fidrouter checking…
Verifiable · no-log · TEE-attested

Don't trust. Verify.

A no-log LLM relay you don't take on faith. Every request runs in a hardware enclave whose exact open-source build is cryptographically attested — check the running code is the published code, and that it keeps no prompts, before you trust it.

How it works

Your prompt is verified end-to-end and served in an attested, no-log enclave — the gateway never sees it.

Your appprovider key + fid SDK Gateway (New API)identity + billing · not in path cp-adapterkey → capability token Enclave (TEE)attested · no-logsees plaintext in RAM only LLM providerAnthropic / OpenAI Neutral registrymeasurement → source E2EE prompt + token
1 · TokenYou keep your provider key; cp-adapter (beside the gateway) swaps it for a capability token. The gateway never sees the prompt.
2 · VerifyThe SDK checks the enclave's attestation against the neutral registry and fails closed on mismatch.
3 · SealYour prompt is end-to-end-encrypted to the attested enclave and opened only in its memory.
4 · ReceiptThe enclave returns a signed metadata receipt (no content) — verify it anytime.
For developers

Use it with the key you already have

You send prompts. Keep using your provider's key — the drop-in SDK verifies the enclave and E2EEs your prompt, fail-closed.

  • Drop-in from fid import OpenAI
  • Verifies attestation before sending
  • Verify any response's signed receipt
How to use →Verify a receipt
For relay operators

Run a verifiable, no-log relay

You run a gateway. Offer a verifiable lane to your users while your gateway stays the identity + billing system, never in the data path.

  • Register your enclave endpoint (live-attested)
  • Inject your key operator-blind, in your browser
  • Per-user usage from unforgeable receipts
Partner sign in →Read the docs

Use it — with the key you already have

Get your key from your provider, as today. Point the drop-in SDK at the relay; it exchanges the key, verifies the enclave, and E2EEs the prompt — automatically, fail-closed. No login; the platform never sees your prompt.

from fid import OpenAI                       # pip install fidrouter — drop-in
client = OpenAI(api_key="sk-...",            # the key from your provider
                base_url="https://<relay>")   # SDK verifies + E2EE under the hood
client.chat.completions.create(model="claude-opus-5",
    messages=[{"role":"user","content":"hi"}])   # → served in the verified enclave

Verify a receipt

Every response carries a signed X-Fid-Receipt (metadata only). Paste one to check it was signed by a registered enclave and the model wasn't downgraded.

← back

loading…

Partner sign in

Run a verifiable relay? Sign in to register your enclave, inject your key operator-blind, and see usage. Signup is open; endpoints go live only after review.

Operator / internal login

Partners sign in with GitHub / Google. ← back

Usage

Per-user usage from signature-verified receipts (metadata only — the platform never saw a prompt, can't inflate these).

User / tenantRequestsIn tokOut tokModels

Your enclave endpoints

Each is live-attested. Register → review → an admin publishes (refused unless it attests).

NameBase URLMeasurementStatusAttest

Register a new endpoint

Onboard your relay

Stand up a verifiable, no-log relay bound to your gateway.

  1. CP keypair — generate below; the public half bakes into your enclave, the seed stays with your cp-adapter (we never see it).
  2. Build + deploy the enclave — reproducible build at github.com/aoraki-labs/fidrouter → get base_url + measurement.
  3. Register the endpoint — the Endpoints tab (live-attested).
  4. Bundle cp-adapter beside your gateway (fidrouter-cp-adapter).
  5. Inject your key — the BYOK tab (operator-blind, in your browser).
  6. Metering → point the enclave's FIDPROXY_METERING_URL at .

Generate a CP keypair (in your browser)

Seed shown once, never sent to us.

Inject your upstream key — operator-blind, in your browser

The plaintext key is sealed in this browser to your attested enclave; we only receive ciphertext. Every check goes green before it seals.

1
Measurement pinned from the registry
2
Endpoint attests green (independent)
3
Sealing key signed by the attested identity
4
Sealed in-browser (plaintext never sent)
5
Ciphertext submitted → enclave accepted

Admin — endpoint review

Publish refused unless the endpoint attests green; then publish the registry.

NameBase URLMeasurementAttest