diff --git a/apps/web/next.config.ts b/apps/web/next.config.ts
index 2272ba8..9dc3fe8 100644
--- a/apps/web/next.config.ts
+++ b/apps/web/next.config.ts
@@ -1,5 +1,15 @@
 import type { NextConfig } from "next";
 const nextConfig: NextConfig = {
+  async headers() {
+    return [
+      { source: "/.well-known/:path*", headers: [{ key: "Access-Control-Allow-Origin", value: "*" }] },
+      {
+        source: "/.well-known/wallet-app.json",
+        headers: [{ key: "Content-Type", value: "application/json; charset=utf-8" }],
+      },
+      { source: "/wallet-app/:path*", headers: [{ key: "Access-Control-Allow-Origin", value: "*" }] },
+    ];
+  },
   reactStrictMode: true,
   reactCompiler: true,
   typedRoutes: true,
diff --git a/apps/web/public/.well-known/wallet-app.json b/apps/web/public/.well-known/wallet-app.json
new file mode 100644
index 0000000..15955a3
--- /dev/null
+++ b/apps/web/public/.well-known/wallet-app.json
@@ -0,0 +1,30 @@
+{
+  "name": "XCP.io",
+  "short_name": "XCP.io",
+  "description": "Explore Counterparty assets, addresses, blocks, and transactions.",
+  "start_url": "/",
+  "scope": "/",
+  "display": "standalone",
+  "background_color": "#09090b",
+  "categories": ["utility", "counterparty"],
+  "icons": [
+    {
+      "src": "/wallet-app/icon.png",
+      "sizes": "1024x1024",
+      "type": "image/png",
+      "purpose": "any"
+    }
+  ],
+  "wallet": {
+    "version": "1",
+    "subtitle": "Counterparty Explorer",
+    "heroImageUrl": "/wallet-app/banner.png",
+    "splashImageUrl": "/wallet-app/splash.png",
+    "chains": {
+      "optional": ["bip122:000000000019d6689c085ae165831e93"]
+    },
+    "capabilities": {
+      "optional": []
+    }
+  }
+}
diff --git a/apps/web/public/_headers b/apps/web/public/_headers
index 43e03ba..45cb023 100644
--- a/apps/web/public/_headers
+++ b/apps/web/public/_headers
@@ -3,3 +3,12 @@
 # per-load revalidation the default (max-age=0, must-revalidate) forces.
 /_next/static/*
   Cache-Control: public, max-age=31536000, immutable
+
+/.well-known/*
+  Access-Control-Allow-Origin: *
+
+/.well-known/wallet-app.json
+  Content-Type: application/json; charset=utf-8
+
+/wallet-app/*
+  Access-Control-Allow-Origin: *
diff --git a/apps/web/public/wallet-app/banner.png b/apps/web/public/wallet-app/banner.png
new file mode 100644
index 0000000..b6e77e3
Binary files /dev/null and b/apps/web/public/wallet-app/banner.png differ
diff --git a/apps/web/public/wallet-app/icon.png b/apps/web/public/wallet-app/icon.png
new file mode 100644
index 0000000..289dcc0
Binary files /dev/null and b/apps/web/public/wallet-app/icon.png differ
diff --git a/apps/web/public/wallet-app/splash.png b/apps/web/public/wallet-app/splash.png
new file mode 100644
index 0000000..1ebf646
Binary files /dev/null and b/apps/web/public/wallet-app/splash.png differ
diff --git a/docs/casatookan.md b/docs/casatookan.md
new file mode 100644
index 0000000..6f35ef4
--- /dev/null
+++ b/docs/casatookan.md
@@ -0,0 +1,18 @@
+# Casa Tookan app
+
+The app manifest is served at `/.well-known/wallet-app.json`. The PNGs under `/wallet-app/` provide its icon, banner and splash. Paths are root-relative so they resolve outside `/.well-known/`.
+
+The manifest makes this site discoverable when a user saves it in Casa Tookan. It does not register the site in a curated directory or enable new signing methods. Bitcoin support is optional because browsing needs no wallet. The splash uses Casa Tookan's automatic readiness timeout.
+
+This change adds browsing metadata only. Existing connection and signing flows are unchanged.
+
+## Deployment check
+
+- Fetch the manifest without cookies and confirm JSON, HTTP 200 and `Access-Control-Allow-Origin: *`.
+- Fetch a missing `/.well-known/` path and a missing `/wallet-app/` image: each must return 404 with CORS, not the homepage.
+- Fetch all three images: 1024×1024 opaque icon, 1200×630 banner, 200×200 splash.
+- Open the site in the native Casa Tookan browser, save it and reopen its app card. Check the title, artwork and splash dismissal.
+
+Headers are configured in both Next (SSR/404) and Cloudflare Static Assets (public files). Production framing and CSP policies are unchanged; the development iframe bridge is not installed.
+
+Format: https://docs.casatookan.com/apps.html