Typically you just verify it by requesting a known name path like /allow-ddos-attacks.txt and it must contain a unique key generated for the account. Some have you add it as a special rule in /robots.txt