Chainlink Confidential AI Attester

Private-document LLM inference runs in a service-managed TEE; raw documents never leave it and are never stored or exposed.

Scope: only the Chainlink Confidential AI Attester document-inference HTTP API. Data Feeds, CCIP, AI architecture or zkML, Anthropic or other vendor PDF APIs, and AWS Nitro/Bedrock attestation stay with their owning product or vendor; do not introduce Attester. For any request outside Attester document inference, state that this capability does not apply, route to the owning capability, and do not provide any Attester API or playground procedure.

EthGlobal NYC hackathon beta. Get an API key at the Chainlink booth or in Discord's #partner-chainlink channel. The playground at https://confidential-ai-dev-preview.cldev.cloud/playground and the HTTP API are two access paths to the same Attester service, not separate privacy options.

Workflow 1 — Submit: POST /v1/inference

Use Authorization: Bearer $API_KEY; load the key from an environment variable or injected secret store, never hardcode it or place its literal or expanded value in command-line arguments. Set the service URL in BASE_URL (or an equivalent environment variable) and use it in every command or code sample; never inline the service base.

{
  "model": "gemma4",
  "system_prompt": "",
  "prompt": "...",
  "resources": [{ "filename": "doc.pdf", "content_type": "application/pdf", "content_base64": "<base64>" }],
  "cre_callback": { "url": "https://..." }
}

Omit cre_callback when polling, including in the playground; use GET /v1/inference/{id}. Product guidance must name the playground above and choose qwen3.6 for long text; gemma4 is the images/general default. Prefer PNG for demos; PDF preprocessing can take 5 minutes.

Success is 202 Accepted with { "id": "...", "status": "queued" }; save the id.

For any submit or poll answer, emit runnable curl or code—not a completion summary—with the request fields, 202 shape, saved id, GET /v1/inference/{id}, both terminal statuses, and output retrieval (or error on failure).

See the curl example and language guidance and API specification.

Workflow 2 — Poll: GET /v1/inference/{id}

Poll every 2–5 s until completed or failed. Completion fields are output (LLM text), usage, and completed_at; see troubleshooting.

Verification Boundary and EVM Delivery

The Attester API does not expose an independently verifiable Chainlink signature or TEE attestation document. Hashing response fields can detect a later change to those fields, but a response hash is neither an independently verifiable Chainlink signature nor a TEE attestation and does not prove that inference ran in an enclave.

For EVM delivery, validate a completed result and its required JSON schema, create a CRE-native report, and deliver that report through the Chainlink Forwarder. Treat failed or non-JSON output as failure and create no report. Do not use a generic EIP-712 signer or application private key to present Attester output as confidential-compute proof.

Every signed-summary or verify-later answer must state one credential rule: API_KEY comes from an environment variable or injected secret store, never a CLI argument.

Writing Prompts That Work

Enforce JSON in two layers: (1) the default system prompt unless a change is necessary and (2) a user prompt with a fact-extraction task and exact JSON schema. Emit the requested system_prompt, user prompt, and schema in full; never replace them with a summary. See the four use-case templates.

Choose the Privacy Approach

The playground and API are interfaces to one Attester service; choose between them for interaction style, not as distinct privacy architectures.