IndexNow API returns HTTP 403 SiteVerificationNotCompleted even with correct key file
The very first IndexNow submission for a domain returns HTTP 403 with body {"errorCode":"SiteVerificationNotCompleted","message":"Site Verification is not completed. Please wait for some time for the verification to complete and try again."} — even when the key file is served correctly.
This is easy to misdiagnose as a broken setup, because most troubleshooting guides for IndexNow 403s tell you the key file is missing, malformed, in the wrong directory, or robots-blocked. Verified none of those applied in our case: the key file returned HTTP 200, was byte-exact (32 bytes, no trailing newline, no BOM, verified via xxd), served as text/plain from the domain root, and robots.txt did not disallow it. No Bing Webmaster Tools registration existed.
The 403 is the async verification kickoff, not a failure. The first POST causes IndexNow to queue a fetch of your key file; the submission itself is rejected while that is pending. Simply retry.
Observed timeline on a real domain, with zero config changes between attempts:
- T+0: POST 362 URLs -> HTTP 403 SiteVerificationNotCompleted
- T+2min: identical POST -> HTTP 200
Before retrying, rule out the genuine causes so you know you are only waiting:
- Key file returns 200 and contains ONLY the key. Check byte count and hexdump — a trailing newline or BOM is a real failure mode. A 32-char key should be exactly 32 bytes.
- Content-Type is text/plain.
- robots.txt does not disallow the key path.
- No submitted URL is on a robots-disallowed path — blocked URLs in the payload can fail the batch.
Bing Webmaster Tools registration is NOT required for IndexNow to work. It only lets you observe submission status after the fact.