Our commitment to open source
OpenDPP is open-core. The client surface — the helpers, schemas and SDKs you integrate with — is open under Apache-2.0, so you can build on it, audit it, and avoid lock-in. The hosted node that signs, seals and resolves your passports is the product we run for you.
Live from the npm registry — refreshed automatically, never hand-maintained.
Pick your language
Official SDKs and client libraries, scoped to your stack. The SDKs are generated from the public OpenAPI contract and version-locked to it — the SDK version is the API contract version.
TypeScriptnpmv1.12.11,109 / mo
Fully-typed ESM client, zero runtime dependencies. Node 20 and later.
npm install @opendpp/sdk
Client libraries on npm
@opendpp/gs1
v0.5.01,921 / mo
GS1 Digital Link URI builders and GS1 mod-10 check-digit helpers — the identifier maths behind every scannable passport.
@opendpp/csv
v0.2.11,141 / mo
A pure CSV-to-passport reference mapper: turn a spreadsheet row into a structured passport payload, with errors reported by line.
@opendpp/webhooks
v0.1.2302 / mo
OpenDPP webhook event types plus a constant-time HMAC-SHA256 signature verifier, so you can trust the payloads you receive.
@opendpp/eori
v0.1.3453 / mo
EORI customs-identifier validation against the European Commission's authoritative EOS service, plus pure offline EORI syntax and parsing helpers.
@opendpp/aeo
v0.1.2308 / mo
Authorised Economic Operator (trusted-trader) status lookup against the European Commission's authoritative EOS service — a supply-chain due-diligence signal.
@opendpp/vies
v0.1.079 / mo
EU VAT-number existence validation against the European Commission's authoritative VIES service, plus pure offline VAT-ID syntax and parsing helpers.
@opendpp/testdata
v0.3.0697 / mo
Deterministic synthetic sample passports for every ESPR category, plus supply-chain event chains and import-ready CSV — test an integration without hand-crafting payloads.
JavaMaven Centralv1.12.1
Typed client built on the JDK HTTP client. Java 17 and later; GPG-signed artifacts.
implementation("eu.opendpp-node:opendpp-sdk:1.12.1")
Java client libraries are on the roadmap. The SDK ships today and covers the full public API — everything the npm helpers wrap is a typed call away.
Kotlinvia Javav1.12.1
The Java artifact is idiomatic from Kotlin — same coordinates, no separate package.
implementation("eu.opendpp-node:opendpp-sdk:1.12.1")
Your language
More official SDKs are on the roadmap. The OpenAPI contract is public — generate a client for any stack today.
curl https://opendpp-node.eu/openapi.json
What we open, and why
A simple rule: if it helps you integrate with OpenDPP it is open; if it protects your keys or runs the node it stays with the hosted service.
Open — the client surface
Every helper you call to format identifiers, map your data, verify a webhook or talk to the API is published under Apache-2.0. Read it, fork it, vendor it — no account required.
- Identifier, CSV and webhook helpers
- The typed API SDKs, generated from the public OpenAPI contract
- AAS and UNTP / W3C-VC interop schemas, samples and validators
- The AI knowledge bundle (OKF) and /llms.txt
Closed — the hosted node
Key custody, sealing, DID and revocation issuance, and resolution run on the managed node. That boundary is what keeps every tenant's private keys inside the vault.
- Per-tenant key vault and passport sealing
- did:web and revocation status-list issuance
- The resolver, persistence and retention layer
- The multi-tenant control plane
The closed line is deliberate and load-bearing: your signing keys never leave the vault, and the node never hands out a credential emitter that could sign on your behalf off-platform.
Also open — the interoperability & knowledge repositories
opendpp-interop
The interop boundary kit: official AAS (IDTA) and UNTP / W3C-VC schemas, live-reproducible samples, an offline conformance validator, and OpenDPP-authored non-normative SHACL shapes.
opendpp-knowledge
The OpenDPP knowledge bundle in Open Knowledge Format (OKF) — machine-readable Markdown that lets AI agents learn the API. Also served live at /okf and advertised via /llms.txt.
Apache-2.0, and a word on the name
The open packages and repositories are licensed under Apache-2.0 — use them in commercial and open projects alike. The OpenDPP hosted service and its server components remain proprietary.
OpenDPP™ is a trademark of Opendpp UAB. You are welcome to build integrations that work with OpenDPP and to say so; "OpenDPP-conformant" describes software that interoperates with the OpenDPP node — it is not a certification or endorsement we grant.
Build with OpenDPP
Start from the open packages and the public API contract — no account required to read the code.
Explore the OpenDPP org on GitHub