Activation

Live mode turns on when you prove you control a site's domain, with a DNS TXT record or a file at /.well-known — like verifying a sending domain.

Test mode works immediately. Live mode — real scans of your site, certificates, sending notices — turns on for the whole account the first time you verify the domain of one of your sites. There is no sales call, no card and no review.

Until then, live-mode operations that act on a real site (scans, certificates, turning on Notices) answer:

{
  "error": {
    "type": "permission_error",
    "code": "account_not_activated",
    "message": "Live mode needs an activated account: verify the domain of one of your sites (or use a test key).",
    "next_action": { "type": "verify_domain", "operation_id": "createDomainVerification" }
  }
}

Live sites created before activation are stored with monitoring held (monitoring.held_for_activation: true); monitoring starts by itself when the account is activated.

#Verify a domain

Start a verification for a live site. You get two ways to prove control; either one works:

curl -X POST https://app.checkbox.site/v1/sites/site_3f9a1c2e7b4d4e0f9a8b7c6d5e4f3a2b/domain_verification \
  -u "$CHECKBOX_LIVE_KEY:"

1. DNS: a TXT record at _checkbox-verify.<your domain> with the value in the response, or
2. File: serve the token at https://<your domain>/.well-known/checkbox-verify.txt. checkbox init --live writes this file into your project's public folder for you.

Then ask Checkbox to look (it also re-checks on its own for a while):

curl -X POST https://app.checkbox.site/v1/sites/site_3f9a1c2e7b4d4e0f9a8b7c6d5e4f3a2b/domain_verification/check \
  -u "$CHECKBOX_LIVE_KEY:"

When it succeeds, account.activation.status becomes active (method: "domain") and held monitoring starts.

#Fair use

Checkbox is free to start, with no plan limits on compliance features. Fair-use limits apply: 25 active sites per account and mode, 300 API requests per minute per account and mode (RateLimit-* headers; 429 rate_limit_exceeded with Retry-After), 16 webhook endpoints per mode, and per-route limits on scans and evaluations. Ask support@checkbox.site to raise them.

Checkbox is compliance software, not a law firm; nothing in these docs is legal advice (details). For AI agents: every page is available as Markdown at the same URL plus .md; the index is /llms.txt.