Phala Cloud Documentation — Private AI on TEE

Phala Private AI is OpenAI-compatible. Most integrations require changing only the base URL and API key:

https://inference.phala.com/v1

After migration, responses can be verified with x-receipt-id, Attestation Report, and Get Receipt.

Migrate from OpenAI

from openai import OpenAI

# Before
openai_client = OpenAI(api_key="sk-...")

# After
phala_client = OpenAI(
    api_key="YOUR_PHALA_API_KEY",
    base_url="https://inference.phala.com/v1",
)

Everything else stays familiar: chat completions, streaming, tool calling, vision, structured output, and embeddings use OpenAI-compatible request shapes.

Migrate from OpenRouter

from openai import OpenAI

client = OpenAI(
    base_url="https://inference.phala.com/v1",
    api_key="YOUR_PHALA_API_KEY",
)

Model ids use the provider/model format returned by /v1/models. Verify the actual response receipt when you need evidence for an exchange.

OpenAI SDK

from openai import OpenAI

client = OpenAI(
    api_key="YOUR_PHALA_API_KEY",
    base_url="https://inference.phala.com/v1",
)

response = client.chat.completions.create(
    model="z-ai/glm-5.3",
    messages=[{"role": "user", "content": "Explain TEE privacy."}],
)

print(response.choices[0].message.content)

import OpenAI from "openai";

const client = new OpenAI({
  apiKey: process.env.PHALA_AI_API_KEY,
  baseURL: "https://inference.phala.com/v1",
});

const response = await client.chat.completions.create({
  model: "z-ai/glm-5.3",
  messages: [{ role: "user", content: "Explain TEE privacy." }],
});

LangChain

from langchain_openai import ChatOpenAI

chat = ChatOpenAI(
    model="z-ai/glm-5.3",
    api_key="YOUR_PHALA_API_KEY",
    base_url="https://inference.phala.com/v1",
)

response = chat.invoke("Explain confidential inference in one paragraph.")
print(response.content)

Vercel AI SDK

import { generateText } from "ai";
import { createOpenAI } from "@ai-sdk/openai";

const phala = createOpenAI({
  apiKey: process.env.PHALA_AI_API_KEY,
  baseURL: "https://inference.phala.com/v1",
});

const { text } = await generateText({
  model: phala("z-ai/glm-5.3"),
  prompt: "Explain attestation.",
});

Langfuse

import os
from langfuse.openai import OpenAI

os.environ["LANGFUSE_PUBLIC_KEY"] = "pk-lf-..."
os.environ["LANGFUSE_SECRET_KEY"] = "sk-lf-..."
os.environ["LANGFUSE_HOST"] = "https://cloud.langfuse.com"

client = OpenAI(
    api_key="YOUR_PHALA_API_KEY",
    base_url="https://inference.phala.com/v1",
)

Observability tools may store prompts, responses, metadata, or traces. For sensitive data, configure redaction or self-hosting before sending production traffic.

For custom Node.js or Bun applications, use the TypeScript ACI Verifier to inject a pinned fetch and audit signed receipts in code.

Gateways

Cloudflare AI Gateway

In Compute & AI → AI Gateway → Custom Providers → Add Custom Provider, set Provider Name to Phala, Provider Slug to phala, and Base URL to https://inference.phala.com, then save and enable the provider. Cloudflare’s custom-provider routing appends the path after custom-phala/, so the request includes /v1/chat/completions. For authenticated gateways, also send cf-aig-authorization:

curl "https://gateway.ai.cloudflare.com/v1/$CLOUDFLARE_ACCOUNT_ID/$CLOUDFLARE_GATEWAY_ID/custom-phala/v1/chat/completions" \
  -H "Authorization: Bearer $PHALA_AI_API_KEY" \
  -H "cf-aig-authorization: Bearer $CF_AIG_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "z-ai/glm-5.3",
    "messages": [{"role": "user", "content": "Hello!"}]
  }'

LiteLLM

Add this model to your LiteLLM proxy config.yaml using its generic OpenAI-compatible route. Set PHALA_AI_API_KEY in the proxy’s environment and start it with litellm --config config.yaml:

model_list:
  - model_name: phala-glm
    litellm_params:
      model: openai/z-ai/glm-5.3
      api_base: https://inference.phala.com/v1
      api_key: os.environ/PHALA_AI_API_KEY

Clients of the proxy use phala-glm as their model name; LiteLLM sends z-ai/glm-5.3 to Phala.

Migration Checklist

Create a Phala API key.
Change the base URL to https://inference.phala.com/v1.
List models with GET /v1/models.
Use a catalog model; every model on this endpoint runs in a TEE.
Capture x-receipt-id in raw HTTP responses when you need verification.
Verify one representative response before production rollout.

Private AI

Migration and Integrations

Migrate from OpenAI

Migrate from OpenRouter

OpenAI SDK

LangChain

Vercel AI SDK

Langfuse

Gateways

Cloudflare AI Gateway

LiteLLM

Migration Checklist

Use in Agents

On-demand API

Error Handling

​Migrate from OpenAI

​Migrate from OpenRouter

​OpenAI SDK

​LangChain

​Vercel AI SDK

​Langfuse

​Gateways

​Cloudflare AI Gateway

​LiteLLM

​Migration Checklist

​Related

Use in Agents

On-demand API

Error Handling

Migrate from OpenAI

Migrate from OpenRouter

OpenAI SDK

LangChain

Vercel AI SDK

Langfuse

Gateways

Cloudflare AI Gateway

LiteLLM

Migration Checklist

Related