IndieWeb Endpoint Auditor

Audit a public web page for IndieWeb endpoint discovery in one API call. Checks for IndieAuth authorization and token endpoints, IndieAuth server metadata, Micropub, Webmention, Microsub, and rel="me" identity links. Returns a readiness score, letter grade, issues, and recommendations.

Use cases

• Personal website owners and IndieWeb adopters - verify their site exposes the endpoints required for IndieAuth login, content publishing, and webmentions
• IndieWeb tooling developers - validate that a target domain is correctly configured before building a client against it
• Static site generator and CMS plugin authors - regression-test endpoint discovery after template or theme changes
• Agency consultants - batch-audit client sites that claim IndieWeb support
• Identity verification services - check rel="me" link presence for RelMeAuth-based sign-in flows

Input

Field	Type	Required	Default	Description
startUrl	string	yes	-	Public page URL to audit (typically a homepage or IndieWeb profile page)
timeoutSeconds	integer	no	10	Per-request timeout (3-30 seconds)
maxHtmlBytes	integer	no	1048576	Maximum HTML body size to download and parse (16 KB - 2 MB)

Example input

{
  "startUrl": "https://example.com",
  "timeoutSeconds": 10,
  "maxHtmlBytes": 1048576
}

Output

A single dataset item with the full audit:

Field	Type	Description
inputUrl	string	The URL provided as input
finalUrl	string	Final URL after redirects
https	boolean	Whether the final response was served over HTTPS
endpoints	object	Discovered endpoints, keyed by authorizationEndpoint, tokenEndpoint, indieauthMetadata, micropubEndpoint, webmentionEndpoint, microsubEndpoint. Each value is either null or { url, resolvedUrl, source }
relMeLinks	array	List of rel="me" identity links found, each { href, resolvedUrl }
indieAuthReady	boolean	true when both authorization_endpoint and token_endpoint were discovered
score	integer	IndieWeb endpoint readiness score (0-100)
grade	string	Letter grade (A+, A, B, C, D, E, F)
issues	array	Aggregated issue descriptions
checkedAt	string	ISO 8601 timestamp
recommendations	array	Actionable recommendations for improving endpoint discovery
error	string | null	Fetch error message, if any

endpoints entry shape

Each non-null endpoint entry contains:

Field	Type	Description
url	string	The raw href or Link header URL value as published
resolvedUrl	string | null	The URL resolved to an absolute URL against the final page URL
source	string	Where the endpoint was discovered: html (a <link> element) or header (an HTTP Link response header)

Endpoints checked

Endpoint	rel value	Purpose
Authorization endpoint	authorization_endpoint	Where IndieAuth clients redirect users to sign in
Token endpoint	token_endpoint	Where IndieAuth clients exchange authorization codes for access tokens
IndieAuth metadata	indieauth-metadata	Server metadata document for richer IndieAuth client discovery
Micropub endpoint	micropub	Where IndieAuth-authenticated clients publish content
Webmention endpoint	webmention	Where other sites send mention/reply/like notifications
Microsub endpoint	microsub	Feed reader server endpoint for the IndieWeb reader ecosystem

Discovery checks HTML <link rel="..."> elements first, then falls back to the HTTP Link response header per RFC 8288 for any endpoint not found in HTML. rel="me" links are collected from both <a> and <link> elements, deduplicated by resolved URL.

Grading scale

Score range	Grade
95-100	A+
85-94	A
75-84	B
65-74	C
50-64	D
30-49	E
0-29	F

Scoring awards 25 points for the authorization endpoint, 20 points each for the token endpoint, Micropub endpoint, and Webmention endpoint, and 15 points for having at least one rel="me" link.

Example output

{
  "inputUrl": "https://example.com",
  "finalUrl": "https://example.com/",
  "https": true,
  "endpoints": {
    "authorizationEndpoint": {
      "url": "https://example.com/auth",
      "resolvedUrl": "https://example.com/auth",
      "source": "html"
    },
    "tokenEndpoint": {
      "url": "https://example.com/auth/token",
      "resolvedUrl": "https://example.com/auth/token",
      "source": "html"
    },
    "indieauthMetadata": null,
    "micropubEndpoint": {
      "url": "https://example.com/micropub",
      "resolvedUrl": "https://example.com/micropub",
      "source": "html"
    },
    "webmentionEndpoint": {
      "url": "https://webmention.io/example.com/webmention",
      "resolvedUrl": "https://webmention.io/example.com/webmention",
      "source": "html"
    },
    "microsubEndpoint": null
  },
  "relMeLinks": [
    { "href": "https://github.com/example", "resolvedUrl": "https://github.com/example" },
    { "href": "mailto:me@example.com", "resolvedUrl": "mailto:me@example.com" }
  ],
  "indieAuthReady": true,
  "score": 95,
  "grade": "A+",
  "issues": [],
  "checkedAt": "2026-10-02T05:00:00.000Z",
  "recommendations": [
    "Consider publishing an IndieAuth server metadata document (rel=\"indieauth-metadata\") per the current IndieAuth spec for richer client discovery."
  ],
  "error": null
}

Security

• Only public HTTP/HTTPS URLs are accepted
• SSRF protection: localhost, private IPv4/IPv6 literals (including bracketed IPv6), and DNS-resolving-to-private IPs are blocked
• URLs with embedded credentials are rejected
• Redirects are manually revalidated before following (max 3)
• HTML body is capped at maxHtmlBytes to prevent oversized responses
• Discovered endpoint URLs and rel="me" links are never fetched by the actor; only the input page itself is retrieved
• No browser automation, no proxies, no cookies stored

Pricing

Pay per event:

Event	Price
Actor start	$0.005
Page audited	$0.01

A single-page audit costs approximately $0.015.

FAQ

What is IndieWeb endpoint discovery? IndieWeb sites publish a small set of <link> elements (or equivalent HTTP Link headers) that let independent clients discover how to sign a user in (IndieAuth), publish content on their behalf (Micropub), receive mention notifications (Webmention), and sync feeds (Microsub). This actor checks for all of them in one pass.

What is rel="me"? A rel="me" link on an anchor or <link> element asserts that the linked profile (GitHub, Mastodon, a mailto: address, etc.) belongs to the same person as the page being audited. It underlies RelMeAuth-style identity verification used by some IndieAuth implementations.

Does this actor replace a full IndieAuth client or server implementation? No. It only performs read-only discovery and validation of the endpoints a site publishes. It does not perform OAuth flows, issue tokens, or store credentials.

Does the actor follow redirects? Yes, up to 3 redirects. Each redirect target is revalidated for SSRF safety before it is followed.

Can I audit multiple pages in one run? This actor audits one page per run. For bulk audits, schedule multiple runs.