Domain verification

Before Sill records agent visits or publishes a signed agent card, MCP server or ARD catalog for your site, you prove that you control its domain. Sill does this by fetching a per-site proof token from your own domain. There is no DNS record to add.

Until a site is verified it stays NOT YET VERIFIED, and its agent card URL returns 404 with {"status":"pending_verification", …}.

Choose how to verify

How you installed Sill	How verification works
Script tag	Paste the snippet, publish, click Verify. Sill finds the token in your homepage.
WordPress plugin	The plugin serves the proof file. Click Verify.
Cloudflare Worker	Deploying the Worker verifies the domain. Nothing else to do.
Shopify	Connecting your Shopify store verifies the domain. Nothing else to do.
Any site where the snippet is not in the page source	Publish the proof file at `/.well-known/sill-proof.txt`, then click Verify.

Verify with the snippet

The install snippet carries your proof token in data-proof-token:

<!-- paste before </body> -->
<script async src="https://cdn.sill.so/embed.js"
        data-site-key="us_…"
        data-proof-token="pf_…"></script>

In onboarding (Install and verify) or Settings → Install, copy the snippet. It is filled in with your site key and proof token.
Paste it before </body> on your homepage and publish.
Click Verify. The button shows Checking… while Sill fetches https://{your-domain}/, then Domain verified when it finds the token.

The proof token is not a secret. It is meant to sit in your public HTML, and the script in the browser never reads or sends it. It only proves ownership because Sill fetches it from your domain itself.

Script tag install with the site key and proof token filled in, and a Verify button that checks your homepage. The snippet comes filled in with your site key and proof token.

Verify with a proof file

Use this if your homepage HTML is built by JavaScript (a single-page app), so the snippet is not in the page source Sill fetches.

Click Verify once. If Sill can’t find the snippet, it shows OPTIONAL FALLBACK · ONLY IF THE SNIPPET CAN’T BE FOUND with the exact file to publish. Click Copy.
Publish a file at https://{your-domain}/.well-known/sill-proof.txt whose whole content is your proof token on one line, for example:
```
pf_AbCdEfGhIjKlMnOpQrStUvWxYz0123456789-_AbCdE
```
Click Verify again.

The WordPress plugin and the Cloudflare Worker serve this file for you.

Proof file fallback showing the .well-known path and the one-line token to publish. The fallback appears when Sill can’t find the snippet on your homepage.

What happens when you click Verify

flowchart LR
  A[You click Verify] --> B{Token in<br/>homepage?}
  B -->|yes| V[Domain verified]
  B -->|no| C{Token in<br/>proof file?}
  C -->|yes| V
  C -->|no| X[Message says<br/>what to fix]

Sill fetches your domain from its own servers. It checks the exact domain you registered and does not follow redirects, with one exception: if your domain redirects to its own www version (or from www to the bare domain), Sill tries that version once.

Once verified, Sill starts recording agent visits and publishes your agent card, MCP server and ARD catalog.

Fix a failed verification

Message	What it means	What to do
Snippet not found yet	Sill loaded your homepage but the snippet with your token was not in it.	Publish the snippet on the homepage (check your theme or page builder saved it), or use the proof file.
Store is password-protected	Shopify is showing its password page, so the snippet is not visible.	Remove the store password, or connect Shopify instead.
{domain} redirects somewhere else	Your domain redirects to a different host (Sill already follows a redirect to its own `www` or bare version).	Add the domain your site actually serves as the site, or serve the registered domain directly.
Couldn’t reach {domain}	Sill could not load the site.	Make sure the site is live and reachable over HTTPS.
Too many attempts	More than 10 checks in a minute.	Wait a minute and try again.
Site unavailable	The site is suspended.	Contact Sill support.

Connected platforms as proof

Connecting a platform can add a second proof to your site:

Shopify — when the store’s domain matches your site, connecting Shopify proves ownership on its own, because Shopify has already verified that domain.
Stripe — when the website in your Stripe account matches your site, Sill records it, but only alongside a snippet, proof-file, plugin or Worker verification. Anyone can type any URL into Stripe, so it is not enough on its own.
WooCommerce — connecting your store’s REST API keys on your domain is also recorded alongside the main verification, never instead of it.

Rotate the proof token

You rarely need to. The token is public by design; rotate it only if you think someone else is using it. Rotation is available to owners and admins through the API: POST /v1/sites/{site_id}/proof-token/rotate with {"mode":"graceful","reason":"routine"} keeps the old token valid for 24 hours, and "mode":"immediate_revoke" (with "reason":"suspected_leak") stops it at once. Then update your snippet or proof file and click Verify again. See API endpoints.

Common questions

Does Sill need access to my DNS? No.

Can I install Sill without verifying? You can paste the snippet, but Sill records and publishes nothing until the domain is verified. Verifying is the last part of installing.

My snippet is on /about, not the homepage. Can Sill check there? Yes, through the API: send {"install_page_path": "/about"} to POST /v1/sites/{site_id}/proof-check. The path must be on your registered domain.

Can two sites share a proof token? No. Each site has its own.

Where does the check come from? From Sill’s servers in the US. There is no published list of source IP addresses, so don’t allow-list by IP.