# Activation

> Live mode turns on when you prove you control a site's domain, with a DNS TXT record or a file at /.well-known — like verifying a sending domain.

Test mode works immediately. Live mode — real scans of your site, certificates, sending notices — turns on for the
whole account the first time you verify the domain of one of your sites. There is no sales call, no card and no review.

Until then, live-mode operations that act on a real site (scans, certificates, turning on Notices) answer:

```json
{
  "error": {
    "type": "permission_error",
    "code": "account_not_activated",
    "message": "Live mode needs an activated account: verify the domain of one of your sites (or use a test key).",
    "next_action": { "type": "verify_domain", "operation_id": "createDomainVerification" }
  }
}
```

Live sites created before activation are stored with monitoring **held** (`monitoring.held_for_activation: true`);
monitoring starts by itself when the account is activated.

## Verify a domain {#verify}

Start a verification for a live site. You get two ways to prove control; either one works:

```bash
curl -X POST https://app.checkbox.site/v1/sites/site_3f9a1c2e7b4d4e0f9a8b7c6d5e4f3a2b/domain_verification \
  -u "$CHECKBOX_LIVE_KEY:"
```

1. **DNS:** a TXT record at `_checkbox-verify.<your domain>` with the value in the response, or
2. **File:** serve the token at `https://<your domain>/.well-known/checkbox-verify.txt`. `checkbox init --live`
   writes this file into your project's public folder for you.

Then ask Checkbox to look (it also re-checks on its own for a while):

```bash
curl -X POST https://app.checkbox.site/v1/sites/site_3f9a1c2e7b4d4e0f9a8b7c6d5e4f3a2b/domain_verification/check \
  -u "$CHECKBOX_LIVE_KEY:"
```

When it succeeds, `account.activation.status` becomes `active` (`method: "domain"`) and held monitoring starts.

## Fair use {#fair-use}

Checkbox is free to start, with no plan limits on compliance features. Fair-use limits apply: 25 active sites per
account and mode, 300 API requests per minute per account and mode (`RateLimit-*` headers; `429 rate_limit_exceeded`
with `Retry-After`), 16 webhook endpoints per mode, and per-route limits on scans and evaluations. Ask
[support@checkbox.site](mailto:support@checkbox.site) to raise them.