> For the complete documentation index, see [llms.txt](https://docs.nfh.global/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nfh.global/build/onboarding/hosted.md).

# Hosted onboarding via dedi.global

Set up your network as an NFO, or register your subscriber details as an NP, on the hosted dedi.global solution.

On this path you use [dedi.global](https://publish.dedi.global/) — a ready-to-use SaaS implementing the open [DeDi protocol](https://github.com/LF-Decentralized-Trust-labs/decentralized-directory-protocol), offered by the Networks for Humanity Foundation. You publish and manage your registries there; there are no files to host yourself.

The flow at a glance:

```mermaid
sequenceDiagram
    participant NFO
    participant D as dedi.global
    participant NP

    NFO->>D: 1. Register account, create + verify namespace (DNS TXT)
    NP->>D: 1. Register account, create + verify namespace (DNS TXT)
    NFO->>D: 2. Create network registry (Beckn Subscriber Reference schema)
    NP->>D: 3. Create NP registry (Beckn Subscriber schema)<br/>and publish subscriber record
    NP-->>NFO: 4. Share lookup URL of registry / record
    NFO->>D: 5. Add lookup URLs as records in the network registry
```

***

## If you are an NFO: set up your network

A network on the NFH fabric is anchored by your verified namespace and one or more registries under it. Together they define the network boundary participants use during signing, verification, and discovery. Setting this up gives you:

* a verified identity for your NFO, anchored to your domain
* a registry that represents the network
* a **networkId** that participants rely on for trust and policy enforcement, of the form `<nfoDomain>/<registryName>` — for example `example-nfo.com/commerce-network`

### Step 1 — Set up a dedi.global account

Create an account on [dedi.global](https://publish.dedi.global/).

### Step 2 — Create and verify your namespace

1. Create a namespace in dedi.global.
2. Request whitelisting of your domain using [this form](https://docs.google.com/forms/d/e/1FAIpQLScAwEZh94DCIw70zrxWUJ1cud_wYfo_WEjqDpEmbxaw5ZF9aw/viewform). Requests are processed within 5 minutes, provided no adverse signals are detected for the domain.
3. Enter your domain name. A TXT record is generated (only for whitelisted domains).
4. Add the generated TXT record to your domain's DNS configuration.
5. Click **Verify** once the DNS record is in place. DNS propagation takes from 15 minutes up to 48 hours.

Your namespace is now anchored to your domain — if you operate `example-nfo.com`, that is your namespace.

### Step 3 — Create the network registry

Inside your verified namespace, create a registry using the [Beckn Subscriber Reference schema](https://raw.githubusercontent.com/LF-Decentralized-Trust-labs/decentralized-directory-protocol/refs/heads/main/schemas/beckn_subscriber_reference.json). This registry stores references to the NPs that belong to your network.

Choose the registry name carefully — it becomes part of the networkId. A registry named `commerce-network` under `example-nfo.com` gives the network ID `example-nfo.com/commerce-network`.

{% hint style="info" icon="lightbulb" %}
**Tip**: If you operate across multiple environments (sandbox, staging, production) or sectors, create a separate registry for each — e.g. registry `production` → networkId `example-nfo.com/production`, registry `mobility-production` → networkId `example-nfo.com/mobility-production`. This keeps network boundaries explicit and lets participants configure their ONIX instances to accept requests only from networks they want to interact with.
{% endhint %}

***

## If you are an NFO: add NPs to your network

Once your network registry exists, add approved NPs to it. You never copy participant data manually — you add **references** to registries or records the NPs have already published themselves. This keeps identity self-owned while you curate who belongs to the network.

### Create a reference record per NP

For each approved NP, create a subscriber reference record in your network registry with these fields:

| Field          | Description                                                       | Example                                   |
| -------------- | ----------------------------------------------------------------- | ----------------------------------------- |
| subscriber\_id | The NP's unique identifier                                        | example-bap.com                           |
| url            | Lookup URL of the NP's registry or record                         | `https://api.dedi.global/dedi/lookup/...` |
| type           | Whether the URL points to a full registry or an individual record | Registry, Record                          |

**Registry or Record?**

* Use **Registry** when the NP's entire registry belongs to the network — all its current *and future* records are then treated as part of the network.
* Use **Record** when only one specific record should belong to the network.

### Get the NP's lookup URL

1. Go to the [dedi explore page](https://explore.dedi.global/) and find the NP's namespace. (The NP is only visible here once it has verified its namespace.)
2. Click the namespace to see its registries, then open the registry to be added — it should carry the registry tag `beckn_subscriber`.
3. To reference the whole registry, click **Copy** in the *Registry Lookup API* widget (use type **Registry**).
4. To reference a single record, open that record and click **Copy** in the *Record Lookup API* widget (use type **Record**).

### Validate before adding

Before creating the reference entry, confirm that:

* the NP has published its subscriber details under its own verified namespace
* the published callback URL is correct and reachable
* the published public key is valid for signing and verification
* the role and participant details are appropriate for the network
* the NP is being added to the correct environment-specific registry

Once the reference entry is added, the NP is part of the curated network represented by your networkId.

***

## If you are an NP: register your subscriber details

To join a network, publish your subscriber details on dedi.global so other participants can discover your endpoint and verify your signatures. You publish under your own verified domain; the NFO then decides whether to include you in its network.

You will publish:

* your subscriber identity
* your callback URL
* your role on the network (consumer node or provider node)
* your signing public key
* any other subscriber metadata required by the schema

### Step 1 — Set up a dedi.global account

Create an account on [dedi.global](https://publish.dedi.global/).

### Step 2 — Create and verify your namespace

1. Create a namespace.
2. Request whitelisting of your domain using [this form](https://docs.google.com/forms/d/e/1FAIpQLScAwEZh94DCIw70zrxWUJ1cud_wYfo_WEjqDpEmbxaw5ZF9aw/viewform). Requests are processed within 5 minutes, provided no adverse signals are detected for the domain.
3. Enter your domain name. A TXT record is generated (only for whitelisted domains).
4. Add the generated TXT record to your domain's DNS configuration.
5. Click **Verify** once the DNS record is in place. DNS propagation takes from 15 minutes up to 48 hours.

If you operate `example-np.com`, your namespace is anchored to that domain.

### Step 3 — Add a registry under your namespace

Under your verified namespace, create a registry using the [Beckn Subscriber schema](https://raw.githubusercontent.com/LF-Decentralized-Trust-labs/decentralized-directory-protocol/refs/heads/main/schemas/beckn_subscriber.json). It will hold one or more subscriber records for your organisation.

### Step 4 — Publish your subscriber record

Create a subscriber record with:

| Field                 | What to fill                                                      | Example                            |
| --------------------- | ----------------------------------------------------------------- | ---------------------------------- |
| Subscriber ID         | Your unique identifier, typically your domain                     | np.example.com                     |
| Subscriber URL        | Your ONIX receiver endpoint                                       | `https://np.example.com/bap/beckn` |
| Type                  | Your role on the network                                          | consumer node or provider node     |
| Domain                | Deprecated field; can be ignored                                  | \*                                 |
| Signing Public Key    | Your Ed25519 public key, Base64-encoded, without header or footer | eyAeqGFtAuks...                    |
| Encryption Public Key | Optional encryption public key                                    | lCI84I0Q0U0w\...                   |
| Countries             | Countries where you operate                                       | \["IND"]                           |

If you operate in multiple roles, publish a separate record for each role.

{% hint style="warning" %}
Your Subscriber ID must be your namespace domain itself, or a subdomain of it — e.g. a namespace of `example-np.com` may use subscriber IDs `example-np.com` or `bap.example-np.com`, but not `something.com`.
{% endhint %}

**Generating the signing keypair for ONIX**: you can use [this utility script](https://github.com/beckn/beckn-onix/blob/main/install/generate-ed25519-keys.go) provided in ONIX, or any other tool, as long as it produces an Ed25519 key pair with the private key as the raw 32-byte seed and the public key as the raw 32-byte public key, both Base64-encoded (standard RFC 4648, with padding).

Click **Publish**, then note the **record ID** — this is the key ID you will configure in ONIX.

### Step 5 — Verify your key lookup

Check that your key has been cached by the service:

```
https://fabric.nfh.global/registry/dedi/lookup/<np_subscriber_id>/subscribers.beckn.one/<record_id_in_np_registry>
```

{% hint style="info" %}
Allow 5–10 minutes for the cache to update.
{% endhint %}

### Step 6 — Share your lookup URL with the NFO

Publishing on dedi.global is your onboarding — nothing further is needed to be on the NFH fabric. To join a network, share the lookup URL of your registry (or of the relevant record) with the NFO, which adds it to its network registry — see [adding NPs](#if-you-are-an-nfo-add-nps-to-your-network) above.

**Why this matters**: other participants use your published details to resolve your endpoint during transactions, retrieve your public key during signature verification, and validate that your requests are authentic and untampered. After publishing, configure and deploy ONIX with the same subscriber identity, key ID, and private key that correspond to the published record.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.nfh.global/build/onboarding/hosted.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.