If your domain is added to your Cloudflare account and having the nameservers of Cloudflare.
Also, if the A yourdomain.com and A www records at Cloudflare DNS dashboard are being cloud (proxied via Cloudflare).
Moreover, if you added an TXT record with @ symbol and in the content you have copied the value given from Facebook Business → Domains, it should be correctly added in a few minutes or less.
Maybe you are running some Firewall Rules or other security options to protect your Website which could potentially block Facebook bot that checks for that TXT record?
Have you done it this way as step-by-step instructions for a TXT record in the article below?:
It should look like this one at the DNS tab of your Cloudflare dashboard from when adding new one:
Maybe you put an old code, or a new one and tries to check one or maybe both of them?
You can keep both of them just in case until the domain verification is successfull.
If the records are , the added TXT records at your domain seems to me it would have the same effect as you actually weren’t added them at first place, due to the A www or A yourdomain.com record is (not proxied), so I guess the Facebook tool would go to your hosting DNS and ignore the Cloudflare’s DNS records.
Maybe I am wrong about this one.
Due to Squarespace, does it mean you have got an CNAME record at your Cloudflare dashboard?
Have you followed this article how to setup Squarespace with Cloudflare (depending where your domain is registered?):