# Cosign

**Canonical:** https://apis.io/apis/sigstore/cosign/  
**Provider:** Sigstore — https://apis.io/providers/sigstore/  
**Documentation:** https://docs.sigstore.dev/cosign/signing/overview/

Cosign is one of 6 APIs that [Sigstore](https://apis.io/providers/sigstore/) publishes on the [APIs.io](https://apis.io/) network. Tagged areas include Code Signing, Containers, OCI, Security, and Software Supply Chain. The published artifact set on APIs.io includes API documentation and a GitHub repository.

Cosign is the Sigstore tool for signing and verifying container images and other OCI artifacts. It enables keyless signing using OIDC identity, hardware token signing, and policy enforcement for container supply chain security.

## Machine-readable artifacts (3)

- **Documentation** — https://docs.sigstore.dev/cosign/signing/overview/
- **GitHubRepository** — https://github.com/sigstore/cosign
- **APIsJSON** — https://raw.githubusercontent.com/api-evangelist/sigstore/refs/heads/main/apis.yml

## Other Sigstore APIs (5)

- [Sigstore CA API](https://apis.io/apis/sigstore/sigstore-ca-api/)
- [Sigstore entries API](https://apis.io/apis/sigstore/sigstore-entries-api/)
- [Sigstore index API](https://apis.io/apis/sigstore/sigstore-index-api/)
- [Sigstore pubkey API](https://apis.io/apis/sigstore/sigstore-pubkey-api/)
- [Sigstore tlog API](https://apis.io/apis/sigstore/sigstore-tlog-api/)

## Tags

Code Signing, Containers, OCI, Security, Software Supply Chain

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/sigstore/cosign/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/sigstore/.