> ## Documentation Index
> Fetch the complete documentation index at: https://docs.waffo.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Domain Verification

> Prove ownership of your product website before submitting KYB

## Why we verify your domain

Your website is the public face of your product. Before we approve KYB and enable production payments, we need to confirm that the domain you list as `Product website` actually belongs to you. Domain verification is a one-time step per store, and the binding stays in place after KYB approval.

There are two entry points — both write to the same backend state, so verifying once is enough:

* **Settings → General** — verify (or re-verify) your product domain at any time, independent of KYB.
* **Settings → Business Details → Step 8 (Website URL)** — inline during KYB submission. The "Submit for review" button stays disabled until the domain on this step is verified.

## Verification methods

Pancake offers four ways to verify a domain. Pick whichever your stack already supports — they are equivalent.

| Method                  | Typical setup time         | Best for                                                       |
| ----------------------- | -------------------------- | -------------------------------------------------------------- |
| Email domain auto-match | Instant                    | Sites where the support email already lives on the same domain |
| DNS TXT record          | 5–30 min (DNS propagation) | Most websites; works on any host                               |
| HTML `<meta>` tag       | 1–2 min (deploy required)  | Single-page apps and statically generated sites                |
| `.well-known` file      | 1–2 min (deploy required)  | Anything that can serve a static file                          |

<Note>
  Pick **one** method. Once any method succeeds, the others stop being relevant for this domain.
</Note>

## Method 1 — Email domain auto-match (recommended)

If your support email is already verified in **Step 7 (Contact Email)** and lives on the same domain as your website, Pancake automatically detects this and shows a one-click **Verify domain** button.

**Example.** Support email `support@acme.com` (verified) + Product website `https://acme.com` → auto-match available.

1. Click **Verify domain**.
2. Pancake validates the email/domain pair on the server. Verification completes immediately.

If the support email is on a different domain (e.g. `team@gmail.com` while the site is `acme.com`), this option is hidden — use one of the manual methods below.

## Method 2 — DNS TXT record

The most reliable method. You add a TXT record to the DNS zone for your domain.

1. In the dashboard, click **Use another method** → **DNS TXT**.
2. Pancake shows three values:
   * **Type**: `TXT`
   * **Host / Name**: `_waffo-challenge` (the dashboard strips the `.your-domain.com` suffix automatically — most providers prepend it for you)
   * **Value**: a one-time challenge string starting with `waffo-domain-verify=…`
3. Open your DNS provider's dashboard and add the record exactly as shown. Leave TTL at the default.
4. Wait for propagation. Most providers publish within minutes; some (Cloudflare, Route 53) are nearly instant.
5. Back in Pancake, click **I've added the record**. We query the public DNS for the TXT value and complete verification on success.

<Note>
  You can leave the TXT record in place after verification. It does no harm. If you remove it, the existing binding is unaffected — we only re-check at verification time.
</Note>

### Provider-specific notes

| Provider       | Where to add TXT records                              |
| -------------- | ----------------------------------------------------- |
| Cloudflare     | DNS → Records → Add record                            |
| GoDaddy        | My Products → DNS → Add → TXT                         |
| Namecheap      | Domain List → Manage → Advanced DNS → Add new record  |
| Route 53       | Hosted zones → your zone → Create record (Type = TXT) |
| Google Domains | DNS → Custom records                                  |

If your provider expects a fully-qualified record name, use `_waffo-challenge.your-domain.com` instead of just `_waffo-challenge`.

## Method 3 — HTML `<meta>` tag

Useful when you can't change DNS but you can deploy site code.

1. In the dashboard, click **Use another method** → **HTML meta tag**.
2. Pancake shows the snippet:
   ```html theme={"system"}
   <meta name="waffo-verify" content="<your-challenge-value>">
   ```
3. Add it to the `<head>` of your site's homepage (`https://your-domain.com/`).
4. Deploy. Verify the tag is present in the rendered HTML — view-source must include it; tags injected only after JS execution can fail if our crawler hits before hydration. If you're on a fully client-rendered SPA, prefer Method 2 or 4.
5. Back in Pancake, click **I've added the tag**.

## Method 4 — `.well-known` file

Drop a static file under a fixed path. Works on any host that serves static assets.

1. In the dashboard, click **Use another method** → **.well-known file**.
2. Pancake shows:
   * **File URL**: `https://your-domain.com/.well-known/waffo-challenge.txt`
   * **File contents**: a single line starting with `waffo-domain-verify=…`
3. Create the file at exactly that path. Make sure the response is `200 OK`, `Content-Type: text/plain` (or any text-like type), and the body is the challenge value with no extra whitespace.
4. Confirm in a browser that the URL returns the expected content.
5. Back in Pancake, click **I've uploaded the file**.

<Note>
  Common mistake: deploying the file at `/.well-known/waffo-challenge` (no extension) or returning a 301 redirect to `www.your-domain.com`. Both fail. Use the exact URL Pancake shows, served from the apex / canonical host you typed into the website field.
</Note>

## Troubleshooting

### "Could not find the record / tag / file"

Recheck the value. The challenge is generated per attempt; if you hit **Refresh** in Pancake, the previous value is invalidated. Make sure you copied the latest one.

### TXT record exists but verification still fails

DNS caches. Try `dig TXT _waffo-challenge.your-domain.com` (Linux/macOS) or `nslookup -type=TXT _waffo-challenge.your-domain.com` (Windows). If the value isn't visible there yet, wait 5–10 minutes and retry.

### The challenge expired

Each challenge has a short lifetime (the dashboard shows the exact time under the action button). If it expired, click **Refresh** in Pancake to issue a new one, then update your DNS / meta tag / file with the new value.

### I want to change my product website later

Before KYB approval, you can revoke the current domain binding from **Step 8 (Website URL)** and re-verify a new one. After KYB approval the domain is locked — contact support to change it.

## Programmatic / API access

If you're verifying domains as part of an automated onboarding flow, the underlying endpoints are:

| Endpoint                                                    | Purpose                                          |
| ----------------------------------------------------------- | ------------------------------------------------ |
| `POST /v1/actions/verification/start-domain-verification`   | Issues a challenge for one of the four methods   |
| `POST /v1/actions/verification/confirm-domain-verification` | Asks the server to check the record / tag / file |

Both require the merchant JWT (or API key) and the standard `X-Environment` header.

## Next steps

After domain verification succeeds, head back to Business Details and complete the remaining steps (Step 9 onward). The Submit for review button unlocks once **all** steps including domain verification turn green.