Badge specification

The OpenAuthCert badge schema is versioned alongside the registry. The current schema (schema-v1.json) defines the structure every badge must follow.

Schema highlights

• Title: OpenAuthCert Badge
• Required fields: vendor, application, version, badge_type, status, issued_at, expires_at, digital_signature
• Badge types: free-sso-idp, free-ldap-support, free-oidc-support, free-saml-support, multi-idp-ready
• Status values: certified, pending, revoked, denied

You can review the full JSON Schema on GitHub: schema-v1.json.

Canonicalization

Badges are signed using a deterministic JSON serialization:

• Keys are sorted lexicographically at every depth.
• Objects exclude the digital_signature field before signing.
• Arrays retain their original order.
• Numbers and booleans use standard JSON encoding with no extra whitespace.

This canonical form is what the verify tool reconstructs before checking the signature.

Digital signatures

• The initiative publishes a global Ed25519 public key at /public_key.pem.
• Vendors sign badge payloads with the corresponding private key after review.
• The digital_signature field stores a Base64-encoded Ed25519 signature over the canonical payload.
• Revocations require a new signature after updating status and revoked_at.

For implementation details, see the oac CLI and the shared @openauthcert/core canonicalization.