Partner keys and publish credentials
On this page
A partner key is a long-lived secret OPVS issues to your vendor. You send it with every write call to the registry. The registry checks it and pins the call to your vendor scope.
What it looks like
opvs_pk_a1b2c3d4_<secret body>
└──┬──┘ └──┬───┘ └─────┬─────┘
tag prefix secretOPVS stores the prefix in clear text (to find the key fast) and only a bcrypt hash of the secret body. Nobody at OPVS can read your key back.
How you get one
OPVS mints it for you and shows the raw key once, passed to you through a secure channel. To ask for one, write to vendors@opvs.ai with:
A label for where it will live, for example "acme production publish CI".
Whether it is a first key or a replacement.
If you lose it, the only recovery is a new key plus revoking the old one. See Rotate a credential.
What it can do
Every call made with your partner key is scoped to your vendor.
You can: publish new versions under @yourvendor/*, revoke or flag a required upgrade on your own packages, upload your bundles, and run harvest on workspaces that installed your packages.
You cannot: publish into another vendor's scope (refused with a scope mismatch), touch another vendor's packages, mint or revoke keys, or call the admin endpoints. OPVS staff use a separate platform key for those; you will never need it.
Where to store it
OK CI secret (masked + protected) e.g. OPVS_PARTNER_KEY
OK a secrets manager (Vault, AWS SM, 1Password)
OK a gitignored .env file outside the repository, for local work
NO source code, git history, chat, email, CI logsA key that was committed, even for a moment, is compromised. Ask for a new one and have the old one revoked.
The credentials a publish needs
What | Where it comes from | How the CLI takes it |
|---|---|---|
Partner key | this page |
|
Signing key |
| |
Registry address | always |
|
You do not need an npm account or npm token. The CLI uploads your signed bundle straight to the marketplace; nothing is published to npm.
On the wire
The CLI does this for you. This is what it sends:
# 1. ask for an upload URL for the bundle
curl -X POST "https://market.opvs.ai/api/v1/bundles/upload-url" \
-H "X-Admin-Key: $OPVS_PARTNER_KEY" -H "Content-Type: application/json" -d @upload-request.json
# 2. PUT the signed tarball to that URL, then register the version
curl -X POST "https://market.opvs.ai/api/v1/registry/packages" \
-H "X-Admin-Key: $OPVS_PARTNER_KEY" -H "Content-Type: application/json" -d @signed-manifest.jsonThe header is X-Admin-Key and the value is your partner key. Any failure (unknown key, revoked key, wrong scope) returns 403 with a one-line reason, and nothing is published.
Status | Meaning | What to do |
|---|---|---|
| key missing, unknown or revoked | check the variable is set; ask for a new key if it was revoked |
| the manifest's vendor is not yours | publish only under your own scope |
| the manifest or the security review refused it | see Security review |
Revocation is immediate
When a partner key is revoked, the next call with it gets 403. There is no cache window. The revoked key's record (prefix, dates, reason) is kept for audit.