Private inference your agent can prove.

Elyra is an OpenAI-compatible inference API that runs inside hardware-attested enclaves. Every response comes with a signed receipt, and every receipt is anchored on Elysium. Your agent can prove what ran, where, and what it paid, and anyone can check the proof without trusting Elyra.

01Overview

• Gateway https://api.elyra.technology runs in an Intel TDX virtual machine whose code, configuration and keys are measured and published. It verifies the provider's GPU enclave before forwarding, and signs a receipt for every response.
• Providers serve open-weight models in confidential GPU enclaves: Phala (through RedPill) and NEAR AI Cloud. On NEAR routes each non-streamed response is also signed by the model enclave that produced it.
• Accounts are wallets. Sign a message to get an API key; fund it with USDC.
• Receipts record the model, the attested provider session, commitments to the exact request and response, and what was billed. They are anchored on Elysium every 10 minutes.

02Quickstart

With the elyra command from @elyra/sdk (Node 20 or later), from an empty wallet to a verified receipt:

npm install -g @elyra/sdk             # or run each command as npx @elyra/sdk …
export ELYRA_PRIVATE_KEY=0x…           # a wallet funded on Elysium

elyra signin --save                    # sign a message, get an API key
elyra deposit 10                       # credited, net of the deposit fee, within seconds
elyra chat "Reply with the single word: sealed"
elyra verify --last                    # run again once the 10-minute slot has closed

verify reads the saved receipt back and prints what it proves:

✓ receipt signature by the attested key
✓ receipt names the attested keyset
✓ request commitment matches the bytes sent
✓ response commitment matches the bytes received
✓ provider enclave verified before forwarding
✓ cited provider session checks out
✓ keyset bound into the TDX quote
✓ workload measured and linked to public source
✓ production OS image
· TDX quote chains to Intel (checked live by verify-gateway)
✓ billing                     0.00001135 USD for 19+17 tokens, billed $0.000012
✓ charged to this key         yes
✓ anchor                      batch 2, leaf 0 of 2, 2026-11-09T21:40:01.000Z, tx 0x2c8a…41d0

verdict: VERIFIED

elyra verify-gateway checks the live gateway: the TDX quote to Intel's root, the measured compose and source commit, the production OS, and that your TLS connection ends at the attested key.

03In code

// npm install @elyra/sdk
import { Elyra, privateKeySigner, signIn, depositUsdc, MAINNET, toMicros } from '@elyra/sdk';

const wallet = privateKeySigner(process.env.KEY, { rpcUrl: MAINNET.rpcUrl, chainId: MAINNET.chainId });
const { apiKey } = await signIn(wallet);                      // shown once: store it
await depositUsdc({ signer: wallet, amountMicros: toMicros('10') });

const elyra = new Elyra({ apiKey, receiptDir: './receipts' });
const { response, saved } = await elyra.chat({
  model: 'qwen/qwen3.8-27b',
  messages: [{ role: 'user', content: 'Summarize the position risk.' }],
});
// later, once the slot has closed:
const proof = await elyra.verify(saved.dir);                  // signature, billing, payer, anchor

Any wallet works: implement Signer (address, signMessage, and sendTransaction for deposits) around viem, ethers or a hardware wallet. The client saves each receipt with the exact request and response bytes, the provider session it cites, and the attestation report of the keyset that signed it, so it can be verified later, offline.

04With the OpenAI SDK

import OpenAI from 'openai';
const client = new OpenAI({ baseURL: 'https://api.elyra.technology/v1', apiKey: process.env.ELYRA_API_KEY });
const res = await client.chat.completions.create({ model: 'qwen/qwen3.8-27b', messages: [...] }).withResponse();
const receiptId = res.response.headers.get('x-receipt-id');   // fetch it within the hour

To have every request go over a verified channel, run the local verifying proxy and point the client at it. It verifies the gateway before it starts, pins the attested TLS key, and checks every receipt:

npx @elyra/proxy serve https://api.elyra.technology --require-production-os
# base URL: http://127.0.0.1:4180/v1

05Account and funding

In a browser, the account app does all of this with your wallet: deposit, create and revoke API keys, and see usage and deposits. Agents use the endpoints below, or the SDK.

Sign in

GET https://auth.elyra.technology/auth/nonce?wallet=0x… returns a message; sign it with EIP-191 personal_sign and send {wallet, nonce, issuedAt, signature} to POST /auth/key. The API key is shown once. Each sign-in issues a new key; earlier keys keep working until you revoke them.

Manage keys

A management session lists, labels and revokes keys and shows usage and deposits. GET /auth/session/nonce?wallet=0x… returns a message to sign; POST /auth/session with {wallet, nonce, issuedAt, signature} returns a session token, valid for 12 hours. It manages the account and cannot call models, and an API key cannot manage the account.

Deposit USDC

Approve the credit vault for USDC, then call deposit(amount) from your wallet, or depositFor(account, amount) to fund another wallet. The balance is credited within seconds of the deposit being mined, net of the deposit fee. Deposit from a wallet you control, and use the vault's functions: a plain USDC transfer to the vault is not credited.

Automatic top-up

With the SDK, an agent can keep itself funded: when its balance falls below a threshold, the client deposits a set amount from a wallet you choose, waits until it is credited, and retries a request refused for insufficient credit once. A daily cap limits the deposits.

new Elyra({ apiKey, autoTopUp: { signer: wallet, below: '5', amount: '20', maxPerDay: '100' } })

Or fund an agent from another wallet without running anything: in the account app, save a top-up rule on the credit vault (the account, the threshold, the amount and a daily maximum) and approve the vault for USDC. Elyra's keeper, a key only the attested control plane holds, tops the account up when it runs low. The vault contract enforces the amount, the account and the daily maximum, and you turn it off at any time.

Balance

GET https://auth.elyra.technology/account with Authorization: Bearer <API key> returns your balance, in micro-USD.

Prepaid credit

Your balance is prepaid credit: it never expires, works with every key on the account, and is spent request by request at the providers' list prices. Deposit what your agents will use and let automatic top-up keep it there. Credit is not refundable.

06Models and providers

GET https://api.elyra.technology/v1/models lists every model with its per-token prices and routes. At launch:

Choose providers per request with an OpenRouter-style block: "provider": {"only": ["near-ai"]}, or {"order": ["redpill", "near-ai"], "allow_fallbacks": true}. Provider names are redpill, near-ai and chutes. A route marked opt-in in /v1/models is used only when you name it.

Chutes runs on Bittensor's open GPU network, where independent operators run the machines. Elyra verifies each machine on its own (Intel TDX quote, NVIDIA GPU attestation) and encrypts every request end to end to that machine's attested key, so neither Chutes nor the operator sees your prompt. Hardware limits are set out in the protocol spec.

07API reference

api is https://api.elyra.technology, auth is https://auth.elyra.technology. Both terminate TLS inside the attested VM.

08Receipts

A receipt is a JSON document signed with an Ed25519 key that lives only inside the gateway's enclave and is listed in its attested keyset. Its event log records, in order:

The payer commitment is sha256("billing.payer.v1:" + hex(sha256(api_key)) + ":" + receipt_id). It names no account and links no two receipts; you prove a receipt was charged to you by disclosing your key's hash, never the key.

Fetch receipts within the hour: the gateway keeps them for an hour. The SDK and the verifying proxy do it for you.

09Verify

The gateway

npx @elyra/proxy verify https://api.elyra.technology --require-production-os

Checks the TDX quote to Intel's root, that the keyset and your nonce are bound into it, that the measured compose links to the public source commit, the production OS image, and that your TLS connection ends at the attested key. Pin a compose hash with --accept-compose.

A receipt

npx @elyra/proxy audit --report attestation.json --receipt receipt.json \
  --request-body request.json --response-body response.json --session session.json --require-production-os

Checks the signature against the attested keyset and the request and response bytes against the receipt's commitments. elyra verify runs this for you on a saved receipt.

The anchor

The digest is SHA-256 of the receipt's JCS (RFC 8785) bytes. Get its proof from https://auth.elyra.technology/receipts/{digest}/proof and ask the contract directly:

cast call <ReceiptAnchor> \
  'verifyReceipt(bytes32,uint256,bytes32,bytes32[])(bool)' \
  <batchRoot> <batchIndex> <digest> '[<proof>]' \
  --rpc-url <Elysium RPC>

Receipts are anchored in fixed 10-minute slots (UTC): a slot's receipts become one Merkle root, anchored seconds after the slot ends by a key that only the attested gateway VM can derive. The chain sees the slot, never when in it your request ran.

10Pricing

• Tokens are priced at the providers' own list prices. /v1/models has them; every response carries its usage.cost.
• Deposits: a fee of 5% is kept from each USDC deposit. GET /pricing always has the current rate.
• Billing is the exact cost rounded up to the next micro-USD, and every receipt records the tokens, rates and amount, so any charge can be recomputed.
• If one request allows several providers, it is priced at the highest of their list prices.

11Network and contracts

Anchor and vault addresses are published here and in the app at launch, and stay identical to the SDK's MAINNET constants.

12Good to know

• Receipts are kept at the gateway for an hour; anchoring proofs are kept for good.
• A proof is available within about 10 minutes, once the receipt's slot has closed.
• Every wallet is screened against sanctions lists at sign-in and on deposit.
• The gateway never logs prompts, responses, keys or wallets.
• Availability may be restricted in some jurisdictions.