#KartikPrabhutantek: one naive I idea I had was, when A sends a webmention to B, A could include a "secret_code" in the POST request, which B can use while using GET to verify the mention by A, then A allows access only if the secret_code matches .... ?