How to Create an IndexNow API Key (Step-by-Step)

IndexNow lets you notify Bing and other participating search engines when URLs on your site are added or updated. To use it, you need an IndexNow API key — but you do not download that key from Bing Webmaster Tools. You create it yourself, publish a small verification file on your domain, and then tools like IndexEZ can submit URLs on your behalf.

In short:

• An IndexNow API key is a random string you generate (8–128 characters: letters, numbers, hyphens).
• You prove ownership by hosting a file at https://yourdomain.com/{your-key}.txt that contains only the key text.
• Search engines check that file before accepting IndexNow submissions for your host.
• After setup, connect the same key in your project settings to submit URLs from IndexEZ.

What IndexNow is and why you need a key

IndexNow is an open protocol for telling search engines that content on your site has changed. Instead of waiting for the next natural crawl, you send a list of URLs to an IndexNow endpoint. Participating engines — including Bing — can use that signal to crawl sooner.

The API key is not a secret login from Microsoft. It is a shared secret between your site and anyone submitting on your behalf: the key must match a publicly reachable verification file on the same host as the URLs you submit. That design stops third parties from notifying engines for domains they do not control.

IndexNow API key requirements

Before you generate a key, confirm it meets the official IndexNow rules:

• Length: 8 to 128 characters.
• Allowed characters: a–z, A–Z, 0–9, and hyphen (-) only.
• One key per host (or per subdomain, if you treat subdomains separately).
• The verification file name must be exactly {key}.txt at the root of the host you submit for.

Example: if your key is 8f3c2a1b9d4e7f6a, the file must live at https://example.com/8f3c2a1b9d4e7f6a.txt and the file body must be only 8f3c2a1b9d4e7f6a — no HTML, no extra lines, no BOM.

Step 1: Generate your IndexNow API key

Pick any method that produces a random string within the rules above. You only need to do this once per site (or per subdomain).

Option A: Terminal (OpenSSL)

On macOS or Linux, run openssl rand -hex 16. That outputs 32 hexadecimal characters — valid and easy to copy. Adjust length if you prefer a shorter key, as long as you stay within 8–128 characters.

Option B: Password manager or UUID

Many password managers can generate a random alphanumeric string. Remove any characters that are not letters, numbers, or hyphens. A UUID without braces (e.g. a1b2c3d4-e5f6-7890-abcd-ef1234567890) also works if you keep only allowed characters.

Option C: Online generator (use carefully)

You can use a trusted local script or generator. Avoid pasting production keys into untrusted websites. Treat the key like an API credential: store it in your password manager or project settings, not in public repos.

Tip: Use a dedicated key per domain or project. If you rotate the key, update both the .txt file on your server and any tool (such as IndexEZ) that stores the key.

Step 2: Create the verification file on your site

Create a plain text file named {your-key}.txt. The entire file content must be exactly your key — nothing else.

1. Name the file using your key plus .txt (e.g. 8f3c2a1b9d4e7f6a.txt).
2. Put only the key string inside the file (no quotes, no labels).
3. Upload to the web root of the host you will submit URLs for (same hostname as your pages).
4. Serve it over HTTPS with a 200 response and Content-Type text/plain is typical but not always required — avoid redirects to login pages or HTML error pages.

Common hosting setups

• Static site / CDN: upload the .txt file next to index.html at the bucket or public root.
• WordPress: place the file in the site root (often via FTP/SFTP or a file manager plugin), not inside /wp-content/uploads unless your root is configured there.
• Next.js / Vercel: add public/{your-key}.txt so it deploys to https://yourdomain.com/{your-key}.txt.
• Nginx / Apache: ensure the file is not blocked by robots.txt or security rules for .txt paths.

Step 3: Verify the key file is reachable

Open the URL in a browser or run curl -s https://yourdomain.com/your-key.txt. You should see only the key. If you get 404, a redirect to www vs non-www mismatch, or HTML instead of plain text, fix hosting before connecting tools.

• www vs apex: submit URLs for the same host where the key file lives. If the file is on https://example.com, do not expect IndexNow to accept submissions keyed only on https://www.example.com unless the file exists there too.
• Trailing slashes: the key file path should not require a trailing slash.
• Caching: purge CDN cache after uploading a new or rotated key file.

Step 4: Connect the key in IndexEZ

After your verification file is live, add the key to your project so IndexEZ can submit URLs via IndexNow when you request indexing:

1. Open your project in IndexEZ.
2. Go to Settings → Connections.
3. Under Bing (IndexNow), click Connect.
4. Paste the same key you used for the .txt file and save.

From the Links view, you can request indexing via Google Search Console and Bing IndexNow for URLs on that project's domain. Bing submissions use your project key; Google still requires a connected Search Console property with indexing permission.

What happens when you submit a URL

When IndexEZ (or any IndexNow client) notifies engines, the request includes your host, key, keyLocation (the URL of your .txt file), and urlList. The engine may fetch keyLocation to confirm you control the host. A successful submission usually returns HTTP 200 or 202 — it does not guarantee immediate indexing, only that the notification was accepted.

Troubleshooting checklist

• Key file returns 404 or 403 — fix path, permissions, or CDN root.
• File contains extra whitespace or a newline — trim to the key only.
• Key has invalid characters — stick to letters, numbers, and hyphens.
• Submitted URLs use a different host than the key file — align apex/www/subdomain.
• Key was rotated on the server but not in IndexEZ — update both sides.
• Submission skipped in-app — connect Bing (IndexNow) in Settings for that project.

What to do next

Generate one key per site, publish the verification file, verify it in the browser, then connect it in IndexEZ. Pair IndexNow with your normal indexing workflow — Search Console for Google, IndexNow for Bing and partners — and re-check index status after a few days. For background on why indexed URLs matter for links and placements, see our guide on backlink indexing.