Content Credentials

An editor uploads a photo that was made with AI. Your site notices, and suggests the disclosure.

Content Credentials reads the C2PA content credential inside an uploaded image, video or audio file: a signed record, written by the software that made the file, of how it was made. When that record says a generative model made it, the module suggests the matching grade in AI Disclosure. An editor accepts or dismisses it.

Alpha release: try it and report what you find

1.0.0-alpha1 is the first release. It has been tested end to end on Drupal 11.4, and its test suite runs on 11.3 and 11.4, but it has not run on a production site yet. Try it on a test or staging site first, and report what you find in the issue queue.

How it works

1. An editor adds an image, video or audio file and saves. The save is not slowed down: the file waits in a queue.
2. On the next cron run the module reads the file's content credential.
3. If the credential is signed by a certificate your site trusts and says the file was made by AI, AI Disclosure records a pending suggestion, for example Autonomously AI generated.
4. The editor sees it on the edit form and accepts or dismisses it.

No credential, an unsigned one or one your site does not trust: nothing happens.

Only trusted credentials count

The credential arrives with the file, so anyone can write one. A credential your site does not trust gives no suggestion at all, not a weaker one.

A suggestion, never a decision

Nothing is labelled or published automatically. There is no setting to apply a grade without an editor.

Features

• You choose what is read. Select the content types or media types to read. Existing content is left alone; a file is read when it is added or replaced.
• Works with Media. Select the media type, for example Image, and the suggestion appears on the media item.
• Images, video and audio. JPEG, PNG, WebP, AVIF, GIF, TIFF, SVG, MP4, QuickTime, AVI, WAV, FLAC and MP3.
• No guessing. When one AI term matches several grades you set the order. A term without a match is logged and skipped.
• Files re-signed by another module. When a module such as C2PA Sign signs every upload, the AI origin is read from the trusted file underneath. Use C2PA Sign 1.5.0 or later: earlier releases lose the origin of a file in the current C2PA format.
• A status report that tells you what is wrong. It says whether the module is reading, and warns when a setting will stop suggestions from appearing.

Choose how files are read

Pick one on the settings form. A route whose software is not installed is greyed out there, with how to install it.

Route Choose it when You need Pure-PHP verifier You want nothing extra on the server. Works on shared hosting. provemark/c2pa-verifier. Does not read TIFF or SVG. Signing service over HTTP You run, or can reach, a C2PA reading service. Its https:// address and an API key. ext-c2pa PHP extension You can install PHP extensions and trust the people who upload. ext-c2pa in the PHP that runs cron. MP3 files are skipped.

The verifier and the extension check signatures against the certificates you paste in, called trust anchors. The README says which of C2PA's official trust lists goes in which field.

What it does not do

• It does not sign or change files. It only reads.
• It shows visitors nothing. The label they see is AI Disclosure's.
• It does not work without AI Disclosure: that is where the suggestion goes.

Related modules

• AI Disclosure, by sjpagan, holds the grades, the field and the screen where an editor accepts or dismisses a suggestion. This module only adds suggestions to it.
• C2PA Sign does the other half: it signs the files your site serves, with the grade AI Disclosure stores.

Two articles by the AI Disclosure maintainer show the three modules together:

• What does an AI-generated image carry, and how does a Drupal site label it?
• How do AI Disclosure, Content Credentials and C2PA Sign work together on a Drupal site, and what are they for under the AI Act? follows one image from upload to the file a visitor downloads, with the setup that keeps the generator's signature and the versions it was tested with.

Requirements

• Drupal 11.3 or later, PHP 8.3 or later
• AI Disclosure 1.0.0-alpha3 or later; 1.0.0-beta1 or later recommended. From beta1 an editor's decision on a suggestion stays when a later file reads the same. The command below installs it on a new site.
• Composer. The module depends on provemark/content-credentials, which a downloaded tarball cannot include.

Installation

composer require drupal/ai_disclosure:^1.0.0-alpha3
composer require drupal/content_credentials:^1.0@alpha

# For the pure-PHP route:
composer require provemark/c2pa-verifier:^0.7

Run both lines. AI Disclosure has no stable release yet, so Composer installs it only when your project asks for it by name. The install line under Releases, on its own, stops with "does not match your minimum-stability".

Enable the module and go to Configuration → Content authoring → Content credentials:

1. Select the content types or media types to read.
2. Choose a reading route and, for the verifier or extension, paste in your trust anchors.
3. Make sure each selected type has an AI disclosure field. That is where the editor sees the suggestion.

The service API key is not on the form, because configuration usually ends up in Git. Set it in settings.php:

$config['content_credentials.settings']['reader']['api_key'] = getenv('CC_API_KEY');

Known issues in 1.0.0-alpha1

An image field with a maximum resolution removes the credential: Drupal scales the upload before it is read, so that image gets no suggestion. Clear the maximum resolution on the fields you select, or wait for the next release, which reads the original. The other known issues are listed in the CHANGELOG.

Try it locally

The README takes you from a fresh site to a suggestion on screen, with the verifier route and a signed sample image that ships with the module. No Docker needed.

Read the README