isGenAI.com

Glossary

Signed receipt: a verifiable record of what was checked

A signed receipt is a record issued by isGenAI for a completed check that binds the file’s SHA-256 hash, the evidence found, the checks that ran and the timestamp under a digital signature, so a third party can confirm later that this report was produced for exactly this file and has not been altered.

Definitions and isGenAI behaviour as of October 2026. Updated .

See receipts in the API documentationFrequently asked questions
Code-drawn illustration for Signed receipt

Illustration · PNG file

  1. Signature + IHDR
  2. iTXt XML:com.adobe.xmprecord
  3. tEXt parameters
  4. tEXt prompt / workflow
  5. tEXt invokeai_metadata
  6. eXIf
  7. caBX C2PA manifest
  8. IDAT pixels
  9. IEND

AI source type declared

The file labels itself as AI-made.

IPTC DigitalSourceType such as trainedAlgorithmicMedia is read from XMP and shown with its exact value.

Check an image →
AI source type declared: where this record sits inside a PNG file and what the isGenAI report says about it. The picture is a code-drawn illustration.

What the receipt contains

The receipt lists the content hash, the media type, each evidence item with its class, mechanism and strength, the adapters that ran with their status, and the time of the check, and signs that record with isGenAI’s receipt key. The public key is published so anyone can verify the signature without trusting the page they are reading. Receipts are a statement about the check, not about the truth of the image.

How it differs from Content Credentials

A C2PA manifest is signed by the tool that created or edited the file and travels inside the file. A signed receipt is signed by the checker and lives outside the file, referring to it by hash. The receipt can say “this file carried a valid Firefly manifest at 10:42 UTC”; it cannot add provenance to the file.

Using receipts

Download the report and receipt from a check, store them with the file, and compute the file’s SHA-256 later with the checksum tool to confirm the binding. Reviewers and compliance teams use them as evidence that a specific check was performed on a specific artefact.

How to use this term when checking a file

  1. Upload the original file to the AI image detector or the tool named on the page.
  2. Find the finding that uses this term under “How we checked” and read the source field it names.
  3. Weigh it by kind: a signed record, a declared field, a saved prompt and a matching copy are different strengths of evidence.
  4. Remember that absence of a record is not evidence of a human author.

See receipts in the API documentation

Frequently asked questions

What does a signed receipt prove?

That isGenAI produced this report for the file with this hash at this time and that the report is unchanged. It does not prove anything about the image beyond the findings listed.

How do I verify a receipt?

Check the signature against isGenAI’s published receipt public key and recompute the file’s SHA-256 to compare with the receipt.

Is a receipt the same as a Content Credential?

No. A credential is signed by the creating tool inside the file; a receipt is signed by the checker outside it.

Can I get a receipt via the API?

Yes. The API returns the same evidence record and receipt for programmatic checks.

Sources

Definitions follow the published standards linked above; the isGenAI behaviour described is the deployed checker as of October 2026.