> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redpill.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Verified ACI Clients

> Verify the TEE workload, pinned TLS channel, and response receipt from native clients.

Using `https://tee.redpill.ai` forces confidential routing, but a base URL alone does not verify the
TEE from your machine. A verified client must check the workload attestation, bind TLS to an attested
key, and verify the signed receipt for the exact request and response bytes.

| Client                                        | Supported integration                                                     |
| --------------------------------------------- | ------------------------------------------------------------------------- |
| Pi                                            | [`pi-provider-redpill`](/guides/integrations/coding-tools/pi)             |
| OpenCode                                      | [`opencode-provider-redpill`](/guides/integrations/coding-tools/opencode) |
| Node or Bun application with a custom `fetch` | `connectAci()`                                                            |
| Base-URL-only client                          | No native ACI verification                                                |

Agent tools, MCP servers, browser automation, and telemetry remain separate trust boundaries.

## Node and Bun

```bash theme={null}
npm install @phala/aci-verifier openai
```

The same API runs on Node 20.18+ and Bun 1.4+. The `/runtime` export selects the pinned transport.

```typescript theme={null}
import OpenAI from "openai";
import { connectAci } from "@phala/aci-verifier/runtime";

const apiKey = process.env.REDPILL_AI_API_KEY;
if (!apiKey) throw new Error("REDPILL_AI_API_KEY is required");

const aci = await connectAci({
  baseURL: "https://tee.redpill.ai/v1",
  policy: { requireProductionOs: true },
  serving: { requireVerified: true, requireReceipt: true },
});

try {
  const client = new OpenAI({ apiKey, baseURL: aci.baseURL, fetch: aci.fetch });
  const response = await client.responses.create({
    model: "z-ai/glm-5.2",
    input: "Reply with exactly: verified",
  });

  const audit = await aci.verifyReceipt();
  if (!audit.transcript.verdict.verified) {
    throw new Error(audit.transcript.verdict.line);
  }
  console.log(response.output_text);
} finally {
  await aci.close();
}
```

Pass `aci.fetch` only to the client instance that uses this gateway. It retains bounded wire digests
and the matching request authorization for private receipt lookup. Audit a response before treating
its serving path as verified.

## Release policy

`requireProductionOs` rejects development and unknown OS measurements. For reviewed-release
enforcement, also pass `acceptedComposeHashes` obtained from authenticated RedPill release metadata.
Do not copy a hash from the endpoint and trust it on first use.

Without a compose allowlist, the client verifies that the measured compose ran in a genuine TDX
workload. It does not claim that RedPill reviewed that release. For a production security decision,
pair compose appraisal with a dstack verifier result for the same quote and require `is_valid: true`.

## Base-URL-only clients

Claude Code, Codex CLI, Cline, and other base-URL-only tools can call the RedPill API, but cannot
inject the attested TLS transport. Do not describe those configurations as locally verified ACI
clients. Add a native adapter only when the host exposes supported provider, transport, credential,
model, and lifecycle hooks.

## Related

* [Verify a response](/guides/verify-a-response)
* [Channel binding](/confidential-ai/channel-binding)
* [Coding agents](/get-started/use-in-agents)
* [ACI verifier source](https://github.com/Dstack-TEE/private-ai-gateway/tree/main/clients/verifier-ts)