# Verified hosts

The proxy calls only hosts you've proved you control. Owners and admins add them on the project's Try it page, on Pro and up.

### 1. Add the host

Enter its name, such as `api.example.com`, or an `https` URL on it. Only the host is kept. A host is refused if it's an IP address, has a port or a user name, or isn't a public name, and so are latitude10.tech and Cloudflare's own names.

### 2. Put the token on it

The Try it page shows the project's token, which starts with `l10v_`. Put it in one of two places:

- a file at `/.well-known/latitude10-verify.txt` on the host, served over `https` with a `200` and holding only the token;
- a DNS TXT record at `_latitude10.<host>` whose value is the token.

The file is tried first, without following redirects, then the TXT record. The token isn't a secret: it only proves control.

### 3. Check it

Choose **Check now** beside the host. The page says which proof passed.

## Checked again

A proof is checked again when it's 7 days old, at the proxy's next call to that host. If that check fails, calls to the host are refused until you choose **Check now** again and it passes, so leave the file or the record in place.

## Hosts verified for MCP

The file holds one token per project, so a host your project's hosted MCP server has verified, and that isn't due a check, counts for the proxy too.

## How many

The number of hosts per project depends on your plan: see [Plans and limits](../get-started/plans-and-limits#api-client).

## Where this comes from

- `app/reference/_lib/playground/hosts.ts`
- `app/hosted-mcp/_lib/upstream.ts`
- `app/workspace/[ws]/[project]/playground/page.tsx`