Download
Menu

Closed by default. Verifiable on arrival.

The control API can change what leaves your plant, so it ships locked down. Every push is signed so the receiver can prove where it came from.

  • Loopback bindListens on 127.0.0.1:3000 by default. Remote access goes through a TLS proxy or an explicit bind_addr behind your firewall.
  • Bearer tokenEvery /api route and /metrics needs a credential: a named token, the break-glass api_token, or an SSO session. Only /api/health, /api/ready and the login endpoints are public. First start writes a random 32-byte token to <data_dir>/api_token with mode 0600; the log prints the path, never the token.
  • Same-origin onlyNo CORS headers unless you list an origin. While bound to loopback, a foreign Host or Origin gets 403.
  • Redacted configGET /api/config returns secrets, passwords and URL credentials as ***.
  • Signed pushesHMAC-SHA256 over a send-time timestamp plus the raw body, re-signed on every retry. An optional key id lets you overlap two secrets during rotation.
  • Scripts and httpJavaScript runs in a sandbox with no filesystem or network, a heap cap and a deadline. http nodes are deny-by-default: only hosts on your allowlist are reachable.
  • Field protocolsOPC-UA server certificates are verified by default. Postgres speaks TLS through rustls. Runtime-added sources refuse loopback, link-local and metadata addresses.
  • Single sign-on and rolesOpenID Connect sign-in with PKCE, and four roles: viewer, operator, editor, admin. One table maps every API route and MCP tool to its minimum role. SAML goes through an OIDC-capable provider such as Keycloak or Entra ID.
  • Named tokens and auditMachines and agents get named tokens with a role and an optional expiry. Every change and login lands in an append-only audit log, kept 5 years by default and exported as CSV.
  • Secrets, masking, encryptionSecrets are references resolved from Vault, OpenBao or a local encrypted store, never stored in a flow. Personal fields show as *** in traces, dead letters and job logs. Stored payloads are encrypted with AES-256-GCM when a master key is set.
Not providedOpexFlow does not terminate TLS, and it speaks OIDC rather than SAML directly: use a reverse proxy for remote access and an OIDC-capable provider such as Keycloak or Entra ID. Sessions and named tokens belong to one node. Signing out ends the OpexFlow session only, not the one at your identity provider.
verify-push.js
// Node.js. Express: express.raw({ type: "application/json" })
const crypto = require("crypto");

function verify(rawBody, headers, secret, windowSecs = 300) {
  const ts = Number(headers["x-opex-timestamp"]);
  const sig = headers["x-opex-signature"];
  if (!Number.isFinite(ts) || typeof sig !== "string")
    return false;
  if (Math.abs(Date.now() / 1000 - ts) > windowSecs)
    return false;
  const expected = Buffer.from("sha256=" + crypto
    .createHmac("sha256", secret)
    .update(Buffer.concat([Buffer.from(ts + "."), rawBody]))
    .digest("hex"));
  const got = Buffer.from(sig);
  return got.length === expected.length
      && crypto.timingSafeEqual(got, expected);
}

Sign the exact raw bytes you received, compare in constant time and enforce the replay window. Every push carries X-Opex-Timestamp and X-Opex-Signature, except the opexmx batch format, which uses a bearer key. Python and Go versions are in the data contract.

Questions about access and secrets.

Something missing? Write to marketing@opexcg.com.

Does it phone home?

Only for license checks, and only when license enforcement is enabled: the key is validated against flow.opexcg.com on start and the result is cached. A signed offline token keeps it running through an outage for the number of days you configure.

Prometheus SLA metrics are in every build. OpenTelemetry export and stall alerts belong to the separate telemetry build and go where you point them.

Does it have SSO, roles and a secrets vault?

Yes. Sign in with OpenID Connect (PKCE) and get one of four roles: viewer, operator, editor or admin. Machines and agents use named tokens with a role and an optional expiry. Every change and login goes to an append-only audit log.

Secrets are references resolved from Vault, OpenBao or a local encrypted store, and personal fields are masked. OpexFlow speaks OIDC, not SAML directly: use a provider such as Keycloak or Entra ID that exposes OIDC. It does not terminate TLS, so put a reverse proxy in front for remote access.

From download to first record in minutes.

Run one binary, connect a PLC, a CNC or a webhook, and watch the records arrive in the editor.

Download OpexFlowRequest a license

Builds for Linux (x86_64 and ARM64), Windows and macOS.

  • One binary
  • Raspberry Pi to rack server
  • Signed delivery with retries

Sizing questions or an air-gapped install? Email marketing@opexcg.com or read the quick start.