Skip to content

Check a file's Content Credentials

See who signed a file, which edits were recorded, whether it declares itself AI-generated, and whether the signature still matches the bytes. Verify in the console or through the API.

Verify in the consoleRead the verify guide
POST /v1/verifications · what a result can say
  • ValidUnchanged since the signer signed it
  • Valid · signer not on the trust listUnchanged; treat the signer name as a claim
  • Does not matchThe bytes changed after signing
  • No Content CredentialsOrigin unknown, which is not the same as fake
  • Declared AI-generatedThe signer recorded a digital source type
  • RecoveredWatermark or fingerprint matched your record: a lead

A signed sample, inspected. Download it and check it with any C2PA tool.

c2pa-test-signed-sample.jpgConformance fixture · recorded, not live
The sample: a test image of placeholder text

202 KB JPEG, of which 107 KB is the manifest store.

Download the sample

Valid · signer not on the trust list

Signed by
C2PA Signer · C2PA Test Signing Cert
Algorithm
PS256
Claim
v2 · Original Pictures SIGN-05 conformance harness
Action
c2pa.created · trainedAlgorithmicMedia (conformance test file, declared by the signer)
Timestamp
None in this sample
Assertions (5)
  • c2pa.actions.v2
  • c2pa.hash.data
  • c2pa.ingredient.v3
  • c2pa.thumbnail.claim
  • c2pa.thumbnail.ingredient
Validation codes (9)
  • ✓ claimSignature.insideValidity
  • ✓ claimSignature.validated
  • ✓ assertion.hashedURI.match
  • ✓ assertion.hashedURI.match
  • ✓ assertion.hashedURI.match
  • ✓ assertion.hashedURI.match
  • ✓ assertion.hashedURI.match
  • ✓ assertion.dataHash.match
  • ! signingCredential.untrusted

A test file signed with the public C2PA test certificate, which is not on the trust list. Report recorded with c2patool 0.27.16 on 2026-10-19. Download it and check it with any C2PA tool.

How the check works

  1. Read the manifest

    Content Credentials are a signed C2PA manifest stored in the file. Some formats keep it in a separate .c2pa file.

  2. Validate the signature and binding

    The signature must be intact, and the file must still match the hash recorded in the manifest.

  3. Check the signer

    The signer is checked against the C2PA trust list. A signer not on the list can still have a valid signature.

  4. Look for a hidden signal

    If no credentials remain, a watermark or fingerprint can match a record of a file your account signed. That is recovery, never proof.

What a result means, and what it does not

Valid. The file is what the signer produced, with no changes since it was signed. It does not prove that the scene shown happened. Signers declare what they did; the check confirms who declared it and that the bytes have not changed.

Valid, signer not on the trust list. The file has not changed since it was signed by whoever holds that certificate. It does not confirm the signer's identity. Treat the signer name as a claim.

Tampered or does not match. Do not rely on the history recorded in the file. A mismatch is not always malicious: resizing, re-saving or uploading through a platform changes the bytes of a signed file.

No Content Credentials. The origin of the file is unknown. Most files carry none, and screenshots and many re-encodes remove them. No credentials does not mean fake, and it does not mean authentic.

Declared AI-generated. The signer recorded an IPTC digital source type such as trainedAlgorithmicMedia. We cannot confirm that the declaration is complete, and a file without this flag can still be AI-generated.

Recovered by watermark or fingerprint. The file is probably a copy of a file your account signed. It is a lead, not cryptographic proof.

Is this image AI-generated?

Verification reads what a file declares about its origin. It is not an AI detector and gives no verdict on whether content is real or fake. When credentials are present and intact, they tell you what the signer declared. When they are absent, the honest answer is that the origin is unknown.

Verify without us

Content Credentials follow the open C2PA standard, so any C2PA-aware tool can read an embedded manifest without calling our API. Watermark and fingerprint recovery uses our records and needs an account.

Verify through the API

Upload the file, then submit its object identifier. The result arrives asynchronously, with reason codes.

# Verify an object stored in your account. OUTPUT_OBJECT_ID is the signed
# object named in the job's receipt, or the object id of any completed upload.
curl -sS -X POST "$OP_API/v1/verifications" \
  -H "Authorization: Bearer $OP_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d "{\"object_id\": \"$OUTPUT_OBJECT_ID\"}" > verification.json

# 202 returns a pollable verification. Poll until state is completed or failed.
curl -sS "$OP_API/v1/verifications/$(jq -r .verification_id verification.json)" \
  -H "Authorization: Bearer $OP_API_KEY" | jq .

Verification questions

Do I need an account to verify a file?

To verify with Original Pictures, yes: verification runs in the console or through the API with an API key. Any C2PA-aware tool can also read embedded credentials without an account.

Can I verify a file another product signed?

Yes. Upload it and submit it for verification. For a sidecar format, upload the asset and its .c2pa file and send both object identifiers.

How much does a verification cost?

One verification is one unit, from $0.0015 down to $0.00025 per verification as your monthly volume grows.

Need a verification flow for your users?

Book a demo and we will show how the verification API fits your product.

Book a demoVerify in the console