TroubleshootingUpdated: 2026-10-16

Site API connection test fails

Find and fix the cause of “Test failed”: token, signature, wrong URL, redirects, timeouts, or Apache dropping the Authorization header.

Open this screen in the panel

The Site API lets SEOAsist send fixes, content and llms.txt to a site you built yourself. The Test connection button calls your site's /manifest endpoint with a signed request. If the test fails, the connection stays in Error and nothing is sent.

Symptoms

The Site API card on the site's Fix channels tab says “Test failed: …”. The text after the colon tells you why:

Error textMeaning
token rejected / unauthorized (401, 403)Your site didn't accept the token or signature
endpoint not found (is the Site API installed at this URL?) (404)There's no Site API at that URL
redirect to … (use the final API URL)The URL redirects somewhere else
timeoutThe site didn't answer within 25 seconds
non-JSON responseThe response isn't JSON (e.g. an HTML page)
unexpected manifest (spec "…")The spec field in /manifest is wrong

Fix

  1. 401 / 403: The token in the panel must match your site's SEOASIST_SITE_TOKEN environment variable exactly. Restart the site after setting the variable. If you lost the token, generate a New token; the old one stops working right away.
  2. On Apache, the server may not pass the Authorization header to PHP. Add this line to your .htaccess: SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
  3. Signature errors: The signature is HMAC-SHA256(token, "<timestamp>.<raw body>"). The body is empty for GET requests. Timestamps older than 300 seconds are rejected, so the server clock must be correct.
  4. 404: Enter the common root of the endpoints as the API base URL (e.g. https://example.com/api/seoasist). Don't add /manifest; SEOAsist appends it. After changing it, click Save URL.
  5. Redirects: The Site API must never redirect. Save the final address from the error text (e.g. with https:// or www) as the API base URL.
  6. Timeouts: Make sure the site is reachable from the public internet. Local and internal network addresses are refused. Firewalls and bot protection must not block SEOAsist's requests.
  7. Manifest: /manifest must return JSON like {"spec":"seoasist-site-api/1","capabilities":["rules","content","files"]}. List only the capabilities you actually built.
  8. Click Test connection again. Once it passes, pending rules are sent right away.
tip

The curl command on the Test tab of the developer guide sends the same signed request from your terminal. You can see the problem there before trying in the panel.

Still not working?

The test passed, so why don't the rules show on the page?

The test only checks /manifest. Applying the rules on the server while the page renders is up to your code. If the card shows “last push … rules”, the rules reached your site. Compare your code with the Site API reference.

I want to set it up from scratch. Where do I start?

Copy the Setup prompt from the card and give it to the AI coding assistant or developer working on your project. For the steps, see Site API setup.

Was this article helpful?
Didn't find what you need?
Describe the problem and our team will reply by email.
Contact us