fetches the file and confirms the token matches.

File format

Create a file named wayid.toml in the /.well-known/ directory of your website’s root:

# WayID domain verification file
# See https://docs.way.je/verify-website for details

[wayid]
version = 1
verification_token = "wayid-verify-a1b2c3d4e5f6g7h8"

Field	Required	Description
version	Yes	Must be 1
verification_token	Yes	The token provided by WayID during setup

The [org] section namespace is used for organization domain verification; other namespaces are reserved for future use.

Verification rules

WayID performs the following checks:

1. URL resolution — Your domain is normalized and tried in order:

   • https://{domain}
   • https://www.{domain}
   • http://{domain}

2. File fetch — WayID requests {base}/.well-known/wayid.toml from each candidate URL until one succeeds.

3. Token match — The file contents must contain your exact verification token.

4. HTTP status — The server must return a 2xx status code.

Each fetch has a short timeout, and WayID retries a few times with exponential backoff before giving up. (Exact timeout, retry counts, and delays may change.)

Example

If your domain is example.com and your verification token is wayid-verify-a1b2c3d4e5f6g7h8, create this file:

URL: https://example.com/.well-known/wayid.toml

# WayID domain verification file
# See https://docs.way.je/verify-website for details

[wayid]
version = 1
verification_token = "wayid-verify-a1b2c3d4e5f6g7h8"

Token generation

Verification tokens are deterministic HMAC-SHA256 signatures derived from your user ID, the platform, the handle or URL, and the social link’s internal ID. The same token is regenerated each time you view your verification instructions — you don’t need to store it.

Common issues

File not found (404) Ensure the file is served at the exact path /.well-known/wayid.toml. Some hosting platforms require explicit configuration to serve files from .well-known/ directories.

HTTPS required WayID tries HTTPS first. If your site only serves HTTP, verification will still work as a fallback, but HTTPS is strongly recommended.

CDN or proxy caching If you use a CDN, the file might be cached. Clear your CDN cache or wait for the TTL to expire before retrying verification.