Name who stands behind a file

A CAWG identity assertion adds a named organisation or creator to a file's C2PA manifest, signed with an identity certificate of its own. Coming soon — available once the identity certificate is enrolled. Contact us to register interest.

Book a demo What is a CAWG identity assertion?

cawg.identity · v1.3Coming soon

Assertion: cawg.identity
Signature type: cawg.x509.cose
Names: Studio Nova (organisation) or a named creator
Credential: Individual (IV) or organisation (OV) certificate

GET /v1/identity-credentials

{
  "data": [],
  "cawg_available": false,
  "unavailable_reason":
    "CAWG: identity certificate not enrolled yet"
}

Two signatures. Two different questions.

Which service signed the file
Every file is signed with our C2PA certificate, as today. That signature binds the bytes and records what the signer declared.
Who the file is from
The identity assertion names your organisation or a creator and is signed with an identity certificate issued to you. Validators that read CAWG show both.

How it will work

CAWG identity is coming soon: it becomes available once the identity certificate is enrolled. Setting it up will take three steps:

Choose the certificate. Organisations need an organisation-validated (OV) identity certificate; an individual creator needs an individual-validated (IV) one. The certificate authority checks who you are before issuing it.
We enrol it. Our team checks the certificate chain and its key usage and stores a reference to the signing key, never the key itself. Enrolment is not something a key or a console user can do.
Send identity in the sign request. Once the credential is active, a sign request that names it gets the identity assertion. Requests without it are signed exactly as before.

Today, the console shows the identity control disabled with the reason, and the API answers a request that names an identity with 409 IDENTITY_CREDENTIAL_NOT_ENROLLED.

Price

Identity key	Indicative price	Status
Individual	$99 a year	Coming soon, on request
Organisation	$199 a year	Coming soon, on request

Signing with an identity assertion is billed as any other signing job. See pricing.

One field in the sign request. Refused until identity signing ships.

The identity is one object in the body. Until identity signing ships and your credential is active, the API refuses the request instead of signing without it.

sign.sh

# Coming soon — available once the identity certificate is enrolled. The request will look like this:
curl -sS -X POST "$OP_API/v1/sign" \
  -H "Authorization: Bearer $OP_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"asset_id": "ast_...",
       "watermark": false,
       "fingerprint": false,
       "identity": {"credential_id": "idc_..."}}'

409 Conflict (today: no identity credential is enrolled)response

{
  "code": "IDENTITY_CREDENTIAL_NOT_ENROLLED",
  "message": "CAWG: identity certificate not enrolled yet",
  "retryable": false
}

CAWG identity questions

Can I turn on CAWG identity myself?

Not yet. Coming soon — available once the identity certificate is enrolled, and our team enrols the certificate for you. Contact us to register interest.

Does it change the C2PA signature?

No. The manifest is still signed with our C2PA certificate. The identity assertion is a separate assertion inside it, signed with your identity certificate.

Does an identity assertion make a file trustworthy?

It tells a reader which organisation or creator vouches for the file, as checked by the certificate authority. It does not say whether what the file shows happened.

Register interest in CAWG identity

Tell us whether you need an organisation or an individual identity, and we will tell you when identity signing is ready.

Book a demo See pricing