How to add C2PA Content Credentials to AI-generated images

What a C2PA manifest is, what an AI-generated image's manifest should say, how to sign one yourself or with an API, and the pitfalls that silently strip it.

7 min read · Updated 27 October 2026 · Markproof

What C2PA is

The Coalition for Content Provenance and Authenticity (C2PA) publishes an open standard for attaching provenance to media files. A C2PA manifest is embedded in the file and contains assertions(statements about how the file was made), all cryptographically signed. If the file changes after signing, the signature no longer matches, so tampering is evident. “Content Credentials” is the consumer-facing name for the same thing.

Because C2PA is an open, widely supported standard, it's a natural fit for the EU AI Act's requirement that marking be interoperable. See what Article 50 requires.

What an AI-generated image's manifest should say

At minimum, a manifest for AI output should record:

• A c2pa.actions assertion with the action c2pa.created.
• A digitalSourceType of http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia, IPTC's term for “created by a trained AI model”.
• Optionally, a softwareAgent naming the app and model that generated the file.

{  "claim_generator_info": [{ "name": "your-app", "version": "1.0" }],  "title": "render.png",  "assertions": [    {      "label": "c2pa.actions",      "data": {        "actions": [          {            "action": "c2pa.created",            "digitalSourceType": "http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia",            "softwareAgent": { "name": "your-app / your-model-v2" }          }        ]      }    }  ]}

Option 1: sign manifests yourself

The C2PA project publishes open-source tools and libraries, including c2patool and SDKs for Rust, Python and JavaScript. The work involved:

1. Get a signing certificate. C2PA tools reject a simple self-signed certificate. You need a chain: a root certificate authority that issues a separate signing certificate.
2. Protect the private key. Anyone who has it can sign files as you. Keep it in a secrets manager, never in your repository.
3. Write the manifest as above, with the full IPTC URI.
4. Sign every output at the point of generation, before the file is converted or uploaded anywhere.
5. Verify the result with a C2PA reader, such as the Content Credentials verify site or our free checker.

This is very doable, but it's infrastructure: certificates, key rotation, expiry, format quirks. It also only gives you one layer.

Option 2: one API call

Markproof signs the manifest with its own certificate chain and records your app and model as the software agent. It also adds an invisible watermark, so the file stays detectable if the manifest is stripped:

curl https://markproof.co/v1/mark \  -H "Authorization: Bearer $MARKPROOF_KEY" \  -F file=@render.png \  -F generator_name="your-app" \  -F model_name="your-model-v2" \  -o render.marked.png -D -

The response is the marked PNG, with its watermark code, a public verification URL and the manifest label in the headers. There are also SDKs for Node.js, Python, the Vercel AI SDK and AI agents.

Pitfalls that silently strip the manifest

A manifest lives in the file's metadata, so anything that rewrites the file can drop it. Typical culprits:

Two practical rules follow: mark as the final step before delivery, and serve the signed file as-is. If you must convert, re-sign afterwards, and rely on the watermark for copies you don't control.

What “untrusted certificate” means

Verifiers often show a valid signature from an untrusted signer. That means the signature is cryptographically valid and the file is unchanged, but the signing certificate isn't on the public C2PA Trust List. It's not a sign of tampering. Getting onto the list involves the C2PA's conformance process.

This guide is general information, not legal advice. Laws and guidance change; check the sources, and talk to a qualified lawyer about your situation.