OpenPubkey
OpenPubkey: A focused protocol for binding signing keys to OIDC identities across messages and artifacts. Ranked #26 of 28 in Code Signing Software by our editors (6.3/10); pricing: Free plan; best for identity-bound signing for messages and artifacts.
At a glance
- Editor score6.3 / 10
- PricingFree plan
- Best forIdentity-bound signing for messages and artifacts
- Free planYes
- Paid fromFree
- Supported targetsmessages and artifacts
- Facts checked20 Sep 2026
Where it wins
- Binds public keys to Google and GitHub OIDC identities
- Supports both user and workload identities
- Runs on Windows, macOS, and Linux
Where it doesn't
- Does not provide verified certificates
- Does not include timestamping or CI/CD signing
- Not an end-to-end replacement for artifact-signing systems
Our verdict on OpenPubkey
OpenPubkey is an open-source protocol and reference implementation for developers and organizations that need identity-aware signing or verification workflows. It binds user- or workload-generated public keys to OpenID Connect identities, then creates PK Tokens containing identity and key-binding claims. The project supports signing and verification for messages or artifacts across Windows, macOS, and Linux, with Google and GitHub OpenID Providers supported directly.
Its main strength is the connection between identity and ephemeral cryptographic keys. OpenPubkey generates identity-held key pairs, uses GQ signatures to help prevent token replay, and lets users or workloads sign messages with identity-bound keys. Integrations include Google, GitHub, Azure/Microsoft, Okta, OneLogin, and Keycloak, giving teams several identity-provider paths to consider. This makes it a focused fit for systems where verification should connect a signature to an OIDC identity rather than only to a standalone key.
OpenPubkey is narrower than conventional code-signing software. The published positioning does not include verified certificates, timestamping, CI/CD signing, or a conventional end-to-end code-signing workflow. Its own description presents it as complementary to artifact-signing systems such as Sigstore, rather than a replacement for them. Choose OpenPubkey when identity-bound signing for messages and artifacts is the central requirement and open-source tooling is preferred. Choose another product when certificate-based trust, timestamping, or integrated CI/CD artifact signing is required.
Your product? Our editors can test OpenPubkey in depth and publish a review, labelled as paid · from $149/mo →
OpenPubkey pricing
OpenPubkey fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| Supported targets | messages and artifacts |
| Certificate provided | No |
| Cloud signing | Not verified |
| HSM key protection | Not verified |
| Trusted timestamping | Not verified |
| CI/CD signing | Not verified |
| Approval workflows | Not verified |
| Deployment | Self-hosted |
| Platforms | Windows, macOS, Linux |
| Support | Community, Docs |
| Built for | Solo, Small business, Mid-market, Enterprise (editorial estimate) |
| Integrations | 6 integrations: Google, GitHub, Azure/Microsoft, Okta, OneLogin, Keycloak |
| Pricing | Free plan |
| Website | github.com |
| Facts checked | 20 Sep 2026 |
OpenPubkey integrations
OpenPubkey lists 6 integrations on its own site.
- GitHub
- Azure/Microsoft
- Okta
- OneLogin
- Keycloak
Alternatives to OpenPubkey
- SignPathGoverned signing for teams shipping software across diverse artifact formats.9.4
- DigiCert Software Trust ManagerEnterprise signing governance for artifacts, approvals, keys, and release pipelines.9.2
- SignServerA flexible open-source signing server with enterprise controls for production deployments.9.0
See all OpenPubkey alternatives →
Used OpenPubkey? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used OpenPubkey for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
OpenPubkey is listed in our Code Signing Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/openpubkey/"><img src="https://www.itechguides.com/best/badge/openpubkey.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update