Original Pictures
C2PA signing and verification API for AI platforms
Sign every AI-generated image, video and audio file with C2PA Content Credentials in one call. Add an invisible watermark or a fingerprint when a file has to stay traceable after its metadata is gone.
Standards, programs and platforms we build with
What it looks like in your product. A generative AI site adds one call to its publish step.
Four capabilities. One API key.
Signing is the default. Watermarking and fingerprinting are opt-in per request. Each service is metered on its own, so you pay only for what a job runs.
photo.jpg · Content Credentials manifestC2PA 2.4
claimwho signed, with what software
assertions
- c2pa.actionscreated / opened, digitalSourceType
- c2pa.hash.databinds the exact bytes
- c2pa.soft-bindingimage fingerprint, when requested
- c2pa.ingredientthe file it was made from
signature
- x.509 certificate chainthe signing certificate
- RFC 3161 timestampswitched on with the production certificate
- RESULT
- Valid · C2PA 2.4
- BINDING
- sha256 of every byte outside the manifest
- SIGNER
- Checked against the C2PA trust list
C2PA signing
A signed C2PA 2.4 manifest that records origin and binds the exact bytes of the file, across 52 media types. Any C2PA-aware tool can read it.
Signed
Copy
RESULTMatch · record found, a leadPictures: AI-generated illustrations. Content fingerprinting
Perceptual fingerprints kept on our servers, scoped to your account, so a copy without credentials can be traced back.
POST /v1/verifications · what a result can say - ValidUnchanged since the signer signed it
- Does not matchThe bytes changed after signing
- No Content CredentialsOrigin unknown, which is not the same as fake
Verification API
Validate the manifest against the bytes and check the signer. When no manifest survives, search your watermarks and fingerprints.
- MANIFEST
- Stripped on re-upload
- WATERMARK
- Meta PixelSeal · found
- RESULT
- Record recovered, a lead
AI watermarking
An invisible watermark in the pixels or audio samples, embedded before signing. Built for the copies that lose their metadata.
Upload a file. Sign it with one call.
The simplest request signs with C2PA Content Credentials and nothing else. Set watermark or fingerprint to true to add either. The full script shows the upload before it and the poll after it.
# OP_API: your API endpoint. OP_API_KEY: a key from the console.
curl -X POST "$OP_API/v1/sign" \
-H "Authorization: Bearer $OP_API_KEY" \
-H "Idempotency-Key: $(uuidgen)" \
-H "Content-Type: application/json" \
-d '{"asset_id": "ast_...",
"watermark": false,
"fingerprint": false}'202 Acceptedresponse
{
"job_id": "job_...",
"asset_id": "ast_...",
"state": "accepted",
"watermark": false,
"fingerprint": false
}The record travels with the file. When a platform strips it, your watermark can lead back to it.
- MANIFEST
- Embedded · valid
- WATERMARK
- In the pixels or samples
- RESULT
- Declared origin readable
Recovery is a lead back to your signed record, not cryptographic proof. Picture: AI-generated illustration.
The new rules on AI labels. Provenance supports the work. It is not legal compliance by itself.
| Law | From | What it asks |
|---|---|---|
| EU AI Act, Article 50 | 2 Aug 2026 | Mark AI output in a machine-readable way, detectable as AI-generated. |
| California AI Transparency Act | 2 Aug 2026 | Embed a latent disclosure in AI image, video and audio; offer a free check. |
| China, Deep Synthesis Provisions | 10 Jan 2023 | Label synthetic content visibly and with an implicit, machine-readable mark. |
A summary, not legal advice. Each guide gives the source and its review date.
One platform fee, then pay per unit, less at volume.
Sign, watermark, fingerprint and verify are each metered on their own.
$99/ month
Access to the signing, watermarking, fingerprinting and verification APIs. Usage billed per unit.
| Monthly units | Sign, watermark or fingerprint | Verify |
|---|---|---|
| 1 – 10,000 | $0.015$15 per 1,000 | $0.0015$1.50 per 1,000 |
| 10,001 – 100,000 | $0.010$10 per 1,000 | $0.0010$1 per 1,000 |
| 100,001 – 1,000,000 | $0.005$5 per 1,000 | $0.0005$0.50 per 1,000 |
| 1,000,001+ | $0.0025$2.50 per 1,000 | $0.00025$0.25 per 1,000 |
Prices in USD, excluding tax. Graduated: each band's rate applies only to the units within that band, and each service counts its own units in the month. Failed and cancelled jobs are not charged. Enterprise volumes, dedicated SLAs and custom terms on request.
What a signature tells you. And what it doesn't.
- Who declared they made or published the file
- Whether the bytes changed since it was signed
- Which tools the signer declared, including AI
- Whether the depicted event happened
- That an unsigned file is fake
- Legal compliance, on its own
Nothing on this site is legal advice.
Questions
Does Original Pictures tell me whether a file is real or fake?
No. It shows declared origin: who signed a file, what the signer recorded about how it was made, and whether the bytes changed since. It does not judge whether the content is authentic or whether a depicted event happened.
What is Original Pictures?
Original Pictures is a C2PA signing and verification API for AI platforms and other publishers of media. You upload a file, choose what to add with plain request flags, and receive it back with signed Content Credentials. An invisible watermark and server-side fingerprints are optional. You can use it through a REST API or the web console.
How do I sign AI-generated images with C2PA?
Create an API key in the console, upload the image, and call POST /v1/sign with watermark and fingerprint set to false. The API returns a job. Poll it, or wait for a webhook, then download the signed file. To declare AI origin in the manifest, add an ai_declaration with the IPTC digital source type. It is accepted when watermark is false.
Do I have to watermark or fingerprint?
No. The default request signs with C2PA Content Credentials only. Add a watermark by setting watermark to true, or a watermark and fingerprints by also setting fingerprint to true. Each is metered and billed on its own.
Does C2PA metadata survive screenshots and re-uploads?
No. Content Credentials live in file metadata, and screenshots, many re-encodes and some CDNs remove them. That is why you can add an invisible watermark and server-side fingerprints. When a verification finds no manifest, it can search those signals. A match is reported as recovery, which is a lead, and never as cryptographic proof.
Does using Original Pictures satisfy EU AI Act Article 50 or the California AI Transparency Act?
No product can promise that. Original Pictures supports the work with machine-readable marking, detection through the verification API and records for your compliance file. Compliance also depends on your disclosures, testing, terms and governance. Ask your counsel. Nothing on this site is legal advice.
Which file types are supported?
Sign, watermark and fingerprint: JPEG, PNG, WebP, TIFF, AVIF, WAV, MP3 and MP4. Sign and fingerprint: AAC audio in MP4. Sign only: further image, audio and video containers. A sidecar manifest covers documents, plain text, fonts and model files. The supported formats page lists every type and its upload limit.
What happens if Original Pictures shuts down?
Credentials embedded in your files stay readable by any C2PA-aware validator, because the standard is open. Watermark and fingerprint recovery uses our records, so it depends on the service being available.
Where is the API documentation?
At https://docs.originalpictures.com: a quickstart, an API reference generated from the OpenAPI contract and a guide for AI coding agents.
Sign a test file with your own API key
Create an account, issue a key with one click and make your first sign call. If you need a walkthrough for your legal and engineering teams, book a demo.