Portable subscriptions for the open web
OPE is a portable entitlement layer that lets users access gated content across any app, any feed format, any browser, and any platform. Subscribe once, read anywhere — articles in your feed reader, podcasts in your player, video in your app, or content on the web. No lock-in. No walled gardens.
Entitlement, not payments
OPE proves you're allowed in. Payment processors handle money. Clean separation.
Truly portable
Your subscription works in any OPE-compatible app — feed reader, podcast player, or browser. No platform lock-in.
Works with any feed
RSS, Atom, JSON Feed, AT Protocol. OPE extends what you already use.
Publisher-controlled
Publishers issue grants and control access. Their content, their rules.
Design Philosophy
Four layers, cleanly separated
OPE occupies the space between content distribution and payment processing. Each concern stays independent.
Content
Articles, podcasts, video, courses, and more. Created and hosted by the publisher.
Distribution
Feed formats (RSS, Atom, JSON Feed, ATProto) that catalog and deliver previews.
Entitlement
Verification that a user has the right to access content. Portable across apps.
Payments
How money changes hands. Stripe, x402, Lightning, or anything else. Out of scope.
The Flow
From feed to full content
Five steps from discovering content in your app to accessing the full thing.
Feed
Client fetches a feed and finds OPE-gated items with preview content or trailer clips.
Discovery
Client fetches /.well-known/ope to learn the publisher's capabilities.
Authenticate
Client initiates OAuth 2.0 with PKCE. User logs in with the publisher.
Grant
Publisher issues a signed grant token proving entitlement.
Access
Client presents the token and retrieves full content — article, episode, or video. Done.
See It In Action
How OPE works for real people
Two people, two apps, one protocol. Flip through to see how it actually works.
Alice adds a feed
Alice opens her favorite feed reader and subscribes to The Cosmic Courier, a space and science publication. Most articles show full content, but one piece — "The Hidden Cost of Walled Gardens" — shows only a preview. The teaser says: 4,500 words · 18 min read. Intriguing.
Her reader discovers OPE
The feed reader spots the ope extension in the JSON Feed and fetches the publisher's /.well-known/ope endpoint. One tiny JSON file tells it everything: OAuth server, content API, grant types, and pricing. No special integration required.
Alice taps 'Subscribe'
The gated article shows a rich preview with word count, estimated read time, and a clear call-to-action. Alice taps "Subscribe for $5/month" and her reader opens the publisher's OAuth login. Quick and familiar.
Authentication & grant
Alice logs in with The Cosmic Courier. After a quick consent screen, the publisher issues a signed grant token — a portable JWT that proves Alice is a subscriber. Her reader stores it securely. That's it.
Full content, instantly
Her reader presents the token to the content API and pulls down the full 4,500-word article. Alice reads it right where she is — no browser switch, no paywall interstitial, no friction. Just the article.
It just keeps working
Every future gated article from The Cosmic Courier is automatically accessible. The token refreshes silently in the background. Alice can also read on the publisher's website — same token, works via a browser cookie. One subscription, every surface.
Simple discovery, powerful access
Publishers expose a single well-known endpoint. Reader apps handle the rest — OAuth, token management, content retrieval — all standardized.
- Discovery
- JSON manifest at a well-known URL
- Auth
- OAuth 2.0 with PKCE, consent, dynamic registration
- Tokens
- JWT, PASETO, or Macaroons — API or cookie transport
- Content
- Single item or batch retrieval, HTTP 402 signaling
- Web
- Cookie-based grants, browser unlock, cross-publisher SSO
- Feeds
- Non-breaking extensions with unlock URLs
{
"version": "0.1",
"oauth_server": "https://example.com/.well-known/oauth-authorization-server",
"entitlement": {
"grant_url": "https://example.com/api/entitlement/grant",
"token_format": "jwt",
"token_mode": "portable",
"default_ttl_seconds": 3600
},
"content": {
"endpoint_template": "https://example.com/api/content/{id}",
"batch_endpoint": "https://example.com/api/content/batch",
"formats_available": ["html", "markdown"]
},
"grants_supported": ["access", "limit", "signal"]
}
Who It's For
Built for the entire ecosystem
Publishers
Keep full control of your content and subscriptions while making them work everywhere.
- · Add OPE metadata to your existing feeds
- · Works for articles, podcasts, video, courses, and more
- · Expose a single discovery endpoint
- · Use the reference gateway or build your own
- · Support any payment processor you want
- · WordPress, Ghost, Substack, podcast host migration paths
Apps & Browsers
Give your users seamless access to gated content from any OPE-enabled publisher — in feed readers, podcast players, video apps, or on the web.
- · Detect OPE extensions in any feed format
- · Manage per-publisher OAuth sessions
- · Show rich previews: word count, duration, artwork
- · Retrieve full articles, media files, or streaming URLs
- · Batch retrieval for fast offline sync
- · Browser unlock via cookies and HTTP 402
Brokers
Create subscription bundles across multiple publishers. Like cable bundles, but for the open web.
- · Aggregate entitlements across publishers
- · Issue broker grant tokens with Macaroons
- · Capability attenuation for scoped access
- · Single sign-on for multi-publisher access
- · Enable new business models
Flexible Access
Three simple grants, powerful access
OPE doesn't prescribe how entitlements are earned — it standardizes how they're proven. Every grant in the protocol is one of three primitives, each with a small set of composable fields. Fourteen common patterns (subscription, gift, trial, etc.) are named aliases — but the protocol itself only validates three types.
access
The reader may view this content. Access grants cover subscriptions, per-item purchases, gifts, trials, rentals, bundles, and broker access — anything where the core question is "can this person see this?"
scope · duration · transferable · source
limit
The reader may view up to a threshold. Limit grants handle metered paywalls and locale-gated access — situations where entitlement is conditional on a quota or region rather than a binary yes/no.
kind · quota · period · source
signal
The reader has a status that unlocks treatment. Signal grants communicate things like ad-free eligibility, institutional affiliation, patron status, or family-plan membership — the content is accessible, but the experience changes.
kind · source
Grant Builder
Pick a preset to see how named grant types decompose into primitives, or build a custom grant and copy the JSON.
Compatibility
Works with what you already use
OPE is a purely additive extension. Readers without OPE support simply see previews as usual.
Start building with OPE
The spec is open. The demo runs locally in one command. Read it, build on it, and help shape portable entitlements for the open web.