IndexNow Key Generator

Generate a spec-compliant IndexNow key, download the file you need to publish, and check it resolves — free, no account.

32 hex characters, well inside the 8–128 the spec allows

The key is not a secret

This trips people up constantly. An IndexNow key looks like an API key, so the instinct is to hide it in an environment variable. But the protocol only works if search engines can read it — you publish it at https://yourdomain.com/{key}.txt and anyone can fetch it.

It is a proof of ownership, not a credential. It grants no access to your site, your account or your data. The worst anyone can do holding your key is notify search engines about your own URLs.

What the spec actually requires

Length8 to 128 characters.
Character seta-z, A-Z, 0-9 and dashes. Nothing else — underscores and dots are rejected.
File name{key}.txt — the file is named after the key.
File contentsThe key, and nothing else. A trailing newline is fine; anything else fails validation.
LocationYour host root by default, or anywhere on the same host if you pass keyLocation.
Content typetext/plain. Most engines tolerate others, but serving it correctly removes a variable.

Generating one yourself

There is nothing special about the value — it just has to be unguessable and match the character set. Any of these produce a valid key: 

# macOS / Linux
openssl rand -hex 16

# PowerShell
-join ((48..57) + (97..102) | Get-Random -Count 32 | % {[char]$_})

# Node
node -e "console.log(require('crypto').randomBytes(16).toString('hex'))"

# This site's API
curl https://instantindexnow.com/api/generate-key

After you publish it

Verify the file actually resolves before you rely on it. This matters more than it sounds: the global IndexNow endpoint, Bing and Yandex all return 202 Accepted for a key that was never published, then discard the submission later without telling you.

Check your key file Submit URLs

Frequently asked questions

What is an IndexNow key, exactly?
A string of 8 to 128 characters using only letters, numbers and dashes. It is not a password or a credential — the protocol requires you to publish it in a world-readable file on your own domain. Its only job is to prove you control the host you are submitting URLs for. Anyone can read it, and that is by design.

Do I need to keep it secret?
No, and you cannot. The key must be publicly readable at https://yourdomain.com/{key}.txt or search engines cannot validate it. It grants no access to anything — the worst someone can do with your key is submit your own URLs to search engines on your behalf.

Can I use the same key for several domains?
Yes. The key file has to exist on each host you submit for, but the value itself can be shared. Many people prefer one key per host so a compromised or rotated key affects only one site, but the protocol does not require it.

How do I change my key later?
Publish the new key file first, confirm it resolves, then start submitting with the new key. Leave the old file in place for a while — engines that queued a submission against the old key will still validate it asynchronously, and removing the file too early causes those to be discarded.

Does the key have to be a GUID or hexadecimal?
No. The specification allows any 8 to 128 characters from a-z, A-Z, 0-9 and dashes. Microsoft examples often show a 32-character hexadecimal string, which is what this generator produces, but that is convention rather than requirement.

Where does the file go if I cannot write to my domain root?
You can host it elsewhere on the same host and pass that URL as keyLocation when submitting. The file must still be on exactly the host whose URLs you submit — you cannot host the key on one domain and submit URLs for another.