ElevenLabs Music can sign MP3s with C2PA; what to log for a Sume track

If you need a signed credential on AI music, the ElevenLabs Music API offers one, but only for MP3. Sume's Music documentation, as read on 2026-10-05, describes no audio credential, so for a Sume track you keep your own record: the job id, the prompt, the routed model and the artifact URL. That record does not travel with the file the way a C2PA manifest would, so store it next to the file.

The ElevenLabs compose reference (read 2026-10-05) lists sign_with_c2pa among its optional parameters and describes it as adding C2PA authentication, MP3 only. The same reference lists output formats that include MP3, PCM, Opus and ulaw or alaw variants, with a default of mp3_44100_128 for v1 and mp3_48000_192 for the v2 models. The pricing is not on that page.

The two sides, in one table

The Eleven Music overview (read 2026-10-05) says a track runs from 3 seconds to 5 minutes, exports as MP3 or WAV, and is cleared for nearly all commercial uses, with details depending on the plan. The compose reference allows model versions music_v1, music_v2 or music_v2_5. Treat these as the vendor's current description, since the two pages give slightly different ranges for some parameters.

On Sume, Music Router jobs return a hosted audio artifact, usually audio/mpeg on media.sume.com, and charge a fixed price per generation: $0.125 for each accepted Music 1.0 generation, with every Music Router model charging the fixed Music price. The prompt can be 1 to 5000 characters, and the length is controlled in the prompt, because Sume rejects duration and duration_seconds.

What to log for each Sume track

Keep five things for each track that you ship in an ad or a Reel: the job id, the date, the exact prompt, the job.request.routed_model value (the catalog engine that ran, such as lyria-3.5), and the artifact URL from result.artifacts[] where type is audio. Keep them in your asset database, keyed by the file hash of the track you uploaded to the platform.

If a platform later asks where an audio bed came from, that record answers the question. It also lets you regenerate with the same prompt if you need a variant, though the result will not be identical.

• Do not rely on a file name to prove origin. Re-encoding changes the file.
• Store the clean prompt, including the section time ranges if you used them.
• Record the platform's own AI label setting for the post, since that is a separate disclosure.
• Re-check the ElevenLabs page before you rely on sign_with_c2pa, because a flag that is MP3-only will not apply to a WAV export.

When a signature matters more than a log

If a client's policy requires a credential embedded in the file, use a route that provides one and verify it with a C2PA tool before delivery. A log protects you in a dispute about origin. A manifest lets a third party check origin without asking you. Which one you need is a policy question for your client, not a technical one, so ask before you pick the engine.