Verify private inference.

Use PAP with your app

PAP (Private AI Proxy) verifies the gateway before forwarding prompts and audits signed receipts after responses stream. Use it with your existing API client.

Create an inference API key under Private AI / API Keys in the Phala dashboard.

npm install --global private-ai-proxy
pap serve https://inference.phala.com

Keep PAP running. In another terminal, set PHALA_INFERENCE_API_KEY to your inference key and send the request below. PAP forwards the key from the request.

export PHALA_INFERENCE_API_KEY='your-inference-api-key'

curl -fsS -i "http://127.0.0.1:4180/v1/chat/completions" \
  -H "Authorization: Bearer $PHALA_INFERENCE_API_KEY" \
  --json '{
  "model": "phala/qwen3.8-27b-uncensored",
  "messages": [
    {
      "role": "user",
      "content": "Hello"
    }
  ]
}'

For an existing SDK client, set its base URL to http://127.0.0.1:4180/v1 and pass the value of PHALA_INFERENCE_API_KEY as its API key.

Follow a request

Follow the evidence with four curl requests. The sample outputs highlight the fields to look for. Use PAP above for cryptographic verification.

1. 01

   Gateway report

   Inspect the gateway’s hardware evidence and keys. The client checks a fresh report before connecting.

   Gateway reportCopy

   curl -fsS "https://inference.phala.com/v1/aci/attestation" \
     -H "Authorization: Bearer $PHALA_INFERENCE_API_KEY"

   Example output (excerpt)

   {
     "api_version": "aci/1",
     "workload_keyset_digest": "sha256:..."
   }

2. 02

   Inference request

   Send a request. Copy x-receipt-id from the response headers for the next step.

   Inference requestCopy

   curl -fsS -i "https://inference.phala.com/v1/chat/completions" \
     -H "Authorization: Bearer $PHALA_INFERENCE_API_KEY" \
     --json '{
     "model": "phala/qwen3.8-27b-uncensored",
     "messages": [
       {
         "role": "user",
         "content": "Hello"
       }
     ]
   }'

   Example output (excerpt)

   HTTP/2 200
   x-receipt-id: rcpt-example

3. 03

   Signed receipt

   Replace RECEIPT_ID with the ID above. Find session_id in the upstream.verified event.

   Signed receiptCopy

   curl -fsS "https://inference.phala.com/v1/aci/receipts/RECEIPT_ID" \
     -H "Authorization: Bearer $PHALA_INFERENCE_API_KEY"

   Example output (excerpt)

   {
     "receipt_id": "rcpt-example",
     "event_log": [
       {
         "type": "upstream.verified",
         "session_id": "SESSION_ID"
       }
     ]
   }

4. 04

   Provider session

   Replace SESSION_ID with the value from the receipt to inspect the provider’s connection and evidence.

   Provider sessionCopy

   curl -fsS "https://inference.phala.com/v1/aci/sessions/SESSION_ID" \
     -H "Authorization: Bearer $PHALA_INFERENCE_API_KEY"

   Example output (excerpt)

   {
     "api_version": "aci/1",
     "upstream_name": "PROVIDER",
     "verifier_id": "VERIFIER"
   }