For developers and partners

HTTP API

The attestation engine exposes a public REST API, documented in the open OpenAPI 3.0 format — the same one this site uses.

The Swagger UI includes "Try it out": you can call the endpoints directly from your browser, without writing code, to explore requests and responses.

From the terminal and from CI

The same npm package also includes sg-attest, a command-line tool: attest and verify without opening a browser. The fingerprint is computed by streaming the file from disk — the file never leaves your machine — and there's no size cap here: the site's 1 GB limit is imposed by the browser, not by the service.

npx -y -p @spazio-genesi/attest-mcp sg-attest authorize
npx -y -p @spazio-genesi/attest-mcp sg-attest attest opera.zip --pdf certificato.pdf

With authorize you authorize once from your browser (24 hours, 20 attestations); if you have an API key, the IMGAUTH_API_KEY environment variable is enough and authorization isn't needed. Every command accepts --json for script-readable output, and returns 0 on success, 1 on error, 2 when a verification fails.

attest without --pdf only computes the fingerprint and the signature (nothing is archived: no public verification page); add --pdf <file> to also generate the signed certificate — only then is the work archived, and its /c/<fingerprint> page actually exists.

No Node.js on the machine or runner? There's also a standalone executable for Linux, macOS, and Windows — same commands, no installation.

For continuous integration there's a ready-made GitHub Action that attests build artifacts: the artifact never leaves the runner, only its fingerprint travels.

- uses: SPAZIO-GENESI/attest-action@v1
  with:
    files: dist/release.zip
    api-key: ${{ secrets.SG_API_KEY }}

Every attested file receives a signed, archived certificate, and its permanent /c/<fingerprint> page remains verifiable long after the job log is gone.

MCP server

For AI assistants and agents (Claude, and more generally any client that speaks the Model Context Protocol) there's a ready-to-use MCP server: attest and verify a file while staying local, computing the fingerprint on your device — the file never passes through our servers either way.

Installation in an MCP client (e.g. Claude Desktop, Claude Code):

npx -y @spazio-genesi/attest-mcp

Seven tools: authorization, file attestation, PDF certificate download, file verification, certificate verification, Bitcoin anchor check, service status.

Remote MCP — zero installation

For those who'd rather not install anything: the same service, reachable by adding a URL as a connector (claude.ai, Claude Code, or any MCP client that speaks HTTP Streamable). No file transfer — the agent computes the SHA-256 fingerprint by running code locally (sha256sum/certutil/shasum) and passes only that: the file never passes through the client or our servers, a level of privacy that goes even beyond the Telegram bot.

No authentication is required to add the connector: public tools (service status, anchor check, verification) are available immediately; to attest, the agent itself walks you through an on-the-fly authorization (link + anti-bot check, just like on the site).

Eight tools: four public (service status, Bitcoin anchor check, attestation verification, certificate lookup) and four requiring a credential (authorization, authorization completion, attestation by fingerprint, PDF certificate download).

Which credential works on which client

The MCP protocol isn't uniform across remote clients: some let you add custom headers, others don't. This determines whether your API key (Developer quota or Convention pool) can be used, or whether only the temporary in-session authorization remains available — better to know this before choosing a client than to discover it halfway through an integration.

In short: if you have a key and want your attestations to count against your quota or convention, use Claude Code (or a client with custom headers) or the local @spazio-genesi/attest-mcp package. On claude.ai attestation works, but always with an independent temporary authorization — a key↔claude.ai bridge (OAuth on the MCP server) is a possible future development, not yet built.

How to get access

Automated requests (API or MCP) go through the same engine as the site, with two access modes:

• On-the-fly authorization (to try it right away). The MCP server — or your own integration — opens a link that you confirm yourself with a quick anti-bot check: from that moment you have access valid for 24 hours, up to 20 attestations. No registration, no permanent password.
• Self-service API key (for ongoing integrations). Verify your email with Google, Microsoft, or LinkedIn and get a key right away with 50 attestations a month, revocable at any time. No password of ours, no waiting.
  Get an API key
• Production and higher quotas. Beyond 50 attestations a month, the self-service path is the Professional tier (200 attestations a month, same email identity, also via API). For conventions and partnership agreements, write to us at [email protected] describing your intended use case.

Your app in production: two models

If you're building an application that integrates attestation, in production you have two paths — they're not mutually exclusive, it depends on who owns the identity that ends up on the certificate.

Built an integration (model A or B)? Submit it to the public Integrations showcase from your profile — publication is manually reviewed by the service manager before going live.