Feature request: A way to publicly verify Responses API outputs

API Feedback
1

Feature request: A way to publicly verify Responses API outputs

Hi everyone,

I’m currently looking for a way to prove to a third party that a specific text was actually returned by the OpenAI Responses API.

I initially thought the resp_... ID might be enough for this. Since the response can be stored and retrieved through the API, it seems like the necessary information already exists on OpenAI’s side.

The problem is that only an authorized client of the originating project can retrieve that response.

So if I give someone:

  • the response ID,

  • the returned JSON,

  • a screenshot,

  • or a hash of the output,

they still have to trust me.

I could theoretically modify the JSON, fake the screenshot, or create a hash for a completely different text.

What I would like is a way for someone who does not have access to my OpenAI project to independently verify:

“Yes, OpenAI actually returned this exact output.”

The simplest solution I can imagine would be something similar to ChatGPT shared links, but for API responses.

For example, I could explicitly create a read-only verification link for a stored response:

openai.com/verify/response/...

Opening it could show something like:

  • the response ID

  • the generated output

  • optionally the input

  • model/model version

  • timestamp

The important part would be that the information is served directly by OpenAI and cannot be changed by me.

It wouldn’t have to expose my project, API key, usage information, or any other responses. Ideally, I could choose what is included and revoke the link later.

Another solution could be a cryptographic signature returned with the response. If OpenAI signed the response ID and hashes of the input/output with a private key, anyone could verify it using an OpenAI public key without needing API access at all.

For my use case, though, even a simple OpenAI-hosted verification link would already solve the problem.

I can imagine this being useful for benchmarks, research, competitions, audits, compliance, or any application where someone needs to demonstrate that an AI result genuinely came from OpenAI.

Or am I missing an existing way to accomplish this?

And if not, would other API users find a public verification/share mechanism for resp_... responses useful as well?

2

You are missing something: Digital signature with public key encryption.

This can be an additional attestation in an API response that is calculated upon a known plantext portion of output. Then, one does not need to employ an endpoint or a record of API requests, the only offering needed is a trustworthy channel to get the public key of the pair that the signing party had used (and that they can keep secrets as secrets).

Read page 22-26.

This is not a normal API need. You are developing a product - you can offer this service. If someone wants to interact with OpenAI, they can bypass you.

Another artifact that is interesting to supply is the logprobs results, if supported for the non-reasoning AI output you are requesting. You can provide a trace that would take more effort to fake, and shows at each token of delivered output generation the likelihood of that token having been sampled.

3

Yes, exactly — a digital signature is basically what I’m proposing as the authentication mechanism.

The important part for my use case is that this should work in a decentralized crowd project, where anyone can verify that a specific answer really came from ChatGPT/OpenAI without having to trust a central verification service.

So ideally, OpenAI would sign the response (or a hash of the relevant fields) with a private key, and publish the corresponding public key. Then anyone could verify the provenance independently.

If I signed it with my own key, people would only be verifying my claim. I’m specifically looking for OpenAI itself to be the trust anchor.

4

The only problem is in OpenAI’s own infrastructure. Thousands of inference servers across many global datacenters, some outsourced, along with other inference providers also now providing OpenAI model services. Keeping a secret is decidedly NOT putting it where there are thousands of opportunities for personnel to access it.

Then as further solution to this, you go into certificate authorities, delegation, key revocation mechanisms, etc to mitigate this exposure to scopes, adding further complexity and a chance that the digital attestation of proof might need to be revoked.

You might need to come up with a solid “why” for OpenAI: why a developer needs this, and why it would make them more money than not implementing such an idea.

If you want to look further - an output-damaging idea - you can look at Google’s SynthID, used in proprietary form on OpenAI-generated images, but which can also be used on text to watermark it by a specific alteration to the probabilities of text generation.

5

That’s a fair point about key management, although I don’t think the signing key would need to live on the inference servers themselves. The response could be signed afterwards by a separate attestation service with much tighter access controls and its own key rotation/revocation mechanism.

The main “why” for me is provenance in decentralized applications.

I’m working on the idea of a crowd-based system where anyone should be able to submit an AI response and anyone else should be able to verify independently that it really came from OpenAI without trusting the submitter or a central verification service.

I think that could be useful beyond this project as well: benchmarks, competitions, research datasets, audits, marketplaces, or anywhere people make claims like “GPT produced this result”.

From OpenAI’s perspective, it would make their API outputs usable in systems where verifiable provenance is a requirement, rather than forcing developers to introduce another trusted intermediary.

SynthID is interesting, but for this use case I’d prefer explicit authentication over probabilistic detection, since the goal is verifying a specific API response rather than detecting whether arbitrary text might be AI-generated.