Phala Cloud Documentation — Private AI on TEE

Signature

curl --request GET \
  --url https://api.example.com/signature/{id}

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/signature/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/signature/{id}"

	req, _ := http.NewRequest("GET", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.example.com/signature/{id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)

response = http.request(request)
puts response.read_body

GET

signature

{id}

Signature

curl --request GET \
  --url https://api.example.com/signature/{id}

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/signature/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/signature/{id}"

	req, _ := http.NewRequest("GET", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.example.com/signature/{id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)

response = http.request(request)
puts response.read_body

GET /v1/signature/{id} is a legacy compatibility endpoint. It returns the same proof as the canonical Get Receipt endpoint, but wrapped in the older text, signature, and signing_address envelope. New integrations should use GET /v1/aci/receipts/{id}.

Endpoint

GET https://inference.phala.com/v1/signature/{id}?signing_algo=ecdsa

Parameters

string

required

Receipt id (rcpt-...) or response id from POST /v1/chat/completions.

string

default:"ecdsa"

Legacy wrapper signature algorithm: ecdsa (default) or ed25519. This selects the wrapper signer; the canonical receipt retains its own key_id and Ed25519 signature.

Example

curl "https://inference.phala.com/v1/signature/$RECEIPT_OR_RESPONSE_ID" \
  -H "Authorization: Bearer <API_KEY>"

Response

Field	Description
`api_version`	ACI version token, for example `aci/1`.
`signing_algo`	Signature algorithm, for example `ecdsa`.
`signing_address`	Address that signed `text`.
`text`	`"<request body hash>:<response hash>"`.
`signature`	Signature over `text`.
`receipt`	Full receipt object, identical to the canonical `/v1/aci/receipts/{id}` response.

{
  "api_version": "aci/1",
  "signing_algo": "ecdsa",
  "signing_address": "0xffb22d95...",
  "text": "111d08a5...:07703fb4...",
  "signature": "0xd0cd266a...",
  "receipt": {
    "receipt_id": "rcpt-...",
    "event_log": ["..."],
    "signature": "..."
  }
}

Verification

For new clients, verify the receipt object directly:

Fetch a fresh Attestation Report.
Confirm receipt.workload_keyset_digest matches the report.
Resolve receipt.key_id in the attested receipt_signing_keys and verify receipt.signature over the JCS receipt with signature removed. The canonical receipt uses ed25519 (dstack-kms-receipt-ed25519-v1), independently of the wrapper’s signing_algo.
Confirm request.received.body_hash and response.returned.body_hash match the exact bytes you sent and received. On this TEE-only endpoint, require upstream.verified.result: verified, required: true, and a verified cited session.

For legacy clients that verify the wrapper, also verify signature over text, then bind signing_address back to a fresh attestation report.

​Endpoint

​Parameters

​Example

​Response

​Verification

​Related

Get Receipt

Verify a Response

Endpoint

Parameters

Example

Response

Verification

Related