Hosted onboarding via dedi.global

Set up your network as an NFO, or register your subscriber details as an NP, on the hosted dedi.global solution.

On this path you use dedi.global — a ready-to-use SaaS implementing the open DeDi protocol, offered by the Networks for Humanity Foundation. You publish and manage your registries there; there are no files to host yourself.

The flow at a glance:

---

If you are an NFO: set up your network

A network on the NFH fabric is anchored by your verified namespace and one or more registries under it. Together they define the network boundary participants use during signing, verification, and discovery. Setting this up gives you:

• a verified identity for your NFO, anchored to your domain
• a registry that represents the network
• a networkId that participants rely on for trust and policy enforcement, of the form <nfoDomain>/<registryName> — for example example-nfo.com/commerce-network

Step 1 — Set up a dedi.global account

Create an account on dedi.global.

Step 2 — Create and verify your namespace

1. Create a namespace in dedi.global.
2. Request whitelisting of your domain using this form. Requests are processed within 5 minutes, provided no adverse signals are detected for the domain.
3. Enter your domain name. A TXT record is generated (only for whitelisted domains).
4. Add the generated TXT record to your domain's DNS configuration.
5. Click Verify once the DNS record is in place. DNS propagation takes from 15 minutes up to 48 hours.

Your namespace is now anchored to your domain — if you operate example-nfo.com, that is your namespace.

Step 3 — Create the network registry

Inside your verified namespace, create a registry using the Beckn Subscriber Reference schema. This registry stores references to the NPs that belong to your network.

Choose the registry name carefully — it becomes part of the networkId. A registry named commerce-network under example-nfo.com gives the network ID example-nfo.com/commerce-network.

Tip: If you operate across multiple environments (sandbox, staging, production) or sectors, create a separate registry for each — e.g. registry production → networkId example-nfo.com/production, registry mobility-production → networkId example-nfo.com/mobility-production. This keeps network boundaries explicit and lets participants configure their ONIX instances to accept requests only from networks they want to interact with.

---

If you are an NFO: add NPs to your network

Once your network registry exists, add approved NPs to it. You never copy participant data manually — you add references to registries or records the NPs have already published themselves. This keeps identity self-owned while you curate who belongs to the network.

Create a reference record per NP

For each approved NP, create a subscriber reference record in your network registry with these fields:

Field	Description	Example
subscriber_id	The NP's unique identifier	example-bap.com
url	Lookup URL of the NP's registry or record	https://api.dedi.global/dedi/lookup/...
type	Whether the URL points to a full registry or an individual record	Registry, Record

Registry or Record?

• Use Registry when the NP's entire registry belongs to the network — all its current and future records are then treated as part of the network.
• Use Record when only one specific record should belong to the network.

Get the NP's lookup URL

1. Go to the dedi explore page and find the NP's namespace. (The NP is only visible here once it has verified its namespace.)
2. Click the namespace to see its registries, then open the registry to be added — it should carry the registry tag beckn_subscriber.
3. To reference the whole registry, click Copy in the Registry Lookup API widget (use type Registry).
4. To reference a single record, open that record and click Copy in the Record Lookup API widget (use type Record).

Validate before adding

Before creating the reference entry, confirm that:

• the NP has published its subscriber details under its own verified namespace
• the published callback URL is correct and reachable
• the published public key is valid for signing and verification
• the role and participant details are appropriate for the network
• the NP is being added to the correct environment-specific registry

Once the reference entry is added, the NP is part of the curated network represented by your networkId.

---

If you are an NP: register your subscriber details

To join a network, publish your subscriber details on dedi.global so other participants can discover your endpoint and verify your signatures. You publish under your own verified domain; the NFO then decides whether to include you in its network.

You will publish:

• your subscriber identity
• your callback URL
• your role on the network (consumer node or provider node)
• your signing public key
• any other subscriber metadata required by the schema

Step 1 — Set up a dedi.global account

Create an account on dedi.global.

Step 2 — Create and verify your namespace

1. Create a namespace.
2. Request whitelisting of your domain using this form. Requests are processed within 5 minutes, provided no adverse signals are detected for the domain.
3. Enter your domain name. A TXT record is generated (only for whitelisted domains).
4. Add the generated TXT record to your domain's DNS configuration.
5. Click Verify once the DNS record is in place. DNS propagation takes from 15 minutes up to 48 hours.

If you operate example-np.com, your namespace is anchored to that domain.

Step 3 — Add a registry under your namespace

Under your verified namespace, create a registry using the Beckn Subscriber schema. It will hold one or more subscriber records for your organisation.

Step 4 — Publish your subscriber record

Create a subscriber record with:

Field	What to fill	Example
Subscriber ID	Your unique identifier, typically your domain	np.example.com
Subscriber URL	Your ONIX receiver endpoint	https://np.example.com/bap/beckn
Type	Your role on the network	consumer node or provider node
Domain	Deprecated field; can be ignored	*
Signing Public Key	Your Ed25519 public key, Base64-encoded, without header or footer	eyAeqGFtAuks...
Encryption Public Key	Optional encryption public key	lCI84I0Q0U0w...
Countries	Countries where you operate	["IND"]

If you operate in multiple roles, publish a separate record for each role.

Your Subscriber ID must be your namespace domain itself, or a subdomain of it — e.g. a namespace of example-np.com may use subscriber IDs example-np.com or bap.example-np.com, but not something.com.

Generating the signing keypair for ONIX: you can use this utility script provided in ONIX, or any other tool, as long as it produces an Ed25519 key pair with the private key as the raw 32-byte seed and the public key as the raw 32-byte public key, both Base64-encoded (standard RFC 4648, with padding).

Click Publish, then note the record ID — this is the key ID you will configure in ONIX.

Step 5 — Verify your key lookup

Check that your key has been cached by the service:

https://fabric.nfh.global/registry/dedi/lookup/<np_subscriber_id>/subscribers.beckn.one/<record_id_in_np_registry>

Allow 5–10 minutes for the cache to update.

Step 6 — Share your lookup URL with the NFO

Publishing on dedi.global is your onboarding — nothing further is needed to be on the NFH fabric. To join a network, share the lookup URL of your registry (or of the relevant record) with the NFO, which adds it to its network registry — see adding NPs above.

Why this matters: other participants use your published details to resolve your endpoint during transactions, retrieve your public key during signature verification, and validate that your requests are authentic and untampered. After publishing, configure and deploy ONIX with the same subscriber identity, key ID, and private key that correspond to the published record.