Select a supported image or document.
Controlled C2PA signing
Create Content Credentials and verify the result
Use local test certificates for learning and prototypes, or import organization-controlled signing material for a managed workflow.
A successful test signature proves the workflow functions. It does not create public ecosystem trust.
Signing flow
Prepare, describe, sign and verify
Keep the declaration, certificate and resulting report together as one reviewable workflow.
Generate a test certificate or import supported material.
Add the available provenance information and create the credential.
Inspect integrity, signature and trust-chain results.
Choose the right context
Testing and production are different trust models
The cryptographic operation may be similar; governance and recognition are not.
Test signing
- Fast setup for demonstrations
- Useful for development and training
- Expected to appear as untrusted publicly
- Not evidence of a recognized organization
Production signing
- Organization-controlled identity process
- Protected private keys
- Certificate lifecycle and revocation
- Trust policy and operational auditability
Security checklist
Treat signing keys as production credentials
Do not copy a test workflow into production without an explicit key-management and certificate policy.
Use least privilege and separate human, service and administrative roles.
Prefer managed or hardware-backed storage for production material.
Document expiry, compromise response and certificate replacement.
Before deployment
Verify how external validators will present the result
Always test the signed output in the intended distribution environment. A valid signature, a recognized certificate chain and a trusted organizational identity are related but distinct results.