Prove you own your domain

Enter your site address as a bare host name — storefront.example. A scheme, a trailing slash and a trailing dot are cleaned up for you. A port, an @, or anything that is not a host name is refused, because that value is published verbatim inside your structured data and it has to name your site and nothing else.

Geoffy gives you a verification token. Serve it at:

https://yourdomain.com/.well-known/geoffy-site-verification.txt

Put the file at public/.well-known/geoffy-site-verification.txt, then run the check in Geoffy.

Nothing works until this passes

Until ownership is verified, every artifact endpoint returns 404 and nothing publishes. This is deliberate: without it, anyone who can type a domain name into a form could have Geoffy host content attributed to it.

This check runs in the opposite direction to everything else

Every other request in these guides is your site fetching Geoffy. This one is Geoffy fetching your site. So it needs an address Geoffy can actually reach: https, on the default port, on a public host name. A local address is refused rather than attempted.

That gives you two paths, and the first is the normal one:

• Your site is already live. Deploy the one verification file and run the check. Nothing else has to ship, and you need no tunnel. You can then develop locally against that same site key for as long as you like.
• Your site is not live yet. Put a temporary public https address in front of your dev server:

cloudflared tunnel --config /dev/null --url http://localhost:3000

Enter the tunnel's host name as your site address, verify, and carry on. Swap it for your real domain before you go live — the address is published verbatim inside your structured data.

--config is not optional

If you have ever configured a named tunnel on that machine, a leftover ~/.cloudflared/config.yml is loaded even when you pass --url, and a quick tunnel's random host name matches none of its rules. The tunnel comes up, and every request is answered with an empty 404 that looks exactly like a tunnel that never started.

Run with --loglevel debug and read the ingress rule it picked. ingressRule=1 rather than 0 is the whole diagnosis.

Also check your canonical URLs

Geoffy publishes its structured data against your canonical URL. If that URL denies being the product, the data points at a page that contradicts it, and Geoffy refuses to publish rather than emit it.

Open any product page’s source and look for <link rel="canonical">. It must point at that product, not at your home page.

The App Router trap

A missing generateMetadata on your product page — whatever its path — means every product page inherits the layout’s metadata. So all of them tell search engines they are the home page, and every product fails with canonical_broken. One missing export, one broken catalogue.

app/[lang]/products/[handle]/page.tsx

export async function generateMetadata({ params }) {
  const { lang, handle } = await params;
  return {
    alternates: {
      canonical: `https://yourdomain.com/${lang}/products/${handle}`,
    },
  };
}

Pass that same value as canonicalUrl to <GeoffyProduct> rather than building it twice.