Content credentials (C2PA)

Content Credentials are tamper-evident manifests attached to an image, video, audio file, or document. The format comes from the C2PA standard, published by the Coalition for Content Provenance and Authenticity. A manifest records which tool created or edited the content and is cryptographically signed, so tampering with it is detectable.

For builders, the main job is not destroying them. Several image-generation APIs already attach Content Credentials to their output, and the EU AI Act's duty to mark synthetic content is pushing more products to rely on them. But ordinary media pipelines strip metadata: resizing, recompressing, format conversion, and CDN optimization can each drop the manifest. The open-source c2patool command-line tool lets you inspect both the provider's original and the version your app serves to see whether the credentials survive.

Credentials have a known weakness: metadata can be removed, so a missing credential proves nothing about where an image came from. That's why they're often paired with invisible watermarks such as Google DeepMind's SynthID, which survive edits better but carry less information. Treat credentials as one layer: also label generated media visibly in your UI, and keep your own record of the provider, model, and generation time for every asset.