OpenAI doesn't cryptographically sign its API responses

OpenAI does not cryptographically sign its Responses API outputs, leaving users unable to independently prove to third parties that a specific text was returned by the API, according to a user inquiry posted in an OpenAI community forum. The user noted that a `resp_...` response ID can only be retrieved by an authorized client of the originating project, so sharing the response ID, returned JSON, a screenshot, or a hash of the output still requires the recipient to trust the sender. The user proposed either an OpenAI-hosted read-only verification link at a URL such as `openai.com/verify/response/...` or a cryptographic signature over the response ID and input/output hashes verifiable with an OpenAI public key, citing benchmarks, research, competitions, audits, and compliance as use cases.

Hi everyone, I’m currently looking for a way to prove to a third party that a specific text was actually returned by the OpenAI Responses API. I initially thought the resp ... ID might be enough for this. Since the response can be stored and retrieved through the API, it seems like the necessary information already exists on OpenAI’s side. The problem is that only an authorized client of the originating project can retrieve that response. So if I give someone: - the response ID, - the returned JSON, - a screenshot, - or a hash of the output, they still have to trust me. I could theoretically modify the JSON, fake the screenshot, or create a hash for a completely different text. What I would like is a way for someone who does not have access to my OpenAI project to independently verify: “Yes, OpenAI actually returned this exact output.” The simplest solution I can imagine would be something similar to ChatGPT shared links, but for API responses. For example, I could explicitly create a read-only verification link for a stored response: openai.com/verify/response/... Opening it could show something like: - the response ID - the generated output - optionally the input - model/model version - timestamp The important part would be that the information is served directly by OpenAI and cannot be changed by me. It wouldn’t have to expose my project, API key, usage information, or any other responses. Ideally, I could choose what is included and revoke the link later. Another solution could be a cryptographic signature returned with the response. If OpenAI signed the response ID and hashes of the input/output with a private key, anyone could verify it using an OpenAI public key without needing API access at all. For my use case, though, even a simple OpenAI-hosted verification link would already solve the problem. I can imagine this being useful for benchmarks, research, competitions, audits, compliance, or any application where someone needs to demonstrate that an AI result genuinely came from OpenAI. Or am I missing an existing way to accomplish this? And if not, would other API users find a public verification/share mechanism for resp ... responses useful as well?