# Site verification

baas serves content only for **verified** domains — proof that you control
the site a public key belongs to. Verification is a one-time step per site;
your token is shown on the site page.

Two methods; either one passes.

## Method 1: DNS TXT record

Create a `TXT` record on the `_baas` subdomain of your domain:

| Field | Value |
|---|---|
| Name / host | `_baas.example.com` (some providers want just `_baas`) |
| Type | `TXT` |
| Value | your verification token, exactly as shown |

Then click **Verify** on the site page. DNS can take from minutes to a few
hours to propagate depending on your provider.

## Method 2: well-known file

Serve the token as plain text at:

```
https://example.com/.well-known/baas-verify.txt
```

The response must be HTTP 200 over HTTPS, and the file's content must be
the token (surrounding whitespace is fine). Then click **Verify**.

:::callout{severity=info title="Which should I pick?"}
DNS survives site redeploys and works before your site even exists. The
file method is instant if you can ship static files faster than you can
edit DNS. Keep whichever you chose in place — it also lets you re-verify
after changes.
:::

## Troubleshooting

- **DNS check fails** — confirm with `dig TXT _baas.example.com` (or an
  online DNS checker) that the record is visible and matches the token
  exactly. Propagation delays are the usual cause.
- **File check fails** — `curl https://example.com/.well-known/baas-verify.txt`
  must return the token with status 200. Redirects to another status,
  HTML error pages, and HTTP-only sites won't pass. The check times out
  after 5 seconds, so the file must be served promptly.
- **Token mismatch** — re-copy it from the site page; the comparison is
  exact apart from trimmed whitespace.