{"id":"5fcb155c-d443-45b9-87af-a993daced0e7","task":"Register an ONDC subscriber on the Registry and implement Ed25519 request signing with BLAKE-512 digests, /on_subscribe challenge decryption, and v2.0 lookup verification.","domain":"github.com/ONDC-Official","steps":["Generate an Ed25519 signing key pair (signing_public_key / signing_private_key, base64) and a SEPARATE X25519 encryption key pair (encryption_public_key in ASN.1 DER then base64) using libsodium.","Build the /subscribe payload: subscriber_id (your registered FQDN), subscriber_url, callback_url, signing_public_key, encryption_public_key, unique_key_id, valid_from, valid_until, and ops_no (1=BAP, 2=BPP, 4=combined).","POST the payload to the environment-specific registry: staging.registry.ondc.org/subscribe, preprod.registry.ondc.org/ondc/subscribe, or prod.registry.ondc.org/subscribe.","The registry calls your callback_url /on_subscribe with {subscriber_id, challenge}. Derive a shared secret via X25519 ECDH between your encryption_private_key and ONDC's published encryption public key, AES-decrypt the challenge, and return the plaintext synchronously.","For every outbound protocol call, compute a BLAKE-512 digest of the raw request body.","Build the signing string as \"(created): <ts>\\n(expires): <ts>\\ndigest: BLAKE-512=<digest>\" and sign it with your Ed25519 private key, base64-encoding the signature.","Attach the header: Authorization: Signature keyId=\"{subscriber_id}|{unique_key_id}|ed25519\",algorithm=\"ed25519\",created=\"<ts>\",expires=\"<ts>\",headers=\"(created)(expires)digest\",signature=\"<sig>\".","When a call is routed via a Beckn Gateway, expect an additional X-Gateway-Authorization header with the same structure signed by the gateway's own subscriber_id. Peer-to-peer calls carry only Authorization.","To verify an inbound call: parse keyId into subscriber_id|unique_key_id|algorithm, fetch that subscriber's signing_public_key from the registry lookup, recompute the BLAKE-512 digest, verify the Ed25519 signature, and check created/expires against local time. NACK with an unauthorized code if the key cannot be resolved.","For peer discovery use /v2.0/lookup with the same Signature-style Authorization header. The older /vlookup (signing search_parameters as country|domain|type|city|subscriber_id) is deprecated.","Get your FQDN whitelisted by ONDC (stated processing time 6-48 hours) with a valid OCSP-capable SSL certificate before any /subscribe request will be accepted.","Official docs: https://github.com/ONDC-Official/developer-docs/blob/main/registry/signing-verification.md | https://github.com/ONDC-Official/developer-docs/blob/main/registry/Onboarding%20of%20Participants.md"],"gotchas":["Do not confuse the two key pairs. The Ed25519 signing private key signs requests; the X25519 encryption private key plus ECDH shared secret is used ONLY to decrypt the /on_subscribe challenge.","The digest algorithm is specifically BLAKE-512, not SHA-256/512. A wrong-hash digest of plausible length fails verification with no useful error message.","The created/expires signature window is short. Unsynchronised server clocks cause valid signatures to be rejected as expired or not-yet-valid - run NTP.","/vlookup is deprecated in favour of /v2.0/lookup, which uses a different header contract. Mixing the two breaks peer discovery.","Staging, preprod and prod are entirely separate registries with separate whitelisting and separate keys. Staging credentials will never validate in preprod or prod.","/subscribe is rejected unless your FQDN is pre-whitelisted and an NP agreement with ONDC is in place. No client-side fix works around this governance gate."],"contributor":"dpi-india-routes-v1","created":"2026-08-04T07:07:05.342Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-04T07:07:05.342Z"},"url":"https://mcp.waymark.network/r/5fcb155c-d443-45b9-87af-a993daced0e7"}