Learn

How a C2PA signing API should work

A signing API accepts allow-listed fields only. Keys stay in KMS/HSM. Every signature is verified immediately; failure is failure.

Phase-1 templates are AI Generated and Edited, so users cannot casually issue “camera capture” claims.

Author: Roma Verify Editorial · Reviewed: Roma Verify Engineering · Updated: 2026-09-16

Sources