Sign and verify media with a C2PA API

Signing media for provenance used to mean running desktop tools, managing certificates, and hoping the proof survived the next transcode. Krusade's signing API is one authenticated POST that stamps a C2PA Content Credential—plus the optional standards you select—and returns the signed asset. The same credential verifies in Krusade, Adobe Content Credentials, and c2patool. You do not install a desktop signer, and you do not host a verification service for your audience. The credential travels with the file.

That matters for media and agency pipelines where the “published” object already lives in a CMS or CDN. Krusade is the stamp at that handoff, not a second library. One POST from a build step, a WordPress plugin, or a render farm is enough to attach org identity, optional IPTC or CAWG claims, and a tamper-evident binding. Downstream, anyone can check the file without a Krusade login.

The signing request

Call POST /api/v1/sign at https://api.krusade.dev with Authorization: Bearer krsd_your_key_here. The multipart file field is required. Supported types are JPEG, PNG, WebP, AVIF, TIFF, GIF, MP4, MOV, MP3, WAV, and FLAC, with a 64 MB cap. Unsupported or undetectable types return 415.

Optional form fields attach assertions: author, title, a comma-separated standards selector (for example iptc,training_mining), and JSON payloads for IPTC, EXIF, XMP, CAWG training preferences, licensing, Web3 references, and opt-in signer identity. Unknown standard names and malformed JSON return 400. Failed signs are never charged; exhausting included or free signs with a zero credit balance returns 402. The field list and error shapes live in the Signing API docs.

Embed or sidecar

By default the credential is embedded in the file you get back. Add ?manifest=sidecar to leave the original bytes unchanged. The response is a ZIP of the original asset plus a detached .c2pa manifest. Verify can accept an optional manifest part for that detached case. Sidecar is the right choice when a downstream system must hash the exact unpublished bytes, or when you cannot mutate the mezzanine.

The browser Sign page is the same product without writing HTTP: file picker, standards toggles. Use the browser to learn the flow; use the API when a CMS, CDN, or render farm should stamp at publish time. New to the format? What is C2PA? explains why C2PA is the envelope and the other standards are claims inside it.

Public verify

Verification is unauthenticated and free. POST the file to /api/v1/public/verify (the unversioned /api/verify alias behaves identically). The endpoint is rate-limited to 30 requests per minute per IP. The browser verify page is the same check with a UI. See the Public Verification API for the report shape.

The report's status is valid, invalid, or no_credentials. Unsigned files return HTTP 200 with no_credentials—that is not an error. trusted is true when the certificate chain verified against a trusted root; it is independent of status. Issuer, assertions, ingredients, and signed-at (including whether an RFC 3161 timestamp backs the claim time) round out the report. PDF is accepted on verify only; it is not a signing format. Uploads over 64 MB return 413. Errors use RFC 7807 problem+json with a machine-readable code field.

There is also an authenticated POST /api/v1/verify for the same report when you already have a session or API key. Public verify is the one to give journalists, partners, and CMS plugins that should never hold a secret. An optional parent asset can be sent as ingredient on sign so the manifest records a parentOf relationship—useful when a still is cut from a master, not a substitute for a media library.

Where this fits in a pipeline

A typical path: generate a krsd_ key (shown once), sign on the publish handoff, store the signed object where you already store media, and let anyone verify. Krusade is not a DAM. We do not become the system of record for your files. We are the stamp and the audit trail of who signed what, when.

The Developer plan includes 1,000 free signs lifetime, then $0.015 per sign, under the shared Krusade certificate. Team adds DNS-verified org identity and included monthly volume. Current numbers are on pricing. For the full endpoint list, start at the Docs.

If you are evaluating the API, sign a still in the browser, then POST the same file shape from curl using the Signing API examples. Verify both copies on /verify and with a third-party C2PA tool so you can see that the proof is the open standard, not a Krusade-only receipt. When you are ready to automate, keep the key in your secret store and call sign only at the publish boundary—failed signs are never charged, so retries after a 415 or 400 are safe.