ProtocolPlatformsUse casesDocsTrust modelVerifyAll docs
Docs · Quickstart

GOVP in five minutes.

Three ways to start, depending on where your records live. The fastest is the browser — you can verify a real record before you finish reading this sentence.

Browser
Verify · no install
WordPress
Issue · publish
CLI & self-host
Issue · verify
Track A · Browser

Verify a record — nothing to install

The full GOVP-1 check, including the Ed25519 signature, runs in your browser. Nothing is uploaded.

  1. Open the verifier
    Go to the public verification portal.
  2. Load a real sample
    Click Load a real sample (or paste any .govp.txt record).
  3. Verify
    Press Verify record. You get a deterministic PASS with the checks that ran.
  4. Break a byte
    Change one character and verify again — it fails for everyone, everywhere. That is the whole point.

Want a record to try? Download one from the use cases or the reference library — every example passes.

Track B · WordPress

Issue evidence from a WordPress site

The reference plugin turns any WordPress site into a GOVP issuer and verifier — pure PHP (libsodium), no sidecar. Requires PHP 7.4+ with ext/sodium and ext/dom.

  1. Install & activate the plugin
    Add the GOVP Public Evidence plugin and activate it.
  2. Generate the site signing key
    In GOVP → generate key. Then confirm the built-in self-test reports CONFORME — it proves your install verifies byte-for-byte like the reference implementations.
  3. Certify a post or page
    In the editor, open the GOVP panel → Certify. The declaration is fixed into a GOVP-1 record.
    # show the verifier anywhere with a shortcode [govp_verify id="GOVP-DOC-xxxxxxxxxxxx"]
  4. Route .well-known to WordPress
    The one host-dependent step: make sure requests reach PHP so the identity and records are served.
    # Nginx — inside server { }, before any static .well-known block location ^~ /.well-known/govp { try_files $uri $uri/ /index.php?$args; }
    # check it serves GOVP, not a 404 curl -s https://your-site/.well-known/govp.txt curl -s https://your-site/.well-known/govp/index.json

Production key safety. Keep the signing key out of the web root. In a production environment the plugin blocks issuing if the key sits under the web root (verification still works). Set a safe path, or sign with a KMS/HSM — see the integration guide.

Track C · CLI & self-host

Issue and verify from your own systems

Embed GOVP with a reference library (Python, JavaScript, Kotlin, PHP) and publish your identity at your own domain. Verification is a pure function of the record.

  1. Publish your domain identity
    Serve your public key and metadata at a stable URL. Records bind to it via the Canonical field.
    # the identity a verifier can fetch and pin https://your-domain/.well-known/govp.txt
  2. Issue a record
    Fix a statement or an asset into a GOVP-1 record — from a build pipeline, an ERP export or a device gateway.
    # illustrative CLI — canonicalize, sign, emit $ govp issue \ --publisher your-domain \ --asset-type document \ --asset-id LOT-78432 \ --asset ./lot-78432.pdf \ --canonical https://your-domain/.well-known/govp.txt \ > lot-78432.govp.txt
  3. Verify — anywhere, offline
    Anyone recomputes the signing input, checks Ed25519, derives the GOVP-ID and (optionally) the asset hash.
    $ govp verify lot-78432.govp.txt PASS signature valid · domain bound · GOVP-ID matches · asset hash matches
  4. Prove your implementation is conformant
    Run the golden vectors so your build matches the reference bytes exactly.
    # reproducible cross-language conformance $ make test # PHP lint + pytest conformance/ in an isolated venv

Command names are illustrative — the operations (canonicalize → sign → verify) are defined byte-for-byte in the specification and can be reimplemented in a few lines.

Next: worked examples Integration guide
← Gemacode Research