IndexNow API key: what it is and where it lives

What the key is, and is not

"API key" is a misnomer inherited from other services. Nobody issues an IndexNow key and there is nothing to register: you invent it, publish it in a text file on your host, and endpoints verify that the file exists whenever you submit. Anyone can read the file, so the key does not protect anything; it only ties submissions to a host you demonstrably control.

Key format

8 to 128 characters from a-z, A-Z, 0-9 and the dash (-). A random 32-character hex string, as produced by the generator, is the common choice.

Hosting the key file

The default location is https://<host>/<key>.txt: a file named after the key, at the root, containing exactly the key. Serve it as text/plain with a 200 status and without redirecting to another host.

If you cannot write to the root, pass keyLocation in each request with the full URL of a .txt file elsewhere on the same host. The key is then valid only for URLs under that file's directory: a key at /blog/key.txt covers /blog/… but not /pricing.

One key or several

One key per host is enough. Several keys are legitimate when different systems submit for different paths (each with its own keyLocation), or during a rotation. Subdomains are separate hosts and need their own key files.

Rotating or retiring a key

1. Publish the new key file.
2. Switch every submitter (plugin, CI script, AutoIndexNow site settings) to the new key.
3. Confirm a submission returns 200.
4. Delete the old file.

Retiring a key without replacement simply means future submissions with it fail with 403. Already-accepted submissions are unaffected.