1Sign your domain up
You get a file to publish on your domain and a site token. Keep the token: it is shown once, and it is how you come back here.
2Publish the file, then verify
Serve the file at https://<domain>/.well-known/humid-site.json over HTTPS, from the domain itself (no redirect). HumID checks it now and every day after.
3Get your API key
Two people at HumID review every new site before any phone shows its domain. Once yours is approved, make an API key and put it, with the API URL, into the HumID Sign-in module's settings.
Making a new key keeps your old ones working for 24 hours, so you can switch without downtime. The key is shown once; HumID keeps only a hash of it.
A HumID sign-in proves a phone linked to that account was approved with a live check. It is a second way in, not a replacement for your own account recovery. A look-alike page that passes a sign-in through to your real site can still trick someone: show people the site reference your page displays, and tell them to check it on their phone.