C2PA sign image API: Content Credentials with one POST

If your product generates images, EU AI Act Article 50(2) expects the outputs to be “marked in a machine-readable format and detectable as artificially generated”. The practical standard for that is C2PA (Content Credentials) — and the fastest way to adopt it is an API call in your generation pipeline:

curl -X POST https://aiact.zalize.com/api/c2pa/sign \
  -H "Authorization: Bearer $AIACT_API_KEY" \
  -F "image=@generated.png" \
  -o signed.png

The response is your image with an embedded, cryptographically signed C2PA manifest carrying a generative-AI assertion. Any conforming verifier — including the public Content Credentials Verify tool — will read it and report the asset as AI-generated.

Try it free in the playground

The API reference pageincludes a live playground: drop in an image (up to 2 MB), get it signed, and inspect the manifest — no account needed. It's the quickest way to show your team what a Content Credential actually looks like before writing integration code.

Why an API instead of running c2patool yourself?

• No signing infrastructure: certificate management, key storage and manifest construction are handled server-side.
• One line in your pipeline: sign at generation time, right before you deliver the file.
• Auditability: usage is tracked per key (see the X-C2PA-Usage header), which pairs well with the evidence pack when you need to demonstrate compliance.

Prefer self-hosting? The open-source route (c2pa-rs / c2patool) is covered in our C2PA guide— it's a fine choice if you have the engineering capacity to run signing infrastructure.

Limits, quotas and errors

• JPEG, PNG and WebP up to 15 MB per image (2 MB in the free playground).
• Monthly quotas by plan: Growth 2,000 images/mo, Agency 20,000 images/mo — quotas reset on the 1st (UTC). Plans.
• Standard error responses for oversized files (413), quota exhaustion (429) and plans without API access (403) — full table in the reference.

FAQ