Our Android app uses Sign in with Google with only openid, userinfo.email and userinfo.profile. We control the app homepage, privacy policy and terms on a hosting-provider pages.dev subdomain. URL-prefix HTML ownership was verified by an account with OAuth Config Editor permission; a different account is the existing Cloud project owner. The automated finding says the homepage is not registered to the submitter. We cannot add DNS records for the provider’s shared parent domain and do not have a separately registered domain.
For this brand-only case, can the existing project owner establish acceptable ownership using a URL-prefix HTML verification of the hosted subdomain, or is DNS Domain Property verification mandatory? If DNS verification is unavailable, is there a compliant no-cost hosted-domain route or an official clarification channel? We seek the correct process, not an exception or bypass, and do not assert that the automated finding is incorrect. We will not broaden IAM or change live OAuth callbacks merely to bypass verification.