Generated Verification Key
Every verification key must be served at the root directory of your site.
Where do I place this key file?
1. Save the file. It will be named exactly key.txt.
2. Upload the file to your website's root folder (e.g. https://yoursite.com/key.txt).
3. Submit your pings. Search engines will call this path to verify domain ownership.
Deep-Dive: How IndexNow Keys Authorize Fast Crawling
The IndexNow protocol is an open-source initiative designed to optimize website indexing by transitioning from a passive "pull" mechanism to a real-time "push" model. In a traditional SEO environment, search engine crawlers (such as Bingbot or YandexBot) must periodically scan your XML sitemaps or follow internal link graphs to discover new or updated pages. This passive method is highly inefficient and creates significant latency, sometimes taking weeks for a new page to appear in organic search results. IndexNow solves this latency by allowing webmasters to notify search engines instantly when a URL is created, updated, or deleted.
The Security Model of UUID Verification Keys
To prevent malicious actors from spamming search engines with fake indexing requests or triggering crawl loops on unauthorized domains, IndexNow uses a simple yet highly secure verification protocol based on UUID (Universally Unique Identifier) keys. When you generate a key, you are creating a secret token that only you, as the domain owner, can serve on your web server.
The protocol requires you to host a text file named after your key at the root of your domain. For example, if your generated key is 3a5f9c8d..., the file must be accessible at https://yourdomain.com/3a5f9c8d...txt, and the body of the file must contain that exact key string. When you send an indexing ping to the IndexNow API, the search engine will immediately fetch this text file from your root domain to verify that the request originated from the authorized owner.
Step-by-Step Implementation Guide
- Step 1: Generate the UUID Key: Use our generator tool above to create a compliant key. Click "Download Key File" to download the formatted
.txtfile. - Step 2: Upload to Server Root: Upload this file to your website's public HTML root directory (commonly
public_html,wwwroot, or the assets path in static hosting). - Step 3: Test Verification URL: Open your web browser and navigate to
https://yourdomain.com/your-key.txt. Ensure that it returns a clean page with only the key text and no 404/500 errors. - Step 4: Dispatch the Ping Request: Send an HTTP GET request to a search engine endpoint. For example, to ping Bing, execute a request to:
https://www.bing.com/indexnow?url=https://yourdomain.com/new-page&key=your-key.
Best Practices for Programmatic Platforms
If you are running a single-page application (SPA), a headless Next.js site, or a closed platform like Webflow or Wix, uploading raw text files to the root directory can be challenging due to routing locks. To bypass this, you can configure dynamic rewrite rules inside your middleware (e.g., next.config.js redirects or Cloudflare Pages functions) that intercept requests for the key file path and return the plain-text key value with a text/plain content-type header.
Additionally, search engines share submissions. Pinging Bing's IndexNow API will automatically broadcast the update notification to Yandex, Seznam, and other participating search networks, eliminating the need to dispatch separate pings to each engine. Make sure to keep your key active and unchanged; changing the key requires search engines to re-verify your domain, which can temporarily disrupt your automated crawling schedules.
Tired of managing scripts and JSON keys?
Let our automated sitemap watcher submit posts and catalog drops on autopilot.