CLI Tool

The certivu CLI lets you sign and verify AI-generated content directly from the terminal — suited for shell scripts, CI pipelines, and quick manual testing.

Install

Via npm (recommended):

npm install -g @certivu/cli

Via Bun:

bun install -g @certivu/cli

Via install script (installs npm package automatically):

curl -fsSL https://certivu.ai/install.sh | sh

Verify the install:

certivu --version  # 2.4.0

Configuration

The CLI reads config from three sources in priority order:

CLI flags (highest priority) — --api-key, --generator-id
Environment variables — CERTIVU_API_KEY, CERTIVU_GENERATOR_ID
Config file — ~/.config/certivu/config.json

Set persistent config with certivu config set:

certivu config set api-key ctv_key_abc123
certivu config set generator-id your-generator-uuid

certivu config get  # show current config

Commands

`certivu sign`

Upload content for server-side watermarking and signing. Supports images (JPEG/PNG/WebP), audio (MP3/FLAC/WAV), text (PDF/HTML/plain), and video (MP4/MOV/MKV/WebM). Format is auto-detected from magic bytes. The API returns the content with the token embedded, which is written to disk.

# Image
certivu sign ./output.jpg --model stable-diffusion-xl

# Audio
certivu sign ./track.mp3 --model musicgen-large

# Text / PDF
certivu sign ./report.pdf --model gpt-4o

# Video
certivu sign ./clip.mp4 --model sora-v1

✓ Signed
  Token       ctv_7f3kx9mq2...
  Record ID   rec-00000000-...
  Format      image
  Output      ./output.signed.jpg

Pass --format to override auto-detection:

certivu sign ./content.bin --format audio --model musicgen-large

Flags:

Flag	Description
`--model <name>`	AI model name — required
`--format <type>`	`image`, `audio`, `text`, or `video` — auto-detected if omitted
`--generator-id <id>`	Override generator ID from config
`--output <path>`	Output path (default: `<file>.signed.<ext>`)
`--api-key <key>`	Override API key from config
`--base-url <url>`	Override API base URL

`certivu verify`

Verify content authenticity. Free — no API key required.

certivu verify ./image.jpg

Token is extracted automatically — from format-native metadata (XMP, ID3v2, VORBIS_COMMENT, HTML meta, cerv atom/trailer), then resilient watermark, then pHash fuzzy lookup. Pass --token to skip extraction:

certivu verify ./image.jpg --token ctv_7f3kx9mq2...

Verify many files (globs + CI). verify accepts multiple paths and glob patterns — the CLI expands them itself, so quote them to stop the shell interfering. With --fail-on-missing it exits non-zero if any file lacks valid provenance, which fails a CI job:

certivu verify "assets/**/*.{png,jpg,mp4}" --fail-on-missing

This is the recommended way to enforce provenance in CI — see the CI Verification guide.

Authentic:

✓ Authentic — HIGH confidence
  Org         Acme AI
  Model       stable-diffusion-xl
  Signed      2026-06-07T12:00:00Z
  Source      watermark

  Signals: watermark ✓  record ✓  signature ✓

Not verified:

✗ Not verified — no_provenance_found
  Absence of provenance does not imply human origin.

  Signals: watermark ✗  record ✗  signature ✗

Tampered:

✗ Tampered — content has been modified since signing

  Signals: watermark ✓  record ✓  signature ✗

`certivu status`

Lightweight token metadata lookup — no image upload needed. CDN-cacheable.

certivu status ctv_7f3kx9mq2...

✓ Active
  Record      rec-00000000-...
  Model       stable-diffusion-xl
  Signed      2026-06-07T12:00:00Z
  Generator   active
  Org         org-00000000-...

Use this to check if a token is still valid before embedding it, or to display provenance metadata without re-verifying the image.

`certivu attestation`

Generate a compliance attestation for your org — a factual record of provenance and verification activity over a date range, mapped to EU AI Act Article 50. Enterprise plan only; requires an API key.

certivu attestation --format html \
  --from 2026-01-01 --to 2026-03-31 \
  --out attestation.html

Flags:

Flag	Description
`--format <type>`	`json` or `html` (default: `json`)
`--from <ISO>`	Inclusive start of the reporting window (ISO 8601)
`--to <ISO>`	Inclusive end of the reporting window (ISO 8601)
`--out <path>`	Write the attestation to a file instead of stdout
`--api-key <key>`	Override API key from config

An attestation is a factual record of activity, not a certification, legal opinion, or guarantee of compliance. See the Attestation API reference.

`certivu c2pa`

Embed a post-quantum (ML-DSA-signed) C2PA manifest into a signed JPEG or PNG, bound to an existing record. Pass the signed asset so the C2PA hard binding covers the same bytes Certivu verifies. Requires a Growth plan or above.

certivu c2pa <record_id> ./output.signed.jpg --out output.c2pa.jpg

Flags:

Flag	Description
`--out <path>`	Output file (default: `<input>.c2pa.<ext>`)
`--api-key <key>`	Override API key from config

The manifest is interoperable with the Content Credentials ecosystem but signed with ML-DSA-65 — standard verifiers report the algorithm as unrecognized (the quantum-resistant trade-off). Requires a generator with a server-managed keypair.

`certivu config`

certivu config get              # show all config values
certivu config set api-key ...  # save a value

Valid keys: api-key, generator-id, base-url.

Environment variables

Variable	Description
`CERTIVU_API_KEY`	Your `ctv_key_...` API key
`CERTIVU_GENERATOR_ID`	Default generator UUID
`CERTIVU_BASE_URL`	Override API URL (default: `https://api.certivu.ai`)

CI usage

# GitHub Actions example
- name: Sign AI output
  env:
    CERTIVU_API_KEY: ${{ secrets.CERTIVU_API_KEY }}
    CERTIVU_GENERATOR_ID: ${{ secrets.CERTIVU_GENERATOR_ID }}
  run: |
    curl -fsSL https://certivu.ai/install.sh | sh
    certivu sign ./output.jpg --model my-model
    # watermarked image written to ./output.signed.jpg

GitHub Releases

All release binaries are available at github.com/certivu/certivu/releases:

Binary	Platform
`certivu-linux-x64`	Linux x86-64
`certivu-macos-x64`	macOS Intel
`certivu-macos-arm64`	macOS Apple Silicon