Doing C2PA yourself

Content Credentials and invisible watermarks are open standards and open-source models: you can run them yourself. Here is what that takes, piece by piece, so you can choose.

In short

Yourself: a signing library, a certificate and its key, time-stamps, three watermark models, read-back, a manifest store, a public checker, and the laws to follow.
With us: one API call, free up to 1,000 marks a month.
Either way: the marks are open standards: anyone's tools can read them.

The pieces

What adding C2PA and watermarks takes, yourself or with Kennmarq.com
Piece	Yourself	Kennmarq.com
A C2PA manifest	c2pa-rs, c2pa-python or c2pa-node, and a manifest design: actions, IPTC source types, your provider and system, ingredients	Done, with California's five items
A signing certificate	A certificate chain readers accept, its private key in a hardware module or a cloud KMS, and renewals	Ours, in AWS KMS; Enterprise can sign as you
Time-stamps	An RFC 3161 time-stamp authority you trust and pay per stamp, or run	Ours, every stamp in a public log
Watermarks	TrustMark, Video Seal and AudioSeal running on your servers (CPU or GPU), their strength tuned, and every file read back	Done, read back before the file leaves
Lost metadata	A store of manifests by watermark ID, and an endpoint to look them up	Done: durable credentials
A free detector	A public page or API that reads both marks, which the EU's Code and California ask for	kennmarq.com/check and POST /v1/verify
The laws	Following the EU, California, Washington, Utah and those to come, and changing your marks when they change	Receipts per law; we keep the formats current
Proof	Robustness tests, logs, and answers for an auditor	Published tests and a transparency log

When doing it yourself makes sense

If you already run GPUs and a certificate authority, mark millions of files a day offline, or must keep every byte in your own network, running the open-source pieces can pay off. For that last case, our local mode (coming soon) makes the watermark and the manifest on your machine and sends us only the manifest to sign, and Enterprise offers private deployment.

Or one call

curl

curl https://api.kennmarq.com/v1/mark \
  -H "Authorization: Bearer $KENNMARQ_API_KEY" \
  -F file=@image.png -F source=created \
  -F provider="Acme Inc." -F app_name="Acme Studio" -F app_version="2.1" \
  -F markets=eu,us-ca \
  -o image.marked.png

Get a free key, or read the Quickstart.