# Become a vendor

Source: https://opvs.ai/docs/guides/vendors/become-a-vendor

> Who can publish on the OPVS marketplace, how to apply, and what you receive on day one.

The path from "I want to publish on `market.opvs.ai`" to "my first skill is live and workspaces can install it."

```
  You write to OPVS ──▶ OPVS approves your vendor scope
                              │
              ┌───────────────┴────────────────┐
              ▼                                ▼
     signing certificate               partner key
   (signs your package bytes)     (authenticates your publish call)
              └───────────────┬────────────────┘
                              ▼
          author ──▶ preflight ──▶ publish + security review ──▶ live
```

## Who publishes today

The marketplace has three kinds of vendor:

Kind

Scope

Status

OPVS's own teams

`@opvs-ai/*`

open

Partner companies

their own scope, for example `@di-atomic/*`, `@spideriq/*`, `@vayapin/*`

open

Independent developers

`@yourvendor/*`

**open now**

The registry is live: you can see every published package, and its vendor, with a public call:

```bash
curl -s "https://market.opvs.ai/api/v1/registry/packages?limit=200" \
  | python3 -c "import sys,json; from collections import Counter; print(Counter(p['vendor_name'] for p in json.load(sys.stdin)['items']))"
```

## How to apply

Anyone can apply, including independent developers. A sign-up form is coming at [opvs.ai/vendors](https://opvs.ai/vendors). Until it is live, write to **vendors@opvs.ai** with the subject "Vendor application" and include:

- **The scope you want**, for example `@acme`. It must be lowercase and not already taken.
- **A primary contact email.** Your one-time signing-key link goes here. Use a real person or a shared team inbox, never a no-reply address.
- **An incident contact.** Used for revocations, security issues and failed reviews.
- **One paragraph on what you will publish.**
- **Your GitHub organisation or username**, so OPVS knows where your source lives.

Publishing is free today, and paid skills are being worked on. OPVS reviews each application. Once you are approved, setting up your credentials takes minutes.

## What you get

1. **A vendor scope** registered on `market.opvs.ai`. Only you can publish under it; you cannot publish under anyone else's.
2. **A signing certificate**: an ed25519 key pair. OPVS keeps the public half and sends you the private half once, by a one-time link. See [Your signing certificate](https://opvs.ai/docs/guides/vendors/signing-certificate.md).
3. **A partner key**: a secret that authenticates your publish calls to the registry. See [Partner keys](https://opvs.ai/docs/guides/vendors/partner-keys.md).

The certificate signs the package **bytes**. The partner key authenticates the **request** that uploads them. You need both to publish.

## Your first week

**Day one: set up.** Put the signing key and the partner key in your CI secrets, then install the CLI from public npm:

```bash
npm install -g @opvs-ai/skills
opvs-skills --version
```

**Days two and three: author.** Pick one capability you already run (an API, a tool you maintain) and describe it as a skill. Start with [Skill anatomy](https://opvs.ai/docs/guides/vendors/skill-anatomy.md).

**Days four and five: publish.** Run the [preflight](https://opvs.ai/docs/guides/vendors/preflight.md), then [sign and publish](https://opvs.ai/docs/guides/vendors/publish.md). The registry runs an automated [security review](https://opvs.ai/docs/guides/vendors/security-review.md) on every publish. If a check fails you get the findings back, fix them and publish again.

## What OPVS still does by hand

- **Approving vendors.** Every application is reviewed before your scope is created.
- **Minting certificates and partner keys.** You ask, OPVS mints, you receive each secret once.
- **Some admin views** (for example the marketing overlay and the standalone security review) are run by OPVS for you today. Each page says so where it applies.

## If something goes wrong later

- **Signing key compromised:** OPVS revokes the certificate, mints a new one, and you re-sign and republish. See [Rotate a credential](https://opvs.ai/docs/guides/vendors/rotate-credentials.md).
- **Partner key leaked:** OPVS revokes it immediately and mints a new one.
- **A published version is broken:** move workspaces to a fix with a [required upgrade](https://opvs.ai/docs/guides/vendors/required-upgrades.md), or [revoke the version](https://opvs.ai/docs/guides/vendors/revoke-a-version.md).

## Next

[Your signing certificate](https://opvs.ai/docs/guides/vendors/signing-certificate.md).