Phala Cloud Documentation — Private AI on TEE

Hermes speaks Chat Completions. Private AI Proxy configures it automatically.

With Private AI Proxy

Install Private AI Proxy, choose a Phala profile, sign in, and turn on Protected.
On the Agents screen, connect Hermes.
Start a new Hermes session; existing sessions stay on their original provider.

The app writes the provider into ~/.hermes/config.yaml with an agent-scoped token for its local API, and restores the file when you disconnect or stop Protected. From the CLI, the same connection is:

pap agents connect hermes

Without the Proxy

Create a key under Private AI → API Keys in the Phala dashboard. Define and select a named provider. Hermes reads the key from its process environment or ~/.hermes/.env; do not put it in config.yaml.

export PHALA_AI_API_KEY="YOUR_PHALA_API_KEY"

~/.hermes/config.yaml

providers:
  phala:
    api: https://inference.phala.com/v1
    key_env: PHALA_AI_API_KEY
    transport: chat_completions
    default_model: z-ai/glm-5.3
    discover_models: true

model:
  provider: custom:phala
  default: z-ai/glm-5.3

This changes the main text and tool-calling loop only; image, speech, embedding, search, and browser providers stay separate. This path does not verify attestation locally; use Private AI Proxy or the TypeScript ACI Verifier. Every model on this endpoint runs in a TEE.

Check the Connection

Start hermes, run /model, and confirm the active provider, then run one harmless tool task.

Troubleshooting

Symptom	Check
Hermes ignores the Proxy	Confirm Connected in the app and that Protected is on, then start a new session.
Provider is not selected	Start a new session and choose `custom:phala` with `/model`.
Authentication fails	Export `PHALA_AI_API_KEY` in the Hermes process environment.

​With Private AI Proxy

​Without the Proxy

​Check the Connection

​Troubleshooting

​Related

With Private AI Proxy

Without the Proxy

Check the Connection

Troubleshooting

Related