Do I need my own certificate to produce valid C2PA manifests?

No. A manifest signed with a managed certificate is a valid C2PA manifest — the signature belongs to whoever holds the key, while the claim generator field names the software and brand that created the content. With 0byte, we hold the key and your brand is the claim generator, so the credential reads as yours.

What does a C2PA certificate cost?

If you procure your own, the certificate itself is the cheap part; the cost is the infrastructure and the lifecycle around it — key custody, rotation, revocation handling, and keeping a validator-trusted chain current. Signing through 0byte has a free tier at 60 requests per minute, with higher-throughput tiers above it, and no certificate cost at all.

Can I bring my own certificate later?

Yes — bring-your-own-certificate is on the roadmap for teams that want to hold their own key. The API shape does not change when you switch; the signing identity does.

Will a validator trust a manifest signed by 0byte today?

It will read the manifest as structurally valid and flag that the signer is not yet on the public C2PA trust list, because our certificate is still going through the C2PA Conformance Program. The registry fingerprint match establishes origin independently in the meantime, and our own verification reports each signal separately rather than papering over the gap.

How to Get a C2PA Certificate

What a C2PA certificate actually is

It is an X.509 certificate — the same kind of object that secures HTTPS — used to sign the manifest embedded in a media file. The signature is what makes a C2PA manifest trustworthy rather than merely present: alter one pixel of the content or one field of the claim, and the signature no longer verifies.

Two fields are worth separating, because they are what people usually conflate. The signer is whoever holds the private key. The claim generator is the software and brand credited with creating the content. They do not have to be the same party — and that distinction is the whole reason a managed certificate works.

Route 1 — procure your own certificate

You own the key and the identity. You also own everything around it:

Sourcing. Find a certificate authority whose chain validators accept, and get through its issuance process.
Key custody. Keep the private key in an HSM or KMS, with access controls that survive an audit.
Manifest construction. Build a spec-compliant manifest per asset — assertions, hashes, the claim — and embed it per format without corrupting the file.
Lifecycle. Rotation, revocation, and re-issuance, plus a plan for what happens to already-signed content when a certificate expires.

This is the right route if the signing identity has to be provably yours and nobody else’s — a newsroom attesting to its own photography, for instance. It is a poor use of an engineering quarter if you just need your generated images to carry credentials.

Route 2 — sign through a managed service

0byte holds the certificate and signs on your behalf, naming your brand as the claim generator. One call in, a credentialed file out:

from zerobyte import Client

client = Client(api_key="0b_key_...")

result = client.stamp(
    content=open("art.png", "rb").read(),
    content_type="image/png",
    provider="acme-ai",
    model="imagen-x",
    creator={"name": "Acme Studios", "url": "https://acme.example"},
)

print(result.binding)   # "manifest+registry"
open("art.stamped.png", "wb").write(result.stamped_bytes)

The binding field in the response always tells you what you got: manifest+registry when the manifest was embedded, or registry_only for formats c2pa-rs cannot embed into. It is never silent about the difference.

Check the result yourself

Do not take our word for it. Stamped files are ordinary C2PA files, so the standard tooling reads them:

# confirm the manifest reads back
c2patool art.stamped.png

# the claim generator names your brand, not ours

Trust lists and the Conformance Program

A validator does two separate things: it checks that the manifest is cryptographically intact, and it checks whether the signer appears on a trust list it recognises. Those can disagree, and it is worth knowing which one you are looking at.

Where we stand today

0byte’s certificate is going through the C2PA Conformance Program. Until it completes, validators will report a stamped file’s manifest as structurally valid while noting the signer is not on the public trust list. We say so here rather than letting you discover it in a validator, and our own verification reports the manifest signal and the registry signal separately for exactly this reason.

The part a certificate cannot solve

A certificate gets you a signed manifest. It does not keep that manifest attached to the file. Most platforms re-encode on upload and drop metadata, so the credential you carefully signed is frequently gone by the time anyone looks.

The C2PA specification’s own answer is a soft binding: a fingerprint derived from what the content looks like, stored outside the file. Every 0byte stamp writes one into a public, append-only transparency log, so a screenshot of a re-uploaded copy still resolves back to the original record.

Common questions

Do I need my own certificate to produce valid C2PA manifests?: No. A manifest signed with a managed certificate is a valid C2PA manifest — the signature belongs to whoever holds the key, while the claim generator field names the software and brand that created the content. With 0byte, we hold the key and your brand is the claim generator, so the credential reads as yours.
What does a C2PA certificate cost?: If you procure your own, the certificate itself is the cheap part; the cost is the infrastructure and the lifecycle around it — key custody, rotation, revocation handling, and keeping a validator-trusted chain current. Signing through 0byte has a free tier at 60 requests per minute, with higher-throughput tiers above it, and no certificate cost at all.
Can I bring my own certificate later?: Yes — bring-your-own-certificate is on the roadmap for teams that want to hold their own key. The API shape does not change when you switch; the signing identity does.
Will a validator trust a manifest signed by 0byte today?: It will read the manifest as structurally valid and flag that the signer is not yet on the public C2PA trust list, because our certificate is still going through the C2PA Conformance Program. The registry fingerprint match establishes origin independently in the meantime, and our own verification reports each signal separately rather than papering over the gap.

Ready to put credentials on your own output?

No certificate to procure, no spec to learn. Verification stays free for everyone, forever.

Start with the SDK Join Waitlist