A Kong plugin for validating ChatGPT HTTP Message Signatures using RFC 9421 (HTTP Message Signatures) standard with Ed25519 cryptographic signatures.

You can think of this plugin as the "glue" between ChatGPT requests and your backend services, ensuring only authentic ChatGPT requests reach your APIs.

• ✅ Authentic ChatGPT Requests: Verify requests actually come from ChatGPT, not impersonators
• ✅ RFC 9421 Compliance: Full implementation of HTTP Message Signatures standard
• ✅ High Performance: Ed25519 cryptography with OpenSSL and efficient key caching
• ✅ Zero False Positives: Only validates requests claiming to be from ChatGPT
• ✅ Production Ready: Comprehensive testing with 34 test cases and coverage reporting
• ✅ Kong Native: Built using Kong's Plugin Development Kit (PDK)

1. Request Detection: Plugin checks for Signature and Signature-Agent: "https://chatgpt.com" headers
2. Non-ChatGPT Passthrough: Requests without ChatGPT headers pass through unchanged (zero overhead)
3. Signature Validation: For ChatGPT requests, validates Ed25519 signatures using RFC 9421 format
4. Authentication Decision: Blocks invalid signatures with 403, allows valid ones through
5. Upstream Integration: Sets X-ChatGPT-Verified: true header for your backend services

This guide will get you up and running with ChatGPT signature validation.

1. Kong Gateway: Version 3.x+ (tested with Kong 3.9.1)
2. ChatGPT Integration: Your application must be configured to receive ChatGPT requests
3. ChatGPT Public Key: Obtain the current public key and key ID from OpenAI
4. OpenSSL: Ed25519 support (included in most modern installations)

Note: While Kong 3.11.x is available, this plugin is tested with Kong 3.9.1 as it's the latest version supported by Pongo as of 2024.

luarocks install kong-plugin-chatgpt

1. Clone this repository:

git clone https://github.com/seatgeek/kong-plugin-chatgpt.git
cd kong-plugin-chatgpt

2. Build the rock:

make build

3. Install the rock:

luarocks install kong-plugin-chatgpt-0.0.1-1.all.rock

FROM kong/kong-gateway:latest
COPY kong-plugin-chatgpt-0.0.1-1.all.rock /tmp/
USER root
RUN luarocks install /tmp/kong-plugin-chatgpt-0.0.1-1.all.rock
USER kong

Add chatgpt to your Kong configuration:

export KONG_PLUGINS=bundled,chatgpt

Or in kong.conf:

plugins = bundled,chatgpt

Configure the plugin with ChatGPT's public key information:

curl -X POST http://localhost:8001/plugins \
  --data "name=chatgpt" \
  --data "config.keyid=your-chatgpt-keyid" \
  --data "config.public_key_x=your-chatgpt-public-key-x-coordinate"

luarocks install kong-plugin-chatgpt

git clone https://github.com/seatgeek/kong-plugin-chatgpt.git
cd kong-plugin-chatgpt
make build
luarocks install kong-plugin-chatgpt-0.0.1-1.all.rock

Add chatgpt to your Kong configuration:

export KONG_PLUGINS=bundled,chatgpt

Or in kong.conf:

plugins = bundled,chatgpt

Configure the plugin with ChatGPT's public key information:

curl -X POST http://localhost:8001/plugins \
  --data "name=chatgpt" \
  --data "config.keyid=otMqcjr17mGyruktGvJU8oojQTSMHlVm7uO-lrcqbdg" \
  --data "config.public_key_x=your-chatgpt-public-key-x-coordinate"

Test with a sample request to ensure the plugin is working:

# Non-ChatGPT request (should pass through)
curl -H "Host: your-service.com" http://localhost:8000/your-endpoint

# ChatGPT request without signature (should be blocked)
curl -H "Host: your-service.com" \
     -H "Signature-Agent: \"https://chatgpt.com\"" \
     http://localhost:8000/your-endpoint

1. Non-ChatGPT Requests: Pass through without validation
2. ChatGPT Requests: Validated using HTTP Message Signatures
3. Valid Signatures: Add X-ChatGPT-Verified: true header
4. Invalid Signatures: Return 403 Forbidden

• X-ChatGPT-Verified: true - Set for successfully validated ChatGPT requests

1. Install Pongo:

git clone https://github.com/Kong/kong-pongo.git
mkdir -p ~/.local/bin
ln -s $(realpath kong-pongo/pongo.sh) ~/.local/bin/pongo

2. Clone and setup:

git clone https://github.com/seatgeek/kong-plugin-chatgpt.git
cd kong-plugin-chatgpt

Run the comprehensive test suite:

# Run all tests with coverage
./bin/run-unit-tests.sh

# Run specific test files
pongo run spec/plugins/chatgpt/01-handler_spec.lua

# Run tests with verbose output
pongo run -- --verbose

# Generate coverage report
pongo run -- --coverage-report

spec/
└── plugins/
    └── chatgpt/
        ├── 01-handler_spec.lua      # Main handler tests
        ├── 02-schema_spec.lua       # Schema validation tests
        ├── 03-ed25519_unit_spec.lua # Cryptographic module tests
        └── 04-integration_spec.lua  # Integration tests

Build the plugin rock:

make build

• Key Management: Ensure ChatGPT public keys are up-to-date
• Signature Validation: All cryptographic operations use OpenSSL
• Request Filtering: Only ChatGPT requests are processed
• Error Handling: Invalid signatures result in immediate rejection

• Efficient Filtering: Non-ChatGPT requests have minimal overhead
• Key Caching: Public keys are cached to avoid repeated conversions
• OpenSSL Integration: Native cryptographic operations via FFI

Please feel free to submit pull requests against this repo!

1. Clone the repository:

git clone https://github.com/seatgeek/kong-plugin-chatgpt.git
cd kong-plugin-chatgpt

2. Set up development environment:

make dev-setup

3. Run tests:

make test

4. Make your changes and ensure tests pass
5. Submit a pull request

Apache 2.0 License. See LICENSE for details.

For issues and questions:

• 🐛 Bug Reports: GitHub Issues
• 💬 Questions: GitHub Discussions
• 🔒 Security Issues: Report privately to security@seatgeek.com

• Kong Plugin Development Guide
• RFC 9421: HTTP Message Signatures
• ChatGPT HTTP Message Signatures
• Ed25519 Signature Algorithm