What's New

v2.6.1 — Dashboard and site refresh

Released July 2, 2026

A visual refresh across the dashboard, certivu.ai, and the status page — no API or SDK changes, no breaking changes, no action needed.

• Cleaner dashboard layout, with more room for your data.
• Clearer analytics, including a new at-a-glance verification summary.
• Updated pricing page with a full plan comparison table.
• General visual polish across the marketing site and status page.

v2.6.0 — SDK Expansion (Go, Rust, Java, PHP)

Released July 1, 2026

Certivu now ships in six languages. Four new server-side SDKs join JS and Python — each a thin REST client (no client-side crypto; signing, watermarking, and hashing stay server-side). No breaking changes.

• Four new SDKs. Go, Rust, Java/Kotlin, and PHP, each distributed from a static registry on cdn.certivu.ai (not a public repo):
  • Go — GOPRIVATE=cdn.certivu.ai go get cdn.certivu.ai/sdk/go (module proxy).
  • Rust — the sparse+https://cdn.certivu.ai/sdk/rust/ registry, then cargo add certivu.
  • Java/Kotlin — the https://cdn.certivu.ai/sdk/maven repository, coordinates ai.certivu:certivu.
  • PHP — the https://cdn.certivu.ai/sdk/php Composer repository, package certivu/sdk.
• Six-language coverage. JavaScript/TypeScript, Python, Go, Rust, Java, and PHP — plus the CLI — now share the same sign/verify/batch, token status, audit, analytics, attestation, and webhook surface.
• JS SDK — typed errors, batch signing, timeouts. Non-2xx responses now throw a typed CertivuError with status, code, upgradeUrl, and isQuota/isAuth/isForbidden predicate getters. A new signBatch(items) method signs up to 50 items, and a timeoutMs client option (default 60s) bounds every request.
• Webhook management from any SDK. The /v1/webhooks* routes now accept an API key (Authorization: Bearer ctv_key_...), not just a dashboard session — so webhook CRUD works programmatically from every SDK. Growth plan or above, as before.

---

v2.5.1 — Reliability & hardening

Released June 27, 2026

A maintenance release that hardens the v2.5.0 resilience layers. No breaking changes — existing integrations keep working as-is.

• Neural watermarking robustness. Sign and verify degrade more gracefully when the optional neural-watermark service is slow or unavailable, so an outage never fails a sign or stalls a verify. In-band video watermarking now enforces clear size/duration limits and a processing budget.
• Post-quantum C2PA correctness. Hardened the embedded-manifest hard binding for large manifests so it stays byte-accurate across the full size range.
• Verification accuracy. Tightened neural-watermark lookups so a verify is only ever attributed to the correct record.
• Post-quantum C2PA embedding (POST /v1/records/{id}/c2pa/embed) now requires a Growth plan or above, consistent with batch signing, and enforces the 50 MB asset limit.
• Performance & stability hardening across the worker pool, media pipeline, and inference service.

---

v2.5.0 — Real-world resilience

Released June 27, 2026

Provenance that survives the real world — social-media round-trips, re-encodes, and transcodes — plus deep, post-quantum C2PA interoperability. Additive and backward-compatible: every existing path (DCT watermark, ZWC, pHash, acoustic fingerprint, metadata token, ML-DSA signature) is unchanged; these are new resilience layers.

• Neural watermarking (images & audio). Optional TrustMark (image) and WavMark (audio) neural watermarks survive the regimes where frequency-domain watermarks fail — recompression, resize, screenshot re-capture, MP3 transcode, speed/pitch shift. Verification surfaces a new neural_watermark_found signal and a neural_watermark token source, and a neural match returns high confidence. Neural marks are carried as opaque lookup codes — provenance is still established by the ML-DSA signature, never the watermark alone.
• In-band video watermarking. Video provenance now survives a full re-encode/transcode (not just a container remux): a keyframe neural watermark and an audio-track watermark, recovered on verify for high confidence — up from the first-frame perceptual-hash fallback. Both are opt-in.
• Post-quantum C2PA. Certivu now writes real, embeddable C2PA manifests — signed with ML-DSA (NIST FIPS 204) instead of the classical RSA/ECC the ecosystem uses today — into JPEG and PNG, via POST /v1/records/{id}/c2pa/embed. The manifests are structurally interoperable with the Content Credentials ecosystem; standard verifiers parse them but report the signature algorithm as unrecognized — the deliberate quantum-resistant trade-off. Third-party C2PA reading on the verify path is also richer (manifest_count, signature_issuer, is_certivu).
• SDKs & CLI. JS/Python SDKs gained embedC2pa / embed_c2pa; the CLI gained certivu c2pa <record_id> <signed-file>. Verify results carry the new neural and C2PA signals.

Non-claims, unchanged. Neural watermarks are stronger resilience but are still not claimed unremovable, and absence of provenance still never implies human origin. Certivu verifies declared, signed provenance — it does not claim to detect all AI-generated content.

---

v2.4.1 — Reliability & hardening

Released June 26, 2026

A maintenance release focused on robustness, SDK quality, and performance. No breaking changes — existing integrations keep working as-is.

• Audit log cursor pagination. GET /v1/audit now accepts an optional before=<ISO timestamp> cursor and returns a next_cursor, so you can page through long histories efficiently. The existing page/limit behavior is unchanged.
• One-click email unsubscribe. Marketing emails now include RFC 8058 List-Unsubscribe/List-Unsubscribe-Post headers, and the unsubscribe link opens a confirmation page instead of unsubscribing on load (so link scanners can’t unsubscribe you by accident).
• Python SDK — webhook secret. create_webhook() now returns the signing secret (as WebhookEndpointWithSecret), so Python users can verify delivery signatures. It’s shown once at creation, matching the JS SDK.
• JS SDK — timeouts & retries. All SDK requests now have a request timeout, and idempotent reads retry transient network/5xx errors with backoff. Corrected the TokenStatus type to match the API response.
• <certivu-badge> branding. The badge now renders your organization’s display name, logo, and color from the public status endpoint.
• CLI. certivu status now shows the organization name. Removed an unused private-key flag/env var; the config file is now written with owner-only permissions.
• Performance. Cryptographic signing/verification and audio fingerprinting now run on a worker-thread pool, keeping the API responsive under concurrent load.
• Security & reliability hardening across webhooks, billing accuracy, and background jobs.

---

v2.4.0 — Compliance & Branding

Released June 26, 2026

This release helps you evidence transparency obligations and put your own brand on the verification experience.

• Compliance attestation export. Enterprise orgs can now generate a factual attestation of their provenance and verification activity, mapped to EU AI Act Article 50 transparency obligations, via GET /v1/attestation (JSON) and GET /v1/attestation/export?format=json|html (download). An attestation is a record of activity — not a certification, legal opinion, or guarantee of compliance, and Certivu still makes no claim to detect all AI-generated content. Available on the Enterprise plan, programmatic (API key) access only. See the Attestation API reference.
• Branded verification certificates. Growth+ orgs can customize a public, org-branded certificate page at https://certivu.ai/certificate?t=<ctv_token> — set a display name, logo, primary color, and support URL via GET/PATCH /v1/account/branding (owner/admin). Share a token and recipients see a clean, branded provenance page.
• Public token status now includes branding. The public GET /v1/verify/status/:token response now also returns org_name and a branding object, so badges and embedded verifiers can render org identity without an extra call.

---

v2.3.0 — Adoption & distribution

Released June 20, 2026

This release is about getting content signed and verified where it’s actually created and consumed — no SDK code required.

• No-code web signer. A new Sign page in the dashboard: drag in a file, pick a generator, and download a signed copy. Supports every format (image, audio, text/PDF, video). Each sign counts against your plan quota, just like the API.
• ComfyUI node & Automatic1111 extension. Sign images at generation time, right inside your tooling — a Certivu Sign Image node for ComfyUI and an on_image_saved extension for the A1111 / Forge WebUI. Both wrap the certivu Python SDK.
• Browser extension. Right-click any image on the web → Verify with Certivu → see the provenance verdict in an overlay. No account, no API key.
• <certivu-badge> embed widget. A drop-in web component (@certivu/badge, also hosted at cdn.certivu.ai/integrations/badge.js) that renders a live “Verified by Certivu” badge from a token and self-updates from the public status endpoint. Themable via CSS custom properties; click to open a provenance panel.
• CI verification. certivu verify now accepts globs and a --fail-on-missing flag, so a single npx @certivu/cli verify "assets/**/*.png" --fail-on-missing step fails CI when AI assets lack valid provenance — no plugin to install.
• Sandbox environment. A separate https://api-sandbox.certivu.ai with isolated data and ctv_test_key_... keys. Identical behavior, but signing never consumes or enforces billing quota — integrate without burning real quota. Check the new X-Certivu-Environment header or GET /version to confirm which environment you’re calling.
• Public status page at status.certivu.ai.
• CORS — public read and verify endpoints (/v1/verify, /v1/verify/status/:token, /health, /version) now allow any origin, so the badge and browser-based verifiers work when embedded anywhere.

---

v2.2.2 — Key rotation & performance

Released June 19, 2026

• New — generator key rotation. Rotate a server-managed generator’s signing key with a single API call (POST /v1/generators/:id/rotate-key). New content is signed with the fresh key while everything signed earlier stays fully verifiable, so you can refresh keys on a schedule or after a suspected exposure without affecting past provenance.
• New webhook event — generator.key_rotated fires when a generator’s key is rotated.
• Performance & reliability — signing and verification pipeline improvements, including faster perceptual-hash lookups for large content libraries and more responsive signing under concurrent load.
• Watermark durability — refinements to the image watermark for greater resilience across common transformations.

---

v2.2.1 — Video resilient path

Released June 17, 2026

Video verification now has a pHash fallback — if the container token (cerv atom or sentinel trailer) is stripped or the video is re-encoded, Certivu extracts the first I-frame via ffmpeg, computes a perceptual hash, and performs a fuzzy lookup against stored records.

• POST /v1/sign computes and stores the first-frame pHash at sign time (requires ffmpeg in the API environment)
• POST /v1/verify falls back to pHash lookup when no container token is present (token_source: "phash", confidence: "medium")
• ffmpeg is now installed in the production Dockerfile

The pHash lookup is format-scoped — video records only match against other video records, and image records only match against image records, eliminating cross-format false positives.

The Hamming distance threshold for all pHash lookups is ≤ 8 (corrected from the previously documented ≤ 10).

---

v2.2.0 — Video

Released June 16, 2026

Certivu now signs and verifies video — the fourth content type, completing the core multi-media platform (image, audio, text, video).

Supported video formats

Container	Magic bytes	Token location
MP4	ftyp box with isom/mp4/avc1 brand	Custom cerv atom inserted after ftyp at top level
MOV (QuickTime)	ftyp with qt brand or moov/wide first box	Custom cerv atom inserted after ftyp
MKV (Matroska)	EBML header 0x1A45DFA3	Certivu sentinel trailer appended after Segment
WebM	EBML header 0x1A45DFA3 + webm DocType	Certivu sentinel trailer appended after Segment

Format is auto-detected from magic bytes. Compliant MP4/MOV parsers skip unknown atoms; MKV/WebM parsers stop at the declared Segment boundary, so trailing bytes are ignored by players.

How it works

Sign a video with POST /v1/sign:

curl -X POST https://api.certivu.ai/v1/sign \
  -H "Authorization: Bearer ctv_key_..." \
  -F "content=@my-video.mp4" \
  -F "model=sora-v1" \
  -F "generator_id=gen_..."

The returned MP4 has the ctv_ token embedded in a cerv atom. Verification reads the atom and validates the provenance record and ML-DSA signature.

Current limitations

• No resilient watermark in v2.2.0. Keyframe DCT watermarking (I-frame pixel-domain embedding) requires native H.264/H.265/AV1 frame decode — not available in the pure-TypeScript runtime. The metadata-only token survives copy and download but not re-encode or format conversion. Keyframe watermarking is planned for a future native-bindings release.
• Supported in POST /v1/sign (server-managed keypair) and POST /v1/records (client-side signing).
• Generators must declare "video" in supported_formats to accept video content.

---

v2.1.0 — Provenance Durability

Released June 16, 2026

Deeper embedding across all three content types — provenance now survives real processing pipelines that strip metadata or recompress content. No API surface changes; all improvements are in the signing and verification adapters.

HTML: ZWC steganography in body text

The ctv_ token is now paired with a zero-width character (ZWC) watermark injected directly into the first visible text node of <body>. DOMPurify and most HTML sanitizers preserve text-node content (stripping it would corrupt visible text), so this survives sanitization pipelines that strip <meta> tags. Extraction probes body text for ZWC; the meta tag remains as a fast path.

PDF: ISO 32000 /Metadata stream

The token is now embedded in a proper PDF /Metadata XMP stream object (the official ISO 32000 metadata channel) via an incremental update. GhostScript, Acrobat, and most PDF optimizers preserve the /Metadata stream because it is the standard metadata channel. The prior %% comment approach is retained as a fallback for PDFs where the catalog cannot be located.

WAV: 24-bit PCM watermark support

The DCT frame watermark now supports 24-bit integer PCM WAV files in addition to 16-bit. 24-bit WAV is the standard output of DAWs and archival audio pipelines — previously these files were signed without a resilient DCT watermark.

Plain text: ZWC distributed across paragraphs

The ZWC watermark payload is now repeated at the start of every paragraph (split on \n\n) rather than inserted once at the top of the document. Extraction returns the first valid 128-bit decode found anywhere in the text. Documents that are excerpted, redistributed, or partially edited retain provenance in surviving paragraphs.

Audio: Acoustic fingerprint fallback

For audio records where the metadata tag has been stripped (e.g. MP3 transcoded to AAC), verification now computes a Shazam-style acoustic fingerprint (512-sample Hanning-windowed FFT, spectral landmark pairs) and performs a fuzzy match against stored audio fingerprints. When found, token_source is "fingerprint" and signals.fingerprint_match is true. Supported for WAV 16/24-bit PCM only (MP3 and FLAC require a decoder not available server-side).

---

v2.0.0 — Multi-Media

Released June 14, 2026

Certivu now signs and verifies images, audio, and text — a major platform expansion beyond images only.

Multi-format signing

POST /v1/sign now accepts any content type. Format is auto-detected from magic bytes or can be specified explicitly via the format field ("image", "audio", "text"). The signed content is returned with a format-appropriate provenance token and resilient watermark embedded.

Format	Accepted files	Token container	Resilient watermark
Image	JPEG, PNG, WebP	XMP metadata	DCT spread-spectrum
Audio	MP3, FLAC, WAV	ID3v2 TXXX / VORBIS_COMMENT / CTV RIFF chunk	DCT frame watermark (WAV)
Text	PDF, HTML, plain text	PDF XMP / HTML <meta>	ZWC steganography (plain text)

Generator format enforcement

Generators now declare supported_formats — a required array of one or more formats the generator is allowed to sign. Signing with an unlisted format returns 400 format_not_supported.

Format in verification

The verification response now includes a format field indicating the detected or applied content format. The token extraction pipeline is fully format-aware — it probes the right container for each format rather than assuming XMP.

SDK and CLI updates

• JS SDK: sign() accepts an optional format parameter; response includes signedContent and format.
• Python SDK: sign() and async_sign() accept format=; SignResult has signed_content and format.
• CLI: certivu sign accepts --format <image|audio|text>, auto-inferred from file extension if omitted.

Dashboard

• Generator wizard now requires selecting supported formats (image / audio / text) during registration.
• Generator list shows format badges per generator.

---

v1.5.0 — Help & Support

Released June 14, 2026

Help & Support page

A new Help & Support page is now available in the dashboard. You can:

• Submit a support ticket — choose a category (Billing, Technical, Account, Other), describe your issue, and submit. You’ll receive a confirmation email with your ticket ID from support@certivu.ai.
• Track your tickets — see all open and resolved tickets for your org, with status updates in real time.
• Browse resources — quick links to the Quickstart Guide, API Reference, Webhooks Guide, and SDK documentation.

You can also email us directly at support@certivu.ai at any time.

---

v1.4.1 — Security & Reliability Patch

Released June 13, 2026

Security fixes

• Admin authentication hardened — admin secret comparison now uses timingSafeEqual to prevent timing side-channel attacks. Admin JWTs are now signed with a dedicated ADMIN_JWT_SECRET, independently rotatable from user session tokens.
• Cryptographically secure 2FA OTPs — OTP generation replaced Math.random() with crypto.randomInt (CSPRNG-backed).
• 2FA fail-open closed — a Redis failure during login previously issued a JWT silently, bypassing 2FA entirely. It now returns a 503 and issues no token until OTP storage succeeds.
• Upload size limits — a 20 MB cap is now enforced on sign uploads, single-image verify, and each item in batch verify (returns 413).
• Webhook SSRF protection — webhook URL registration now rejects RFC-1918, loopback, link-local, and CGNAT addresses and requires https: protocol only.
• Analytics authorization fix — per-record analytics ownership was incorrectly verified; it now confirms the record’s generator belongs to the requesting org via a database join.
• Stripe webhook deduplication — duplicate Stripe event delivery is now idempotent via a Redis dedup key (72-hour TTL), preventing double-billing on Stripe’s at-least-once delivery guarantee.

Reliability fixes

• Watermark detection fixed for images larger than 1024px — the embed and extract paths were operating at different resolutions (embed at native size, extract capped at 1024px via Sharp resize). Sharp’s resampling was destroying DCT coefficients, so extracted watermark IDs never matched. Both paths now operate at native resolution.
• Quota enforcement made atomic — the free-tier quota check-and-increment was a non-atomic read-then-write pair, raceable under concurrent signing. It is now a single conditional findOneAndUpdate.
• Atomic registration and invite acceptance — user registration (org + user create) and invite acceptance (user create + invite update) are now wrapped in MongoDB transactions, eliminating orphaned documents on partial failure.

SDK coverage (JS + Python)

Five methods covering the v1.4.0 analytics and webhooks API surface were missing from both SDKs and are now available:

• getAnalyticsOverview(days?) — fetch verification analytics summary
• getRecordAnalytics(recordId) — per-record drill-down (Growth+)
• listWebhooks() — list registered webhook endpoints
• createWebhook(url, events) — register a new endpoint (Growth+)
• deleteWebhook(webhookId) — remove an endpoint

Bug fixes

• Web → dashboard login now works correctly — logging in from certivu.ai and being redirected to dashboard.certivu.ai previously resulted in a broken session because the two domains have isolated browser storage. The session is now passed via a secure hash fragment and hydrated by the dashboard on load.

---

v1.4.0 — Intelligence

Released June 11, 2026

Verification Analytics

Every verification is now logged and surfaced as actionable data. The new Analytics page in the dashboard shows daily verification trends, authentic vs. tamper rates, and your top records by verification volume.

• Free: 7-day window
• Starter: 30-day window + tamper alert emails
• Growth/Scale/Enterprise: 90-day window + per-record drill-down + webhook events

New endpoints: GET /v1/analytics/overview, GET /v1/analytics/records/:id

Webhooks

Subscribe any HTTPS endpoint to Certivu events. Available on Growth+ plans.

Six event types: record.created, verify.attempted, verify.tamper_detected, quota.warning, quota.limit, generator.revoked.

Payloads are signed with HMAC-SHA256 (X-Certivu-Signature: t=<ts>,v1=<sig>) and include a 5-minute replay protection window. Endpoints auto-disable after 5 consecutive failures. Delivery log retained for 30 days with per-delivery retry.

New endpoints: GET/POST /v1/webhooks, PATCH/DELETE /v1/webhooks/:id, GET /v1/webhooks/:id/deliveries, POST /v1/webhooks/:id/deliveries/:id/retry

Monthly Digest Email

Starter+ orgs receive a monthly summary on the 1st of each month: signing activity, verification count, tamper events, quota bar, and upgrade CTA at ≥80% usage.

Admin Dashboard (internal)

Internal ops panel at /admin for the Certivu team. Platform stats (org/user/record counts, estimated MRR), org search and management, plan override, quota reset, and GDPR delete. Separate auth via ADMIN_SECRET environment variable.

---

v1.3.1 — Server-Side Signing

Released June 10, 2026

Signing is now fully server-side

Previously the SDK required you to hold an ML-DSA private key locally, compute signatures, and manually embed watermarks. As of v1.3.1, the API handles the entire pipeline — you POST an image and get back a watermarked, signed image ready to distribute.

Before (≤ v1.3.0):

const certivu = new CertivuClient({
  apiKey: 'ctv_key_...',
  generatorId: 'gen_...',
  privateKey: process.env.CERTIVU_PRIVATE_KEY, // you managed this
})
const { token } = await certivu.sign({ content: imageBuffer, model: 'sdxl' })
// image was unchanged — watermarking was your responsibility

Now (v1.3.1+):

const certivu = new CertivuClient({
  apiKey: 'ctv_key_...',
  generatorId: 'gen_...',
})
const { token, signedContent } = await certivu.sign({ content: imageBuffer, model: 'sdxl' })
// signedContent is the watermarked, signed image — use this one

The returned image has the ctv_ token in XMP metadata and the watermark embedded in the frequency domain. Verification returns high confidence when both signals survive.

New POST /v1/sign endpoint

POST /v1/sign
Content-Type: multipart/form-data
Authorization: Bearer ctv_key_...

Fields: image (file), model (string), generator_id (string).

Response: binary image bytes with headers:

• Content-Type: image/jpeg | image/png | image/webp
• X-Certivu-Token: ctv_...
• X-Certivu-Record-Id: rec-uuid

The old POST /v1/records endpoint is preserved for backward compatibility with client-managed-keypair generators.

Generator keypair management simplified

When registering a generator, no public key is required. Certivu generates and stores the keypair server-side — the private key is encrypted at rest (AES-256-GCM) and never returned to clients.

Breaking changes

What changed	Old	New
SDK CertivuClient config	privateKey required for signing	No privateKey — key lives on server
sign() return value	{ token, record_id }	{ token, record_id, signedContent: Uint8Array }
Python CertivuClient	private_key param	Removed
CLI certivu sign	--private-key flag	Removed; add --output to set output path
Python install	pip install certivu[signing] for signing	pip install certivu is sufficient

---

v1.3.0 — Image Pipeline Improvements

Released June 10, 2026

PNG and WebP metadata support

The ctv_ token is now embedded natively in all three major image formats. Previously, all signed images were converted to JPEG. Starting with v1.3.0, the pipeline preserves the original format:

Format	Token storage	Watermark
JPEG	APP1 XMP segment	DCT spread spectrum
PNG	tEXt chunk (certivu:token)	DCT spread spectrum
WebP	XMP RIFF chunk	DCT spread spectrum

No format conversion means lossless images stay lossless. Extraction and verification are fully format-aware — no changes needed on the verify side.

Spread spectrum watermark

The DCT watermark algorithm has been upgraded from single-coefficient QIM to spread spectrum: each bit is now embedded into 4 independent mid-frequency DCT coefficients per 8×8 block rather than one. This gives 4× the signal redundancy per block, compounded across all blocks via majority voting.

Practical result: watermarks now survive JPEG compression at Q=60 (social media worst case), an improvement over the prior floor of Q=75.

Note: Images signed with v1.2.x and earlier used the old single-coefficient algorithm. Their DCT watermarks will not decode with the new extractor. The XMP token fast path is unaffected — this only impacts images where XMP was stripped (e.g. heavily transformed social media uploads without the token).

Perceptual fingerprinting (pHash)

Generator SDKs can now submit a 64-bit perceptual hash alongside signed records. At verification time, if no watermark or XMP token is found, Certivu performs a fuzzy pHash lookup across recent records using Hamming distance (threshold ≤ 10 bits).

This enables provenance recovery for images where watermarks have been destroyed by aggressive transformations — resizing, heavy recompression, format conversion — that the DCT watermark does not survive.

The phash field is optional in POST /v1/records. If not submitted, the pHash lookup path is skipped. See the sign API reference for the field format.

Two new signals appear in VerificationResult:

• signals.phash_match: boolean — true when the record was located via pHash
• token_source: "phash" — when pHash was the resolution path
• c2pa?: { found, validation_status, assertions } — C2PA manifest signals if present

C2PA compatibility

Certivu now reads C2PA manifests on every verification call. If uploaded content contains a C2PA manifest, its assertions and validation status are surfaced in the c2pa field of the verification response — alongside Certivu’s own cryptographic verification.

Every signed record also exposes a C2PA-compatible manifest export:

GET /v1/records/:record_id/c2pa

Returns a structured JSON manifest with c2pa.actions, certivu.provenance, and c2pa.hash.data assertions. This is a compatibility export for integration with C2PA-aware platforms and tooling, not a fully-signed C2PA manifest (which requires a certificate chain outside Certivu’s scope).

Positioning: C2PA compatible + ML-DSA quantum-resistant — Certivu reads and speaks C2PA while adding post-quantum cryptographic guarantees that C2PA’s PKI-based signing does not provide.

---

v1.2.0 — Teams

Released June 10, 2026

Team management

Org owners can now invite teammates by email directly from the dashboard. Invites use 7-day time-limited links — recipients click the link, set a password, and are immediately joined to the org with the assigned role.

Role-based access control

Three roles with clear permission boundaries:

Role	Access
Owner	Everything — members, billing, generators, settings
Admin	Invite members, manage generators and API keys (Growth+ plans)
User	Read-only — audit log and usage

Admin role is available on Growth and above. All plans include the Owner role.

Per-member API keys

Each team member can generate their own personal API key from Settings → Personal API Keys. Keys are tied to the individual — audit log entries show the member’s email, not just the org. Keys are shown once on creation and can be revoked at any time.

Plan seat limits

Plan	Members	Admin role
Free	1 (solo)	—
Starter	Up to 5	—
Growth	Up to 15	✓
Scale	Up to 50	✓
Enterprise	Unlimited	✓

See the Team guide and Team API reference for full details.

---

v1.1.0 — Developer XP & Performance

Released June 7, 2026

Performance

Significant speed improvements across the signing and verification pipeline. Verification is faster under load, signing throughput is higher, and content hashing is more efficient.

Python SDK

A native Python client is now available.

pip install certivu

Supports both sync and async usage. Full parity with the TypeScript SDK — sign, verify, batch verify, audit log.

from certivu import CertivuClient

client = CertivuClient(api_key="ctv_key_...")
result = client.verify(content=content_bytes)
print(result.confidence)  # "high"

See the Python SDK guide for the full reference.

CLI Tool

A standalone command-line tool for signing and verifying content directly from your terminal.

# Install
npm install -g @certivu/cli

# Sign a file
certivu sign ./image.jpg --model stable-diffusion-xl

# Verify a file
certivu verify ./image.jpg

# Check account and quota status
certivu status

Works on macOS, Linux, and Windows. See the CLI guide for full usage.

Interactive API Docs

A live Swagger UI is available at api.certivu.ai/docs — browse all 28 endpoints, inspect schemas, and make test requests directly from the browser.

An OpenAPI 3.1 spec is also available at GET /openapi.json for client generation and integration testing.

TypeScript SDK — Token Status

A new getTokenStatus() method lets you look up the status of any ctv_ token without uploading content.

const status = await certivu.getTokenStatus("ctv_7f3kx9mq2...")
// { valid: true, revoked: false, signed_at: "...", org: "Acme AI" }

Two-Factor Authentication

Login now requires a 6-digit verification code sent to your email after credentials are confirmed. Applies to both the dashboard and the web login page.

Design

The dashboard and marketing site have been refreshed with the Warm Dusk design system — consistent type scale, amber accent tokens, and improved contrast throughout.

---

v1.0.0 — Launch

Released June 3, 2026

Certivu is live.

Quantum-resistant provenance infrastructure for AI-generated content — sign with ML-DSA, verify anywhere, free forever.