Consent-native authorization
An OAuth-style grant flow (PKCE, single-use codes, origin pinning) where the scopes are personal fields and the resource owner is a person. Authorization flow
Consent you can verify. Not just claim.
The Share Protocol (SP/1) is an open specification for exchanging personal data on the subject's explicit, revocable, cryptographically provable terms. Every grant is fingerprinted, every event is hash-chained, and every certificate can be verified by anyone — including regulators — without trusting the operator.
Why a protocol
Section titled “Why a protocol”Today, “proof of consent” in regulated lead flows means a screenshot and a pinky promise held by a single vendor. The market leader certifies consent by asking you to trust the market leader. The Share Protocol takes the opposite position: evidence is only evidence if the party holding it can’t rewrite it — so the protocol specifies canonical serialization, fingerprints, hash-chained audit logs, and external Merkle-anchored checkpoints that make every record independently checkable, byte for byte.
Verifiable by construction
SHA-256 fingerprints over canonical JSON, an append-only hash chain, and
signed external anchors. Test vectors included — implement verify() from
this site alone. Fingerprints
Revocation is a first-class verb
Grants expire; revocations start a tracked cease-contact clock with acknowledgement semantics. Non-response is itself evidence. Lifecycle
One-to-one certified consent
Certificates bind the exact disclosure text, the named entity list, the policy text in force at opt-in, and a masked subject — publicly verifiable at a URL. Certificates
Status
Section titled “Status”SP/1 — working draft. The protocol is stewarded by PRYVC,
which operates the reference implementation (api.pryvc.com). The specification
text is licensed CC BY 4.0 —
build on it, implement it, cite it. Feedback:
protocol@pryvc.com.