{"slug": "openai-doesn-t-cryptographically-sign-its-api-responses", "title": "OpenAI doesn't cryptographically sign its API responses", "summary": "OpenAI does not cryptographically sign its Responses API outputs, leaving users unable to independently prove to third parties that a specific text was returned by the API, according to a user inquiry posted in an OpenAI community forum. The user noted that a `resp_...` response ID can only be retrieved by an authorized client of the originating project, so sharing the response ID, returned JSON, a screenshot, or a hash of the output still requires the recipient to trust the sender. The user proposed either an OpenAI-hosted read-only verification link at a URL such as `openai.com/verify/response/...` or a cryptographic signature over the response ID and input/output hashes verifiable with an OpenAI public key, citing benchmarks, research, competitions, audits, and compliance as use cases.", "body_md": "# \n\nHi everyone,\n\nI’m currently looking for a way to prove to a third party that a specific text was actually returned by the OpenAI Responses API.\n\nI initially thought the `resp_...` ID might be enough for this. Since the response can be stored and retrieved through the API, it seems like the necessary information already exists on OpenAI’s side.\n\nThe problem is that only an authorized client of the originating project can retrieve that response.\n\nSo if I give someone:\n\n- \nthe response ID,\n- \nthe returned JSON,\n- \na screenshot,\n- \nor a hash of the output,\n\nthey still have to trust me.\n\nI could theoretically modify the JSON, fake the screenshot, or create a hash for a completely different text.\n\nWhat I would like is a way for someone who does **not** have access to my OpenAI project to independently verify:\n\n“Yes, OpenAI actually returned this exact output.”\n\nThe simplest solution I can imagine would be something similar to ChatGPT shared links, but for API responses.\n\nFor example, I could explicitly create a read-only verification link for a stored response:\n\n`openai.com/verify/response/...`\n\nOpening it could show something like:\n\n- \nthe response ID\n- \nthe generated output\n- \noptionally the input\n- \nmodel/model version\n- \ntimestamp\n\nThe important part would be that the information is served directly by OpenAI and cannot be changed by me.\n\nIt wouldn’t have to expose my project, API key, usage information, or any other responses. Ideally, I could choose what is included and revoke the link later.\n\nAnother solution could be a cryptographic signature returned with the response. If OpenAI signed the response ID and hashes of the input/output with a private key, anyone could verify it using an OpenAI public key without needing API access at all.\n\nFor my use case, though, even a simple OpenAI-hosted verification link would already solve the problem.\n\nI can imagine this being useful for benchmarks, research, competitions, audits, compliance, or any application where someone needs to demonstrate that an AI result genuinely came from OpenAI.\n\nOr am I missing an existing way to accomplish this?\n\nAnd if not, would other API users find a public verification/share mechanism for `resp_...` responses useful as well?", "url": "https://wpnews.pro/news/openai-doesn-t-cryptographically-sign-its-api-responses", "canonical_source": "https://community.openai.com/t/feature-request-a-way-to-publicly-verify-responses-api-outputs/1388452", "published_at": "2026-09-21 19:57:54+00:00", "updated_at": "2026-09-21 20:24:38.349333+00:00", "lang": "en", "topics": ["ai-products", "artificial-intelligence", "ai-policy"], "entities": ["OpenAI", "OpenAI Responses API", "ChatGPT"], "alternates": {"html": "https://wpnews.pro/news/openai-doesn-t-cryptographically-sign-its-api-responses", "markdown": "https://wpnews.pro/news/openai-doesn-t-cryptographically-sign-its-api-responses.md", "text": "https://wpnews.pro/news/openai-doesn-t-cryptographically-sign-its-api-responses.txt", "jsonld": "https://wpnews.pro/news/openai-doesn-t-cryptographically-sign-its-api-responses.jsonld"}}