Skip to main content
Encypher Logo

Content provenance with Vercel Edge Middleware Sign every article at the edge.

Vercel Edge Middleware adds a signed label to every article as your CDNCDN: Content delivery network: servers around the world that keep copies of a site close to readers so pages load fast. serves it. The label shows who published the text and whether it changed. It drops into a Next.js project, and signing is free for publishers.

Create a free accountTalk to us
A reader requests a page through a CDN edge worker; the worker fetches the page from your unchanged server, has Encypher sign the text, and serves the signed page, caching the signed copy for the next visit. If anything fails, the original page goes through.
The edge worker adds the label on the way out. Your server stays the same, signed copies are cached, and the page always loads.
A label in every article
Each article gets content provenanceContent provenance: The record of where a piece of content came from and how it changed, carried with the content itself.: a C2PA manifestC2PA manifest: The signed label itself: a small package inside a file that records who signed it, what they declared and how to check it. and invisible provenance markersProvenance markers: Encypher's general name for invisible characters that carry a signed label inside text. in its text, sentence by sentence.
Nothing changes at origin
The edge functionEdge function: A small program that runs on a CDN's servers and can change a page as it passes through to the reader. sits between readers and your origin serverOrigin server: The server where your site's pages are built and stored before a CDN delivers them.. It finds the article on WordPress, Ghost, Substack, Webflow, Hugo and custom HTML.
Never blocks a page
It is fail-openFail open: If signing is down, the page is served unsigned instead of failing, so readers never see an error.: if signing fails for any reason, readers get your original page.
Fast repeat visits
Signed results are kept in memory while an edge instance stays warm, so repeat visits skip the signing call.

Set it up

  1. Claim your domain

    Create a free account and claim your domain. You get a worker credentialWorker credential: A secret key, tied to one verified domain, that lets an Encypher edge worker ask for signatures., a secret key tied to that domain.

    Create a free account

  2. Add the middleware

    Copy middleware.js and its src folder into the root of your Next.js project.

  3. Set the credential and deploy

    Add ENCYPHER_WORKER_TOKEN under project environment variables, then deploy.

  4. Check the label

    Open an article and look for the header X-Encypher-Provenance: active. Then paste a paragraph into the free checker.

    Open the free checker

Copied text keeps the label

Signed text copied into most apps and sites keeps its label; some apps strip the invisible characters and the check then finds no label; editing the words breaks the seal and the check shows the change.
Copy and paste keeps the label in most apps. Some apps strip it, and any edit shows up when the text is checked.

The markers sit between the letters, so they travel when a reader copies a paragraph into a document, a post or an AI prompt.

Some apps strip them. Any edit to the words shows up when the text is checked.

Check a paragraph

For engineers

Show the technical detail
cp middleware.js /path/to/your-project/
cp -r src/ /path/to/your-project/src-encypher/
# Update the import paths in middleware.js if you rename src/

# Set ENCYPHER_WORKER_TOKEN in Project settings > Environment variables
vercel deploy
Article detection
Eight checks in order: your selector override, the <article> tag, common CMS classes, Schema.org articleBody, <main>, JSON-LD, the densest paragraph cluster, then <body>.
What is sent
Only the visible article text, up to 51,200 characters by default. The API returns an embedding plan, and the worker writes the markers into the HTML at those positions.
Status header
X-Encypher-Provenance is active on a signed page, or skipped:oversized, skipped:empty or skipped:error when the page passes through unchanged.
Existing middleware
If your project already has middleware.js, merge the middleware body and the config.matcher entry into it. The matcher skips static assets.
Cache
An in-process map with TTLs, per edge instance. Cold starts provision and sign again on the first request.

Keep reading

Create. Mark. Endure.

Sign every article you serve on Vercel.

Create a free accountTalk to us