Become a vendor

The path from "I want to publish on market.opvs.ai" to "my first skill is live and workspaces can install it."

  You write to OPVS ──▶ OPVS approves your vendor scope
                              │
              ┌───────────────┴────────────────┐
              ▼                                ▼
     signing certificate               partner key
   (signs your package bytes)     (authenticates your publish call)
              └───────────────┬────────────────┘
                              ▼
          author ──▶ preflight ──▶ publish + security review ──▶ live

Who publishes today

The marketplace has three kinds of vendor:

The registry is live: you can see every published package, and its vendor, with a public call:

curl -s "https://market.opvs.ai/api/v1/registry/packages?limit=200" \
  | python3 -c "import sys,json; from collections import Counter; print(Counter(p['vendor_name'] for p in json.load(sys.stdin)['items']))"

How to apply

Anyone can apply, including independent developers. A sign-up form is coming at opvs.ai/vendors. Until it is live, write to vendors@opvs.ai with the subject "Vendor application" and include:

• The scope you want, for example @acme. It must be lowercase and not already taken.

• A primary contact email. Your one-time signing-key link goes here. Use a real person or a shared team inbox, never a no-reply address.

• An incident contact. Used for revocations, security issues and failed reviews.

• One paragraph on what you will publish.

• Your GitHub organisation or username, so OPVS knows where your source lives.

Publishing is free today, and paid skills are being worked on. OPVS reviews each application. Once you are approved, setting up your credentials takes minutes.

What you get

1. A vendor scope registered on market.opvs.ai. Only you can publish under it; you cannot publish under anyone else's.

2. A signing certificate: an ed25519 key pair. OPVS keeps the public half and sends you the private half once, by a one-time link. See Your signing certificate.

3. A partner key: a secret that authenticates your publish calls to the registry. See Partner keys.

The certificate signs the package bytes. The partner key authenticates the request that uploads them. You need both to publish.

Your first week

Day one: set up. Put the signing key and the partner key in your CI secrets, then install the CLI from public npm:

npm install -g @opvs-ai/skills
opvs-skills --version

Days two and three: author. Pick one capability you already run (an API, a tool you maintain) and describe it as a skill. Start with Skill anatomy.

Days four and five: publish. Run the preflight, then sign and publish. The registry runs an automated security review on every publish. If a check fails you get the findings back, fix them and publish again.

What OPVS still does by hand

• Approving vendors. Every application is reviewed before your scope is created.

• Minting certificates and partner keys. You ask, OPVS mints, you receive each secret once.

• Some admin views (for example the marketing overlay and the standalone security review) are run by OPVS for you today. Each page says so where it applies.

If something goes wrong later

• Signing key compromised: OPVS revokes the certificate, mints a new one, and you re-sign and republish. See Rotate a credential.

• Partner key leaked: OPVS revokes it immediately and mints a new one.

• A published version is broken: move workspaces to a fix with a required upgrade, or revoke the version.

Next

Your signing certificate.