In an #IndieAuth flow, what are some authorization endpoint strategies (besides #RelMeAuth) for attesting that a person "owns" the domain they're authenticating with?
Some ideas in decreasing order of complexity: TXT DNS record, an HTTP header, a `<link>` element of some kind…
• https://indieauth.spec.indieweb.org
• https://microformats.org/wiki/RelMeAuth
indieauth.spec.indieweb.orgIndieAuthIndieAuth is an identity layer on top of OAuth 2.0 [RFC6749], primarily used to obtain
an OAuth 2.0 Bearer Token [RFC6750] for use by [Micropub] clients. End-Users
and Clients are all represented by URLs. IndieAuth enables Clients to
verify the identity of an End-User, as well as to obtain an access
token that can be used to access resources under the control of the End-User.
Jason Garber @jgarber@mastodon.cc
Apologies for the tag-in, but you might be the only person I know on here who has any ideas on my post above.