How to verify you control a store
Prove you control a store with a DNS TXT record, a home-page meta tag, or a file. Cloudflare and other hosts, what we look up, and how to check.
Last reviewed September 2026.
What this is for
An unverified store is still checked once a day. Proving you control the host is what the plan cadence and the Manifest tag key wait on. It is not a login to the store, and it is not a Shopify app install.
Three methods are built: a DNS TXT record, a meta tag on the home page, and a file. Email to a role address and OAuth are planned with the Shopify app. They are not offered on the page yet.
DNS TXT record
Add one TXT record at_tagnovo-site-verificationon the store host so it cannot collide with mail (SPF or DMARC). We look that name up over DNS-over-HTTPS. We do not fetch the home page for this method.
The token Tagnovo issues is the record value. The API returns the name as_tagnovo-site-verification— the host relative to the zone, not the fully-qualified name. Paste that into the Name field. If you type the full domain twice, the record lands on the wrong name and the check fails.
Tagnovo cannot write this record for you. The browser cannot callapi.cloudflare.comfrom tagnovo.com, and we do not store a Cloudflare token. Open the dashboard, or run a command with a token you created.
Cloudflare
- Open dash.cloudflare.com and pick the zone for the store host.
- DNS → Records → Add record.
- Type TXT. Name
_tagnovo-site-verification. Content is the token from Tagnovo. TTL automatic. - Save. Wait a few minutes. Check on the Tagnovo page that issued the token.
To add it from a terminal, create an API token with Zone → DNS → Edit on that zone, then run the command the verify panel copies. Replace$CLOUDFLARE_ZONE_IDand$CLOUDFLARE_API_TOKENwith values from your Cloudflare account. TTL 1 is automatic.
Amazon Route 53
- Open Route 53 hosted zones.
- Open the zone, then Create record.
- Record name
_tagnovo-site-verification. Record type TXT. Value is the token. - Create records, wait, then check in Tagnovo.
Any other DNS host
Find DNS records for the domain — registrar, DNS provider, or the panel your host uses. Add a TXT record whose name is _tagnovo-site-verification and whose value is the token. Leave TTL on automatic if the panel offers it. If the panel asks for the full name, it is_tagnovo-site-verification. plus the zone, not the store hostname twice.
Meta tag on the home page
Use this when you can edit the theme or HTML and cannot edit DNS. Paste the tag Tagnovo shows inside <head> on the home page of the exact host we monitor, then publish.
The tag looks like<meta name="tagnovo-site-verification" content="…">. We fetch that home page and look for the tag. We do not follow redirects: apex to www, or a marketing URL that 302s, is a miss. The tag has to be on the host on the store row.
A file on the site
Serve one file at/.well-known/tagnovo-site-verification.txton the monitored host. Create the .well-known folder if it is missing. The whole body must be the token — no HTML wrapper, no extra line you cannot trim.
We fetch that path and compare the whole body. A page that merely quotes the token somewhere else will not pass. A redirect to another host will not pass.
When a check fails
DNS can take a few minutes. A mismatch means a record or file is there, but the value is not this token — replace it. If the token expired, get a new one from the same panel and publish that. Too many checks in a short window have to wait.
After it passes, cadence follows the plan floor instead of the daily unverified cap, and Manifest can issue a tag key.
Related
Add the store, then prove control on that store’s settings or on Manifest install. What verification is in the terms.
Prove control on a store you added
Verification lives on store settings and Manifest install. A public scan does not prove you control the domain.