Signed by your organization
Your organization signs each product with a key only you hold. Only you can publish as you.
Proof it's yours.
Every OpenPX™ product is signed by the organization that publishes it. Wherever it travels, to a marketplace, a retailer or an AI shopping assistant, anyone can verify it's authentic and hasn't been changed.
What you get
Three promises behind every product.
Verified anywhere
Anyone who receives your product can check the signature themselves. No one has to take a middleman's word for it.
A full history
Every change is recorded: what changed, who changed it, and when. The record can be added to, never quietly rewritten.
Where your data lives
Your data stays in your repositories.
Public
Released products and public listings, signed by your organization. Anyone can verify them.
Partner
Shared with one trading partner, on terms you set. Only you and that partner can read it.
Internal
Drafts, costs, supplier data and connector configuration. Private to your organization.
Data only moves outward when you say so. Confidential data never enters a public repository. If you leave, your data, its history and its signatures go with you.
How it works
Sign once. Verify everywhere.
Sign
When you publish a product, OpenPX signs it on your organization's behalf with your organization's key. The signature is unique to that exact product information.
Share
The product travels to each of your channels with its signature attached, shaped for each one but always traceable back to what you signed.
Verify
Whoever receives it checks the signature against your organization. If even one detail was changed along the way, the check fails, and they know not to trust it.
Plainly
What "verified" means, and what it doesn't.
A verified product proves
- It was published by the organization it claims to come from.
- It hasn't been changed since it was signed.
- Every earlier version is on record.
It doesn't prove
- That every detail is right. Signing proves who stands behind the data; getting it right stays the organization's job, now with its name on it.
- That a channel will accept it. Each channel still has its own rules.
Why it matters now
AI shopping assistants and marketplaces are becoming the storefront. They need to know the product information they show is genuine.
Who published this?Signed by the organization
Is it authentic?Verify the signature
Has it been changed?The check would fail
What changed before?Full history
For the technically curious
Under the hood.
You don't need any of this to use OpenPX. It's here so anyone can check how the promises above are kept.
How signing and verification work
- Signatures
- Ed25519 digital signatures, made with a key that belongs to the organization.
- What gets signed
- A canonical form of the product record (JSON, UTF-8, keys in sorted order), so the same information always produces the same signature.
- Fingerprints
- SHA-256 content hashes identify each exact version of a record.
- History
- An append-only transparency log records every change. Entries are added, never edited or removed.
- The format
- Records follow the published OpenPX schema, currently
v0.7.0at schema.openpx.org. - Status
- Developer preview. Details may change before version 1.0. Signing and verification are implemented and ship with early access: see what's available today.