Krusade

Developer Guide

One signing API for media provenance—C2PA Content Credentials plus IPTC, EXIF, CAWG, PLUS, and XMP—from your CMS, CDN, or pipeline.

New to Content Credentials? What is C2PA? · Signing API · Public verify · Webhooks · Watermarking · Integrations

Getting Started

  1. 1Sign up with email, Google, or GitHub — you get 1,000 free signs lifetime under the Krusade certificate, no card needed.
  2. 2In the dashboard, open the API Key tab and generate your krsd_* key. It is shown once — store it safely.
  3. 3Sign a file: one POST to /api/v1/sign with your key (and optional standards fields). The signed copy comes back with the credential embedded — or use ?manifest=sidecar for a detached .c2pa zip.
  4. 4Verify anywhere: our public /api/verify endpoint, c2patool, or Adobe Content Credentials — no Krusade software required.
  5. 5Past the free tier, signing costs $0.015 per sign via credits (Team: $0.010 after monthly included signs). Buy credits from the dashboard; failed signs are never charged.

API Reference

POST
/api/v1/sign

One POST stamps JPEG/PNG/WebP/AVIF/MP4/MOV/audio with a C2PA credential + optional standards selector (iptc, exif, training_mining, …). ?manifest=sidecar returns a zip. 400 bad input, 402 insufficient_credits, 415 unsupported type. 64 MB cap.

Bearer krsd_* or session
POST
/api/v1/verify

Verify a file's C2PA manifest (all signable formats plus PDF, verify-only) — returns the full report

Bearer krsd_* or session
GET
/api/standards

Public registry of supported standards (name, label, display name, kind) — drives /sign toggles

Public
GET
/api/v1/usage

Signs this month, free-tier usage, credit balance

Bearer krsd_* or session
GET
/api/v1/signatures?limit=&cursor=

Paginated org signature history (owner and members)

Bearer krsd_* or session
POST
/api/v1/public/verify

Public verification — same report, no account required (30 req/min per IP). /api/verify is a stable alias. See the Public Verification API docs.

Public
GET
/api/org/webhooks

List org verify webhook endpoints (secrets redacted). Team owner/admin.

Session
POST
/api/org/webhooks

Register HTTPS verify webhook; secret returned once. Team owner/admin.

Session
GET
/api/org/{id}

Public organization details

Public
POST
/api/org

Register your organization

Session
POST
/api/v1/billing/charge

Buy credits (Stripe, idempotent)

Session
GET
/api/v1/billing/transactions

Credit ledger — purchases and per-sign spends

Session

Errors follow RFC 7807 problem+json with a machine-readable code field (e.g. insufficient_credits on 402, validation_failed on 415, bad_request on 400).

Code Examples

# One POST = C2PA + standards (1,000 free signs lifetime, then credits)
curl -X POST https://api.krusade.dev/api/v1/sign \
  -H "Authorization: Bearer krsd_your_key_here" \
  -F "[email protected]" \
  -F "author=Jane Doe" \
  -F "standards=iptc,training_mining" \
  -F 'iptc={"creator":["Jane Doe"]}' \
  -o photo.signed.jpg

# Sidecar: unmodified asset + detached .c2pa in a zip
curl -X POST "https://api.krusade.dev/api/v1/sign?manifest=sidecar" \
  -H "Authorization: Bearer krsd_your_key_here" \
  -F "[email protected]" \
  -o clip.c2pa.zip

# Verify any file — public, no account needed
curl -X POST https://api.krusade.dev/api/verify \
  -F "[email protected]"

Full signing fields, sidecar, and error examples: Signing API.

Response Examples

Verify Response

{
  "status": "valid",
  "trusted": true,
  "issuer": "Krusade",
  "assertions": [
    {
      "label": "stds.schema-org.CreativeWork",
      "data": { "author": "Jane Doe" }
    }
  ]
}

Usage Response

{
  "signs_this_month": 7,
  "free_signs_used": 5,
  "free_signs_per_month": 5,
  "credit_balance": 198
}