What is C2PA? A Developer's Guide to Content Provenance

As AI-generated content becomes indistinguishable from human-created media, the ability to verify the origin and history of digital files is more important than ever. This is where C2PA comes in.

What is C2PA?

The Coalition for Content Provenance and Authenticity (C2PA) is an open technical standard that provides a way to embed verifiable metadata — called manifests — directly into digital media files. Think of it as a tamper-evident seal for images and videos.

Founded by Adobe, Microsoft, Intel, and others, C2PA defines how provenance data is structured, signed, and verified. Major platforms including Google, Meta, and OpenAI have adopted or are adopting C2PA for content credentials.

How does it work?

A C2PA manifest contains three key pieces of information:

• Assertions: Claims about the content — who created it, what software was used, what edits were made, and crucially, whether it was AI-generated.
• Signature: A cryptographic signature from the tool or service that created/edited the file. This lets you verify the assertions haven't been tampered with.
• Ingredients: References to source files, creating a chain of provenance when content is derived from other content.

Why developers should care

If you're building any application that handles user-uploaded media — social platforms, marketplaces, news aggregators, content moderation tools — C2PA verification gives you a reliable signal about content authenticity.

Common use cases:

• Flagging AI-generated images in content moderation pipelines
• Displaying provenance badges on published content
• Verifying photojournalism authenticity
• Building trust indicators for marketplace listings

Verifying C2PA with Provn

Reading and validating C2PA manifests requires cryptographic verification and parsing complex JUMBF (JPEG Universal Metadata Box Format) data. Rather than integrating the C2PA library directly, you can use the Provn API to verify files with a single HTTP request:

curl -X POST https://provn.dev/api/v1/verify \
  -H "Authorization: Bearer provn_sk_xxx" \
  -F "file=@photo.jpg"

The response tells you whether the file has provenance data, if the signature is valid, who created it, and whether it was flagged as AI-generated.

Get a free API key and start verifying content in minutes.