Run valiqai link in your repository to tie it to a site. It asks which verified domain, the address to scan (staging), and optionally production, and saves valiqai.json:

JSON

{
  "$schema": "https://www.valiqai.com/schemas/valiqai.json",
  "workspace": "northstar",
  "site": "northstar.app",
  "environments": {
    "staging": "https://staging.northstar.app",
    "production": "https://northstar.app"
  },
  "scan": { "type": "e2e", "failOn": "blocker" }
}

Commit it; it has no secrets. Then, anywhere in the repository:

valiqai scan scans staging (or the first address).
valiqai scan --env production scans another one.
--type, --fail-on and a URL on the command line still win over the file.
valiqai init writes a CI job that just runs valiqai scan, so the address lives in one place.

Editors that read the $schema line check the file and complete its fields as you type. Every address must be under site, since that's the domain whose verification covers it.

The file

Field	Required	What it holds
`$schema`	no	`https://www.valiqai.com/schemas/valiqai.json`, so editors check the file.
`workspace`	no	The workspace's slug or name. On your computer it picks which sign-in to use; in CI, `VALIQAI_API_KEY` decides.
`site`	yes	The verified domain, like `northstar.app`. Every address below must be it or a subdomain.
`environments`	yes	Addresses by name. `valiqai scan` uses `staging`, or the first one; `--env <name>` picks another.
`scan.type`	no	`e2e` or `security`. See Choose a scan.
`scan.failOn`	no	`blocker`, `high`, `medium` or `none`. See Choose what fails the build.

A command-line flag always wins over the file, and valiqai doctor points at a mistake in it, naming the field.

Verify a domain from the terminal

Verify a domain without leaving the terminal. These change the domains of the person signed in, so they need valiqai login to your personal workspace, or a personal key with Manage your domains. A team key can't change domains, since they belong to a person.

Terminal

$ valiqai domains add example.com --waitAdded example.com. Add this TXT record where your DNS is managed:   Type   TXT  Name   _valiq-site-verification  (the full name is _valiq-site-verification.example.com)  Value  valiq-site-verification=cmvf… Checking every 30 seconds for up to 10 min. Ctrl-C stops waiting.✓ example.com is verified. You can scan it and its subdomains.

Command	What it does
`valiqai domains`	Your domains: verified, pending, or needing a re-check.
`valiqai domains add <domain>`	Adds it and prints the TXT record. `--wait` checks every 30 seconds until it verifies (`--timeout`, default `10m`).
`valiqai domains verify <domain>`	Checks the record now. Exits `1`, and shows the record again, when it isn't there yet.
`valiqai domains remove <domain>`	Removes it. Scans of it are refused after. Asks first, or pass `--yes`.

The rules are the ones on the Domains page: at most one check every 30 seconds, and at most 20 domains.