How do I add domain validation?

I've created https://blogstreak.com recently to add claps and comment for my Hugo powered static site.

I don't want my user to signup first and then start implement the code into their website. I've made the recent changes in my site now they can start testing it in locally and as well as in production without signing up.

Now my question is how do I validate the domain? Let's say any one can add their domain in blogstreak and access the core features like history of claps and moderation system for comments.

To prevent that I've this idea but I want to how you do it.?

First I will generate some random secret code for each website in their profile and ask them to add that code inside their added domain html meta tag. And one bot will check those every minute.

I know that this steps add some friction to onboard the new user but I don't have any idea about how to validate those domain that belong to the mentioned domain email.