We need domain ownership proof based authentication

DNS.live does this for its free web and DNS hosting [1]. All you need to do is sign any post/api call with the private key associated with the address in control of your handshake tld.

An example is on github [2][3].

[1] https://dns.live/hosting.html

[2] Server: https://github.com/dnslive/dnslive-webserv

[3] Client: https://github.com/dnslive/dnslive-webhost

There is IndieAuth, which adapts OAuth 2 to work with URLs as identities (and being OAuth, can even do authorization): https://aaronparecki.com/2018/07/07/7/oauth-for-the-open-web

https://indieauth.net/