Start or continue the device-flow authorization. Call with no arguments to begin: show the returned verification_url to the human and ask them to open it and approve. Then call again passing the same code, a few seconds apart, until status is 'approved' (token saved automatically) or 'expired' (start over). Grants 20 attestations for 24 hours.

Compute the SHA-256 fingerprint of a local file (streamed, never sent anywhere) and attest it: the server timestamps it and returns a signed attestation. Requires a credential — run 'authorize' first, or set IMGAUTH_API_KEY. Optional declared metadata (titolo/autore/anno/note) is bound to the signature.

Get the signed certificate PDF for an attested work, saving it to a local file. Pass attestation (the exact object returned by attest_file) right after attesting, to mint a freshly-signed PDF. Pass only hash to recover an already-archived certificate instead (no credential needed).

Compute the SHA-256 of a local file and check it against a declared hash/attestation, plus verify the HMAC signature server-side (no file bytes are ever sent). Pass the fields as read from the certificate (hash, attestazione, hmac, and any declared titolo/autore/anno/note).

Verify the HMAC signature of a certificate's attestation (+ declared metadata, if any) without checking against any local file. Confirms authenticity and integrity of the declared data, not that a given file matches.

Check whether a fingerprint has an OpenTimestamps proof, optionally saving the .ots proof file to disk.

Get the traffic-light status of the attestation service (worker, archive, signer, Bitcoin anchor).