For publishers · Response-side integration

Publishers integrate by serving the protocol, not by handing over logs.

Most ad-tech integrations ask the publisher to forward something private — query logs, user IDs, behavioral signals — in exchange for monetization. This protocol asks the publisher to publish something public: cryptographic headers on the content the publisher is already serving. The integration surface is the response, not the user.

Who this is for

This page is for content publishers and operators of agent surfaces — sites and runtimes that generate or modify content using AI models and want that content to be readable by an ad-relevance protocol that does not require user tracking.

Specifically:

Not for: ad buyers (see OpenAI Ads or the sister page for sponsor-side publishing), behavioral ad networks, identity-graph vendors.

What you publish

Three artifacts, all at stable URLs or in response headers:

  1. FCS trust headers on AI-generated and agent-modified responses. The four-header set described in the FCS-2.1 spec: X-FCS-Version, X-FCS-Content-Hash, X-FCS-Model, X-FCS-Signature. Emitted at response time, computed from the body and your signing key.
  2. A public verification key at /.well-known/fcs-signing-keys.json — the path already used by the FCS worker and spec references. The key lets any consumer verify the headers.
  3. Optional: a content-publisher manifest at /.well-known/agent-ad.json if you are also serving as a sponsorship endpoint. Most pure content publishers do not need this — it is the sponsor-side artifact, covered on the sister page.

That is the full content-publisher integration surface. Three artifacts. None of them describes the user.

What you do NOT publish

The protocol asks the publisher for content provenance, not for the requester's identity. Specifically, integration does NOT require:

If a vendor pitches "contextual integration" but asks for any of the above, that is behavioral integration with a contextual label, not contextual-as-architecture.

The integration surface, concretely

Three things to add to your origin server's response pipeline:

StepWhat you doWhere
1Compute the four required FCS headers on AI-generated or agent-modified responsesResponse middleware
2Publish your public verification key at a stable URL/.well-known/fcs-signing-keys.json
3Sign content at generation time, not at request timeGeneration pipeline

Implementation examples and verification guidance are linked from the FCS-2.1 spec as they stabilize. The integration is response-side: nothing about it requires a database of users.

How this differs from log-handoff and pixel integration

Three common alternatives have different shapes:

The architectural distinction: FCS asks the publisher to publish (declarative, public, auditable), not to forward (transactional, private, opaque).

Where this fits relative to OpenAI Ads

OpenAI Ads frames relevance around conversation, context, and ad details. FCS-signed landing pages make the publisher-side content signal more verifiable for any crawler or ad system that evaluates the page — the read is anchored to content provenance, not just to what a crawler happened to fetch.

FCS-emitting publishers produce a signal that is portable across any ad system that consumes the headers — not just one platform. The integration is portable by design.

What this is not