Skip to content

Docs

One signing API for media provenance

C2PA Content Credentials plus IPTC, EXIF, CAWG, PLUS, and XMP — from your CMS, CDN, or pipeline. New to Content Credentials? Start with What is C2PA?, then the Signing API and Public Verification guides.

Getting started

From zero to a signed, verifiable file in four steps.
  1. Create an account and generate your krsd_* API key — the first 1,000 signs are free (lifetime), no card needed.
  2. Protect a file: one POST to /api/v1/sign with your key (and optional standards fields). The signed copy comes back with the credential embedded — or use ?manifest=sidecar for a detached .c2pa ZIP.
  3. Verify anywhere: our public /api/verify endpoint, c2patool, or Adobe Content Credentials — no Krusade software required.
  4. Past the free tier, signing costs $0.015 per sign via credits (Team: $0.010 after monthly included signs). Buy credits from your account; failed signs are never charged.

Code examples

# One POST = C2PA + standards (1,000 free signs lifetime, then credits)
curl -X POST https://api.krusade.dev/api/v1/sign \
  -H "Authorization: Bearer krsd_your_key_here" \
  -F "[email protected]" \
  -F "author=Jane Doe" \
  -F "standards=iptc,training_mining" \
  -F 'iptc={"creator":["Jane Doe"]}' \
  -o photo.signed.jpg

# Sidecar: unmodified asset + detached .c2pa in a ZIP
curl -X POST "https://api.krusade.dev/api/v1/sign?manifest=sidecar" \
  -H "Authorization: Bearer krsd_your_key_here" \
  -F "[email protected]" \
  -o clip.c2pa.zip

# Verify any file — public, no account needed
curl -X POST https://api.krusade.dev/api/verify \
  -F "[email protected]"

Full signing fields, sidecar, and error examples: Signing API.

API reference

POST
/api/v1/sign

One POST stamps JPEG/PNG/WebP/AVIF/MP4/MOV/audio with a C2PA credential + optional standards selector. ?manifest=sidecar returns a ZIP. 400 bad input, 402 insufficient_credits, 415 unsupported type. 64 MB cap.

Bearer krsd_*
POST
/api/v1/verify

Verify a file's C2PA manifest (all signable formats plus PDF, verify-only) — returns the full report

Bearer krsd_*
GET
/api/standards

Public registry of supported standards — drives standards selectors

Public
GET
/api/v1/usage

Signs this month, free-tier usage, credit balance

Bearer krsd_*
GET
/api/v1/signatures?limit=&cursor=

Paginated org signature history (owner and members)

Bearer krsd_*
POST
/api/v1/public/verify

Public verification — same report, no account required (30 req/min per IP). /api/verify is a stable alias.

Public
GET
/api/org/webhooks

List org verify webhook endpoints (secrets redacted). Team owner/admin.

Session
POST
/api/org/webhooks

Register HTTPS verify webhook; secret returned once. Team owner/admin.

Session
GET
/api/org/{id}

Public organization details

Public
POST
/api/org

Register your organization

Session
POST
/api/v1/billing/charge

Buy credits (Stripe, idempotent)

Session
GET
/api/v1/billing/transactions

Credit ledger — purchases and per-sign spends

Session

Errors follow RFC 7807 problem+json with a machine-readable code field (e.g. insufficient_credits on 402, validation_failed on 415, bad_request on 400). Full contract on the REST reference page.

Response samples

Verify response

{
  "status": "valid",
  "trusted": true,
  "issuer": "Krusade",
  "assertions": [
    {
      "label": "stds.schema-org.CreativeWork",
      "data": { "author": "Jane Doe" }
    }
  ]
}

Usage response

{
  "signs_this_month": 7,
  "free_signs_used": 5,
  "free_signs_lifetime_limit": 1000,
  "credit_balance": 198
}