Prove control once, then let every deploy re-check the proof and refresh the card without anyone clicking.
Step 1
Verify proof first
Click Verify proof on the campaign. CiteFleet applies BotCentral’s own rules: an apex DNS TXT record must carry botcentral-verify=citefleet-app, or that same line must be served as plain text at /.well-known/botcentral.txt. If it fails you get the exact line to add, and nothing is sent to BotCentral.
Step 2
Generate the secret
Generate webhook secret creates a per-property secret and shows it once — copy it before leaving the page (rotate to get a new one). Paste the Payload URL and the secret into the website repo: Settings → Webhooks → Add webhook, content type application/json, events push and deployment_status.
Step 3
What a delivery does
A push to the attached branch or a successful deployment_status makes CiteFleet re-check the proof (retrying for a few minutes while the deploy lands) and then List or Refresh the card. Anything else is answered and ignored. Every delivery shows under Last delivery and in the Audit log.
Step 4
Customers you do not host
They do not need the webhook. A DNS TXT record proves control with no deploy at all; Verify proof, or autopilot while it is on, will pick it up. Any CI that is not GitHub can POST {domain} to /api/hooks/deployed with the same secret after a deploy. The webhook only makes listing immediate.