Skip to main content

CAI JavaScript library

Overview​

The c2pa-js repository is a monorepo containing JavaScript libraries and tools for working with C2PA metadata. It provides these libraries published for production use:

  • c2pa-web: Library for C2PA metadata in the browser. Import and use this package in browser client JavaScript code.
  • c2pa-node: Node.js library that can read and validate C2PA manifest data that is attached to media assets and add signed manifests to media assets.

Versioned API documentation for published releases is available for Node.js and web. Use the version selector to choose a release.

note

In June 2026, the c2pa-node-v2 repo was merged into the c2pa-js repo. The old c2pa-js repository is now in c2pa-js-legacy and is deprecated. If you need to work with C2PA metadata in the browser, use the libraries in this repository instead.

Learning videos​

For video walkthroughs on using the JavaScript library, see the following lessons from the Content Credentials Foundations course:

Prerequisites​

To use the Node.js library, you need Node.js 22 or later. Use a patched release: v22.23.4+ on v22, v24.22.1+ on v24, or v26.12.1+ on v26. These releases update the bundled roots and block the compromised eMudhra intermediate public keys.

TLS trust stores​

Native SDK HTTP requests and Trustmark model downloads use Reqwest with Rustls and share the patched rustls-webpki verifier and webpki-roots bundle.

The Rust upgrade does not update every HTTPS trust path:

  • The Node package's binary installer uses node-fetch, and shared utilities use the runtime's global fetch (or a caller-supplied implementation) for settings and trust-resource URLs. These paths need a patched Node runtime; updating npm HTTP-client packages alone does not update Node's TLS verifier or roots.
  • Browser/WASM HTTP requests, including remote manifests, timestamp requests, and WASM loading, use browser networking. Keep the browser and its revocation data current, along with the OS trust store where applicable. A Rust dependency update cannot patch the browser.

No production TLS CA bundle is maintained in this repository. Custom fetch implementations, Node CA overrides (such as NODE_EXTRA_CA_CERTS), proxies, and externally supplied binaries remain the deployer's responsibility. C2PA signing trust anchors and test certificates are separate from HTTPS CA roots.

See the eMudhra incident and patched-client list and the upstream Node security releases for v22.23.4, v24.22.1, and v26.12.1.

Contributing​

If you want to contribute to the CAI JavaScript library, see Contributing to the project. For general contribution guidelines, see CONTRIBUTING.md.

License​

This project is licensed under the MIT license.