C2PA Content Credentials in a DAM: what gets verified, what it proves, and how freedam handles it

Content Credentials are the first widely deployed way to attach a signed history to an image or video and check it later. Cameras from Leica, Sony and Google sign at capture, Adobe's tools and OpenAI's image models sign what they produce, and an open specification defines how anyone can verify the result. This guide explains what is actually inside a credential, what a verifier can and cannot conclude from it, which devices and tools write them today, and what freedam does with them from the moment a file is uploaded. Every claim about the standard links to the specification or to the vendor's own documentation, with the date it was checked, because these pages change.

Checked on 2026-09-11 unless stated otherwise.

What a Content Credential is

The technical name is a C2PA manifest, after the Coalition for Content Provenance and Authenticity that publishes the C2PA Technical Specification, currently at version 2.4. The Content Authenticity Initiative, the industry group that promotes it, describes the result as a nutrition label for digital content: verifiable metadata about how a file was made and edited, cryptographically signed so that changes made afterwards can be detected.

A manifest has three parts:

Assertions are statements about the asset. The most useful one is the actions list, which records what was done to the content: c2pa.created, c2pa.opened, c2pa.edited, c2pa.cropped, c2pa.color_adjustments, c2pa.resized, c2pa.converted, c2pa.placed and a few more, defined in section 18.15 of the specification. Each action can name the software that performed it and a digital source type (more on that below). Ingredient assertions, section 18.16, list the source files that went into a composite, each with a reference to its own manifest when it had one.
A claim binds those assertions to the bytes of the file. The specification calls this a hard binding (section 9): a hash of the content, excluding the manifest itself, so that any change to the pixels breaks the match.
A signature over the claim, made with an X.509 certificate, plus an optional timestamp from a timestamp authority so the signature stays checkable after the certificate expires.

Manifests chain. When Photoshop opens a camera file and exports it, the export gets a new active manifest whose ingredient points at the camera's manifest, which travels along inside the file. A verifier sees the whole store, not only the latest entry.

What a verifier actually checks

Section 14.3 of the specification defines the states a verifier reports, and the difference between them matters more than most summaries admit:

Well-formed: the manifest parses.
Valid: the signature verifies, the hard binding matches the bytes, the timestamp (if present) verifies, and every assertion is structurally correct.
Trusted: valid, and the signing certificate chains to a root on the verifier's trust list.
Invalid: any of those checks failed. The specification says a validator must not rely on the claims of an invalid manifest.

The trust list is where the ecosystem draws the line between "someone signed this" and "a known party signed this". C2PA runs a conformance program that evaluates generator products and validator products; only products with a conformance record can obtain production signing certificates from an approved certificate authority, and only those certificates chain to the official C2PA trust list, published as a PEM bundle on GitHub. An earlier interim trust list was frozen on 1 January 2026 and no longer accepts entries, per the conformance page.

This has a practical consequence that vendors rarely spell out. Sony's own Camera Authenticity Solution page says the default C2PA certificate it provides free of charge "does not guarantee" signature validity, and that organisations needing that assurance should use a trust-list backed certificate instead. A file signed with the default certificate is valid but not trusted: the history is intact and the pixels are unchanged since signing, but no third party vouches for who signed it. The open-source c2patool reports this exact case as signingCredential.untrusted. Any DAM that collapses the two states into one "verified" badge is overstating what it knows.

Who signs today

Support arrived from three directions.

Cameras. Leica's M11-P, announced in October 2023, was the first camera with Content Credentials built in, using a dedicated chip to hold the certificate. Sony added C2PA signing by firmware to a growing list of Alpha bodies; its authenticity page lists ten still-image models as of May 2026, including the α1 II, α9 III, α7 IV and α7R V, with video signing on several of them. Google's Pixel 10, announced 10 September 2025, signs every JPEG from the Pixel Camera app, edited or not, and its camera app reached Assurance Level 2 in the conformance program, the highest level defined.

Editing tools. Adobe applies Content Credentials automatically to any asset where all pixels come from Firefly, according to its Firefly documentation. In Photoshop, attaching credentials to an export is a setting the user enables under Window > Content Credentials, per the Photoshop help page, so a Photoshop export does not carry credentials unless someone switched them on.

AI generators. OpenAI embeds C2PA metadata in images its models produce and pairs it with a SynthID watermark, as described in its help centre article on provenance signals. The same article states the limitation plainly: metadata "can sometimes be removed by platforms, editing tools, or file conversions", which is why OpenAI also uses a watermark that survives some transformations.

The signal that matters for AI is a field, not an action name. Actions carry a digitalSourceType from the IPTC digital source type vocabulary. Two values mean an AI model produced pixels: trainedAlgorithmicMedia ("created algorithmically using an Artificial Intelligence model trained on captured content") and compositeWithTrainedAlgorithmicMedia ("augmentation, correction or enhancement using a Generative AI model, such as with inpainting or outpainting"). digitalCapture means a real-life source recorded with a camera. algorithmicMedia means a formula with no training data, and is not AI in the sense people usually mean. The C2PA guidance for AI and machine learning says a generated asset's c2pa.created action should carry trainedAlgorithmicMedia. IPTC retired the older digitalArt term on 17 September 2024 in favour of digitalCreation, so a reader that only knows the old term will misread newer files.

What credentials cannot tell you

Four limits follow directly from the design, and any provenance feature should be judged against them.

Absence proves nothing. A file without a manifest may be a photo from a camera that does not sign, an export from a tool where signing was off, or a signed file that went through a platform that stripped it. Most files in a working library have no credentials today, and that will stay true for years.
Credentials do not survive re-encoding. The hard binding hashes the bytes. Resize, recompress or convert the file and the hash no longer matches, so the manifest is either stripped by the tool or reported as invalid. A resized rendition of a signed original is, from the verifier's point of view, an unsigned new file unless the tool that made it signs again with the original as an ingredient.
Valid is not trusted. Anyone can sign a manifest with a self-issued certificate, including one that claims digitalCapture. Only a trust-list certificate makes an origin claim worth relying on.
The record is what the signer chose to record. A manifest documents the actions the signing software declared. It does not analyse the pixels, and it cannot detect AI involvement that a tool did not declare.

The verifier can only say: this file's bytes are unchanged since a specific certificate signed a specific list of statements, and here is whether that certificate is on the trust list. That is a strong statement. It is not a lie detector.

How freedam handles Content Credentials

freedam verifies every uploaded original with c2patool, the command-line verifier maintained by the Content Authenticity Initiative, against the official C2PA trust list. The result is stored with the asset and shown on the asset page, on gallery cards and in the filters. The user-facing details are in the Content Credentials documentation; this section explains the design choices.

Verification happens at upload, on the original. The manifest is read and validated as part of metadata extraction, before previews are generated. The trust list ships inside the application image and a scheduled job downloads the current PEM bundle from the C2PA conformance repository every week, so a signer that joins the trust list becomes trusted without a redeploy. A verification failure never blocks an upload: the file is ingested normally, and an administrator can re-run verification across the library later, for example after the trust list changes or for files uploaded before the feature existed.

The status keeps the specification's distinctions. Each asset gets one of four values, mapped from the verifier's validation state: Verified (valid and chained to the trust list), Signed, unverified signer (valid but the certificate is not on the trust list, the Sony default-certificate case), Invalid (the signature or the content hash failed) and No credentials (no manifest at all). A file that has never been checked is distinguishable from one that was checked and had nothing.

Two origin markers are derived from every manifest in the file, not only the active one. A Photoshop export of a Leica capture keeps the camera manifest as an ingredient, so the camera origin is still there to read. The AI-generated marker is set when any action or ingredient anywhere in the store carries trainedAlgorithmicMedia or compositeWithTrainedAlgorithmicMedia, and it is kept even when the manifest is invalid, because a tampered file should not lose its AI flag. The camera-captured marker requires a c2pa.created action with digitalCapture and a Verified status, because a self-signed capture claim is not evidence.

The asset page shows the record itself. The Content Credentials section lists the signer's certificate issuer and signing time, the software that wrote the manifest, the full action history with the tool and source type per step, the ingredients with whether each carried its own manifest, and, for invalid files, the verifier's validation notes such as a content hash mismatch. Nothing is summarised into a single score.

Filters make provenance operational. Three rule-engine fields (credential status, AI-generated, camera-captured) sit under a Content Credentials group in the advanced filters, combine with every other rule, and are reachable from one click on the status pill of any asset. Excluding AI-generated files from a campaign selection, or keeping only verified camera captures for an editorial use, is a saved filter rather than a manual review. The same three fields are returned by the REST API for every asset.

Originals keep their credentials; renditions do not. Downloading the original file returns the bytes that were verified, manifest included. Previews, resized downloads and format conversions are new files and carry no credentials, as the standard implies. freedam does not yet sign the files it produces; that step, which requires a certificate from the conformance program, is the natural next one.

Supported formats follow the verifier's own format list: JPEG, PNG, WebP, AVIF, HEIC and HEIF, TIFF, DNG, GIF, SVG, JPEG XL, MP4, MOV, AVI, MP3, WAV, FLAC and M4A, with PDF read-only. Office documents and archives are recorded as having no credentials without being scanned.

Where the standard is heading

Two developments will change what a DAM can do with credentials.

The first is signing becoming affordable for software products. Generator products must pass the conformance program's security requirements at Assurance Level 1 (encrypted keys, least-privilege access, key rotation, dependency vulnerability scanning) or Level 2 (hardware-backed attestation). Since mid-2026 the certificate authority SSL.com issues a free Level 1 signing certificate to products with a conformance record, which removes the cost barrier for a platform that wants to sign the renditions it creates, with the original as a declared ingredient.

The second is version 2.4 of the specification itself, which lets an ingredient added without its own manifest carry a digitalSourceType. That closes a gap for composites: a layout that places an AI-generated element from a tool that never signed can still declare the element's origin.

Frequently asked questions

Does a DAM need Content Credentials support?

It needs it as soon as a library mixes camera originals, retouched exports and AI-generated images and someone has to decide which is which. Manual review does not scale, and file names lie. Verification at upload turns the question into a filter.

Can Content Credentials be faked?

A manifest can be signed by anyone with any certificate, which is why the trust list exists. What cannot be faked without detection is a change to the pixels after signing, because the hash no longer matches. A verifier that reports the trust state separately from the validity state, as the specification requires, makes the difference visible.

Why does my Photoshop export have no credentials?

Photoshop only attaches Content Credentials when the option is enabled under Window > Content Credentials, and platforms that re-encode files on upload strip them. Firefly-generated assets are signed automatically.

Are AI-generated images always marked?

Only when the generating tool signs them. OpenAI and Adobe Firefly do; not every generator does, and credentials can be removed by re-saving the file. Absence of a marker is not evidence that no AI was involved.

What happens to credentials when freedam resizes an image?

They are not carried into the resized file, because the standard binds the manifest to the exact bytes. The original keeps them and remains available for download. Signing renditions with the original declared as an ingredient is possible under the standard and requires a conformance certificate, which freedam does not hold yet.

To see verification on your own files, upload a signed image to the free plan and open it; the Content Credentials section appears below the EXIF data. The documentation covers the statuses, markers and filters in detail.