Site API connection test fails
Find and fix the cause of “Test failed”: token, signature, wrong URL, redirects, timeouts, or Apache dropping the Authorization header.
Open this screen in the panelThe Site API lets SEOAsist send fixes, content and llms.txt to a site you built yourself. The Test connection button calls your site's /manifest endpoint with a signed request. If the test fails, the connection stays in Error and nothing is sent.
Symptoms
The Site API card on the site's Fix channels tab says “Test failed: …”. The text after the colon tells you why:
| Error text | Meaning |
|---|---|
token rejected / unauthorized (401, 403) | Your site didn't accept the token or signature |
endpoint not found (is the Site API installed at this URL?) (404) | There's no Site API at that URL |
redirect to … (use the final API URL) | The URL redirects somewhere else |
timeout | The site didn't answer within 25 seconds |
non-JSON response | The response isn't JSON (e.g. an HTML page) |
unexpected manifest (spec "…") | The spec field in /manifest is wrong |
Fix
- 401 / 403: The token in the panel must match your site's
SEOASIST_SITE_TOKENenvironment variable exactly. Restart the site after setting the variable. If you lost the token, generate a New token; the old one stops working right away. - On Apache, the server may not pass the
Authorizationheader to PHP. Add this line to your.htaccess:SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1 - Signature errors: The signature is
HMAC-SHA256(token, "<timestamp>.<raw body>"). The body is empty for GET requests. Timestamps older than 300 seconds are rejected, so the server clock must be correct. - 404: Enter the common root of the endpoints as the API base URL (e.g.
https://example.com/api/seoasist). Don't add/manifest; SEOAsist appends it. After changing it, click Save URL. - Redirects: The Site API must never redirect. Save the final address from the error text (e.g. with
https://orwww) as the API base URL. - Timeouts: Make sure the site is reachable from the public internet. Local and internal network addresses are refused. Firewalls and bot protection must not block SEOAsist's requests.
- Manifest:
/manifestmust return JSON like{"spec":"seoasist-site-api/1","capabilities":["rules","content","files"]}. List only the capabilities you actually built. - Click Test connection again. Once it passes, pending rules are sent right away.
The curl command on the Test tab of the developer guide sends the same signed request from your terminal. You can see the problem there before trying in the panel.
Still not working?
The test passed, so why don't the rules show on the page?
The test only checks /manifest. Applying the rules on the server while the page renders is up to your code. If the card shows “last push … rules”, the rules reached your site. Compare your code with the Site API reference.
I want to set it up from scratch. Where do I start?
Copy the Setup prompt from the card and give it to the AI coding assistant or developer working on your project. For the steps, see Site API setup.
Related articles
- Connect a custom-built site with the SEOAsist Site APIFor sites that don't run on WordPress or Shopify: install and connect the Site API so SEO fixes, blog posts and llms.txt are applied to your site automatically, server-side.
- Site API reference (seoasist-site-api/1)The complete SEOAsist Site API spec: authentication and HMAC signing, the four endpoints, rule kinds and a summary of the ready-made Next.js/PHP samples.
- Accept audit issues as intentional and fix them automaticallyHow to mark issues you left on purpose as Intentional, undo that, and fix issues automatically with rules or a GitHub pull request.