OpenPubkey review
A focused protocol for binding signing keys to OIDC identities across messages and artifacts.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
OpenPubkey is an open-source protocol and reference implementation for developers and organizations that need identity-aware signing or verification workflows. It binds user- or workload-generated public keys to OpenID Connect identities, then creates PK Tokens containing identity and key-binding claims. The project supports signing and verification for messages or artifacts across Windows, macOS, and Linux, with Google and GitHub OpenID Providers supported directly.
Its main strength is the connection between identity and ephemeral cryptographic keys. OpenPubkey generates identity-held key pairs, uses GQ signatures to help prevent token replay, and lets users or workloads sign messages with identity-bound keys. Integrations include Google, GitHub, Azure/Microsoft, Okta, OneLogin, and Keycloak, giving teams several identity-provider paths to consider. This makes it a focused fit for systems where verification should connect a signature to an OIDC identity rather than only to a standalone key.
OpenPubkey is narrower than conventional code-signing software. The published positioning does not include verified certificates, timestamping, CI/CD signing, or a conventional end-to-end code-signing workflow. Its own description presents it as complementary to artifact-signing systems such as Sigstore, rather than a replacement for them. Choose OpenPubkey when identity-bound signing for messages and artifacts is the central requirement and open-source tooling is preferred. Choose another product when certificate-based trust, timestamping, or integrated CI/CD artifact signing is required.
OpenPubkey pros and cons
- Where it wins
- Binds public keys to Google and GitHub OIDC identities
- Supports both user and workload identities
- Runs on Windows, macOS, and Linux
- Where it doesn't
- Does not provide verified certificates
- Does not include timestamping or CI/CD signing
- Not an end-to-end replacement for artifact-signing systems
OpenPubkey fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update