Content Credentials always contain a C2PA signature, but that signature can be created by different signing backends. The backend is separate from the provenance profile: the profile controls how much provenance is included, while the signer controls which identity signs the manifest.
Backend Choices
Use this as a starting point:
| Signer | Best for | What it means |
|---|
auto | Default render and site workflows | Use Stencila Cloud signing when a Cloud token is available, otherwise use the local signing identity |
cloud | Public or organizational releases | Send the asset and generated provenance to Stencila Cloud for signing |
local | Local testing and private workflows | Sign with the self-signed identity created by stencila credentials init |
The default signer is auto. It uses Stencila Cloud signing when a Cloud token is available and falls back to local signing when possible. Use local when you need to avoid Cloud signing, or cloud when unauthenticated local fallback should be an error.
stencila render article.smd article.pdf --credentials
stencila render article.smd article.pdf --credentials --credentials-signer cloud
stencila render article.smd article.pdf --credentials --credentials-signer local
stencila render article.smd article.pdf --credentials --credentials-soft-binding
stencila render article.smd article.pdf --credentials --credentials-no-soft-binding
The standalone asset command, stencila credentials sign, currently signs with a local identity or explicitly supplied certificate material. It does not use the Cloud signing backend.
Local Signing
Local signing uses certificate and key material on your machine. Create the default local identity with:
stencila credentials init
Local signing is useful while developing a workflow or sharing files inside a small team, but public verifiers should usually report the signer as untrusted or unrecognized unless your workflow provides custom trust anchors.
Cloud Signing
Cloud signing sends the asset and the generated provenance payload to Stencila Cloud's C2PA signing service. The service signs via:
POST https://c2pa.stencila.cloud/v1/sign
This /v1/sign route is a Stencila extension hosted beside the C2PA Soft Binding Resolution API. It is not part of the official C2PA API.
Cloud signing requires a Stencila Cloud API key, normally provided by signing in to Stencila Cloud:
stencila cloud signin
You can also provide STENCILA_API_KEY through the environment or Stencila secrets. STENCILA_C2PA_URL can override the C2PA service base URL for testing or deployment-specific routing.
Cloud signing through --credentials-signer cloud signs the provenance that the local client generated. This gives a stronger signer identity than a local self-signed certificate, but it does not prove that the local snapshot payload was independently generated by Stencila Cloud.
Site Rendering
For workspace-wide render defaults, configure Content Credentials at the root of stencila.toml:
[content-credentials]
enabled = true
profile = "public"
signer = "cloud"
soft-binding = true
For sites, you can also enable or override Content Credentials under site:
[site]
content-credentials = true
Use the detailed site form to override the root profile or signer:
[site.content-credentials]
profile = "public"
signer = "cloud"
soft-binding = true
During site rendering, Stencila signs extracted media assets and annotates the HTML image components with compact manifest metadata. The signed asset bytes and their C2PA manifests remain the source of truth for verification.
Manifest Identity
Stencila records how the manifest was generated and signed in standard C2PA claim_generator_info, using Stencila extension keys for the two facts generic C2PA fields do not distinguish:
| Scenario | name | org.stencila.generated_by | org.stencila.signed_by |
|---|
| Rendered locally, signed locally | Stencila CLI | client | local |
| Rendered locally, signed by Stencila Cloud | Stencila Cloud Signing Service | client | stencila-cloud |
| Rendered and signed by Stencila Cloud | Stencila Cloud | stencila-cloud | stencila-cloud |
The third case is the strongest Stencila-hosted provenance signal because the provenance snapshot was generated by Cloud infrastructure and signed there. The second case still has a Cloud signature, but the snapshot was supplied by the client.
Soft Bindings
Stencila Cloud is implementing the C2PA Soft Binding Resolution API at https://c2pa.stencila.cloud/v1. Soft binding registration is enabled by default. Use --credentials-no-soft-binding, or soft-binding = false in [content-credentials], to skip the combined sign, store, and soft-bind workflow. When signing falls back to a local identity, Stencila signs the asset locally and reports that soft binding registration was skipped.
