OpenProof adds ECDSA signatures to API responses so any client can verify data integrity — provably, without trusting the transport layer.
{
"symbol": "ETH",
"price": 2081.41,
"change_24h": -4.71
}
{
"call_id": "op_abc123def456",
"endpoint": "/v1/price/ETH",
"payload_hash": "sha256:9f86d0...",
"timestamp": 1711234567,
"signer": "0x41A024...",
"signature": "0x3ad7f1..."
}
Four deterministic steps. No certificate authorities. No trusted intermediaries.
Response data is serialized with sorted keys and no whitespace — ensuring identical payloads always produce identical hashes.
A SHA-256 hash is computed. Any modification — even a single character — produces a completely different hash.
The hash is signed with secp256k1 (Ethereum-compatible). The signer's public address is included in the envelope.
Anyone can recover the signer address from the signature and compare it to the declared signer. No API call required.
Every decision an AI agent makes is only as trustworthy as the data it received.
Any modification to response data — by a proxy, CDN, or man-in-the-middle — invalidates the signature immediately.
Every response carries a unique call_id and timestamp. Duplicate responses and stale data are automatically rejected.
Signing is in-process with no external calls. Adds less than 1ms to any response time.
Reference implementations in Python and TypeScript. Any language with ECDSA support can implement OpenProof.
Every signed response is a cryptographic receipt. Agents can prove exactly what data informed each decision.
Uses Ethereum-compatible ECDSA. Any wallet address is a valid signing identity. No certificate authorities.
Install the verification library. Works with any OpenProof-compliant API.
APIs that include a verified _trust envelope on every response.
OpenProof is MIT licensed and free for any use. Implement it in your API in under an hour.
Tell us how you are using OpenProof, report an issue, or suggest a feature. We read every message.