Skip to content

Why do I need to verify project ownership?⚓︎

Question⚓︎

Why do I need to verify project ownership?

How do I verify I own my project?

Answer⚓︎

Already verified projects

This answer only applies to new projects. If your namespace has already been verified previously, human review will be required to add users or transfer ownership.

We require some basic verification steps for your requested group ID to help protect both publishers and consumers of the Central Repository. For instance, no one wants to use fake components published by someone that's impersonating an organization such as org.apache or com.google. You also wouldn't want to have your own namespace squatted on by someone who does not control your DNS domain or SCM hosted project (such as Github).

We understand that verifying your project may require a few extra steps on your part, but we try to keep our verification requirements as simple as possible, and try to follow industry best practices with what we ask for.

If you own your own domain and want to register a group ID for it, we will ask that you create a DNS TXT record for your domain that contains the validation key we provided.

As an example, let's say you own the domain myjavawidget.io, and you want to register the group ID io.myjavawidget. First, open a new project request and record your ticket number which should look something like OSSRH-00000. You would then need to configure a DNS TXT record with your DNS hosting provider that contains the text "OSSRH-00000" which will allow either our automation or support staff to verify that you control the domain. Using DNS TXT records for verification is very common with other service providers (such as Google), and you can also delete the TXT record after we have completed the verification of your project.

If you are registering a group ID based on your SCM host (such as Github, Bitbucket, Gitee, etc), we will ask that you create a publicly accessible repository that is named after your verification key. This will help us verify that you control your source code repository. This repository can be deleted after we have verified your project.