Owner credentials belong in your secret manager, separate from public proof tokens and operation status.
Use the private registration receipt and the artifact identifier from your verified operation. Delivery expires after 15 minutes and can be consumed once. Keep the key in your secret manager; it is never returned by operation-status tools.
Keep this separate from the public DNS or HTTP proof token.
If delivery expired, was already consumed, or its response was lost, use fresh ownership proof to recover a new key. Existing keys are never silently replayed or rotated here.