Skip to main content

WordPress · Domain verification

The neuroon-search plugin does not use meta tags or DNS records to verify the domain. It relies on the API Key + the Origin header: when you click Verify Domain in the admin, the plugin sends POST /api/plugin/shops/verify with the current domain and the backend compares it (after normalizeUrl) against the shop.url already registered in Neuroon.

How the flow works​

  1. You generate the Shop API Key in the Neuroon dashboard.
  2. Paste it into Settings → Neuroon Search → Settings tab.
  3. Click Verify Domain.
  4. The plugin sends:
POST/api/plugin/shops/verify
POST /api/plugin/shops/verify HTTP/1.1
Host: dev-api.neuroon.ai
X-Shop-API-Key: sk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Origin: https://your-domain.example
Content-Type: application/json

{"domain": "https://your-domain.example"}
  1. If the normalized domain matches the registered shop.url, the backend returns:
{
"shopId": "shop_xxxxxxxx",
"verificationCode": "vc_yyyyyyyy",
"domain": "https://your-domain.example",
"name": "Your Shop"
}
  1. The plugin stores neuroon_shop_id, neuroon_verification_code and sets neuroon_verified = 1 in wp_options. The Products, Widget and Diagnostics tabs appear.

Retrieve verification data​

To inspect the current state without re-verifying:

GET/api/plugin/shops/{shopId}/verification-data
curl -s "https://dev-api.neuroon.ai/api/plugin/shops/$NEUROON_SHOP_ID/verification-data" \
  -H "X-Shop-API-Key: $NEUROON_API_KEY" \
  -H "Origin: https://your-domain.example"

Returns domain, verificationCode and verifiedAt. Useful for diagnostics without touching the write flow.

Unverify​

If you sell the shop, move domains or want to rotate credentials:

DELETE/api/plugin/shops/{shopId}/verify
curl -X DELETE "https://api.neuroon.ai/api/plugin/shops/$NEUROON_SHOP_ID/verify" \
-H "X-Shop-API-Key: $NEUROON_API_KEY" \
-H "Origin: https://your-domain.example"

From the admin, Settings tab → Unverify Domain triggers the same call and clears local options.

Rotate the API Key​

API Keys are revocable. If a key has leaked:

  1. Generate a new key in the Neuroon dashboard.
  2. Update Settings → Neuroon Search → API Key and save.
  3. Revoke the old one from the dashboard.

The plugin does not store the key in plaintext outside wp_options (neuroon_api_key). On shared environments, restrict database access and consider moving the key to a constant in wp-config.php with a custom filter.

Common errors​

CodeCauseFix
401 UnauthorizedInvalid or revoked API KeyRegenerate and re-paste the key.
403 ForbiddenOrigin does not match the registered domainCheck get_site_url. Aliases (www. vs apex) must match the URL stored in shop.url.
404 Not FoundThe shopId does not exist or does not belong to your keyClick Verify Domain from scratch; the plugin rewrites neuroon_shop_id.
429 Too Many RequestsRate limit verification (20/min) or verify-action (5/5min) exceededWait for Retry-After. The plugin absorbs it via Neuroon_Rate_Limit_Handler.

Best practices​

  • Verify from the canonical domain you intend to use in production. If your shop forces https://www.example.com, do not verify https://example.com.
  • Do not expose the API Key to the frontend. It is used only server-to-server from PHP.
  • Re-verify after a URL change (siteurl or home in WP). The backend compares normalizeUrl(domain) exactly.

Next steps​

Last updated on