Independent verification

Every VMI certificate is cryptographically signed. “Signature verified” on a certificate page today means VMI's own server checked its own signature: useful, but not something you have to take on trust. Everything below is what you need to check a signature yourself, with nothing but public tools: no VMI account, no VMI server, no trusting VMI's word for it.

How a VMI signature works

Each certificate record is serialized as canonical JSON (its own keys, sorted alphabetically), then signed with ECDSA over the P-256 curve, using SHA-256 as the hash function. Every certificate stores which key version signed it (signingKeyVersion, defaults to “v1” if absent, since that field predates some early certificates). To check one yourself: take the certificate's fields exactly as published (excluding the signature itself), serialize them as JSON with sorted keys, and verify that JSON against the certificate's signature using the matching public key below.

Public signing keys

Every key VMI has ever signed a certificate with, oldest first. A key never gets removed from this list: rotating to a new version adds a new entry here, it never replaces an old one, so every certificate ever issued stays independently checkable forever.

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEajUZPItmXh2TDFzzIAJzgtNjBwsd
VIfT0wlnL67p8oH2ORCgedI+wLxsWrbzAWQi0XNwdQcqq0KSeZoOySnrKg==
-----END PUBLIC KEY-----

API for automated verification

For other software to check a file's registration status by its SHA-256 hash, no VMI account needed on the caller's end beyond an API key, and no audio file ever has to leave their system. Generate a key from your VMI account's API access settings.

POST https://verifiedmusicidentity.com/api/v1/verify

An Authorization header, bearer-token style:

Authorization: Bearer vmiapi_<your key>
Content-Type: application/json

{
  "sha256": "3a1d58018e858f33b7136fd74878fbe066f0c16d788fbd602debdf4dcfee623f"
}

{
  "certified": true,
  "revoked": false,
  "note": "Exact byte-for-byte match against a certified master. This does NOT rule out watermark-based traceability of modified copies; that requires the actual audio file, checked via the website.",
  "certificate": {
    "certId": "6528ace0c52a7f877617d92d8700ef8f",
    "artistName": "Hugo Forsh",
    "trackTitle": "Yellow Lover",
    "registeredAt": "2026-07-16T19:10:53.000Z",
    "certificateUrl": "https://verifiedmusicidentity.com/cert/6528ace0c52a7f877617d92d8700ef8f"
  }
}

{
  "certified": false,
  "note": "No exact match. This means the hash is not registered with VMI as a certified master, and nothing more. It does not indicate the file is AI-generated, unowned, or infringing. ..."
}

1,000 requests per hour, per API key.

Hash-only matching can only confirm an EXACT, byte-for-byte match against a certified master. It cannot detect a VMI watermark in a modified copy; that needs the real audio file, checked via the website's own verify page. Every API response says so explicitly, not just this paragraph.