[jph]

Thanks for the reply. It turns out the current JSON file approach can't prove ownership of the project nor the domain, so perhaps there's a gap in my understanding or your team's understanding...? Feel free to contact me about this a because I believe in your mission: [e-mail]

Some options that I use successfully with other donations services and funding services...

- A unique token per project published in a project file

- A unique token per domain published in a DNS TXT record

- A verification of the project's existing setup, such as using GitHub API access or OAuth

- A forwarding to the project's existing funding link, such as using a project's GitHub sponsors link

- A heuristic with the person's existing payment links, such as contact info being identical on GitHub and Venmo

- A challenge/response, such as verifying a small random payment

- A dedicated KYC process such as with a background checking service.