@tectra/sdk

Official JavaScript / TypeScript SDK for the Tectra content provenance platform.

A C2PA Contributor Member implementation.

Install

npm install @tectra/sdk

Quick start

import { TectraClient } from "@tectra/sdk";

const client = new TectraClient({
  apiKey: "iai_your_api_key",
  signingKeyId: "your-signing-key-uuid",
});

// Sign an image
const result = await client.sign(file);
console.log(result.record_id);          // UUID
console.log(result.blockchain_tx);      // Polygon tx hash

// Verify — no API key needed, no upload for videos
const check = await client.verify(imageFile);
if (check.authentic) {
  console.log(`Signed by ${check.signer?.org_name}`);
  console.log(`Confidence: ${Math.round(check.confidence * 100)}%`);
}

Verification — how it works

The SDK uses a two-tier approach that minimizes data leaving your application:

| Tier | Method | Network? | Use case | |------|--------|----------|----------| | 1 | SHA-256 hash lookup | Hash only (~100 bytes) | Exact original file | | 2 | Full upload | Image bytes | Modified copies, screenshots |

Videos are always Tier 1 — only the hash is sent. The video file never leaves the client.

// Equivalent to client.verify() — use when you already have the hash
const result = await client.verifyByHash(
  "7f5287772e276e43...",  // SHA-256 hex
  "video/mp4",
);

API reference

new TectraClient(config)

| Option | Type | Required | Description | |--------|------|----------|-------------| | apiKey | string | Yes | Your API key (iai_...) | | signingKeyId | string | No | Default signing key UUID | | apiUrl | string | No | Override API base URL |

Signing

// Sign a file
const result = await client.sign(file);
const result = await client.sign(file, { returnFile: true });

// Sign multiple files
const batch = await client.signBatch([file1, file2]);

Verification

// Auto two-tier (recommended)
const result = await client.verify(file);

// Hash-only (no upload)
const result = await client.verifyByHash(sha256Hex, contentType);

Records

await client.listRecords({ skip: 0, limit: 20, originType: "ai" });
await client.getRecord(id);
await client.getCertificate(id);
await client.revokeRecord(id);

Keys & webhooks

await client.createSigningKey("production", "ai_generated_image");
await client.listSigningKeys();
await client.createApiKey("my-key", "sign,verify");
await client.createWebhook({ url: "https://...", events: "content.signed" });

Error handling

import { TectraClient, TectraError } from "@tectra/sdk";

try {
  await client.sign(file);
} catch (err) {
  if (err instanceof TectraError) {
    console.error(`API error ${err.status}: ${err.detail}`);
  }
}

Requirements

• Node.js 18+ (uses native fetch and crypto.subtle)
• Browser: any modern browser (Chrome 90+, Firefox 90+, Safari 15+)

Links

• Tectra
• Documentation
• npm
• C2PA — Tectra is a Contributor Member

License

MIT