Production-grade HTTPS ingress for Acurast jobs.
A stable public URL for code sealed inside attested compute — without the operator ever seeing your traffic.
Public alpha APIs and pricing may change.
01 — The problem
Attested compute seals your code on real hardware — but gives it no public URL the world can reach, not while keeping the one rule that makes it confidential: TLS only ever terminates inside the enclave. Three things make that genuinely hard:
01 · network
Behind home routers and carrier NAT — direct inbound from the public internet doesn't work.
02 · enclave
The runtime is locked down — you can't just app.listen() and expose a port.
03 · trust
Someone must terminate TLS and own the cert. If that's the operator, confidentiality is gone.
02 — Transport
A processor behind NAT can't take a direct connection. There are two ways to move bytes to it anyway — and Switchboard runs both, so no processor class is off the table.
The processor dials out and holds the tunnel open; traffic rides back down it. Works anywhere outbound internet does — even deep behind carrier NAT.
A public gateway routes callers straight in by server name — admitted by a cryptographic ceremony, with no extra hop.
03 — The innovation
Each closes a gap where "just trust the operator" would otherwise creep back in — exactly what an enterprise needs to ship in production. Switchboard built all six.
Born inside the enclave — and never leaves.
One signed quote per name — one deployment.
USDC escrow, released per uptime-minute to the operator and validators.
A ceremony picks each route's carrier — with failover.
Validators prove it served — and that gates payment.
Your app, one line to deploy.
04 — How it works
A request reaches your app over a path where no one in the middle can read it. The gateway routes by server name at layer 4 and passes encrypted bytes straight through to TLS that terminates inside the enclave.
The operator never sees plaintext. It carries encrypted bytes between the public internet and the processor — across NAT or direct. TLS only ever terminates inside the sealed enclave, where the key was born and stays.
05 — Proven, then paid
Funds are escrowed up front — but a route only earns once attested validators have signed that it was actually serving. Proof is the gate on the money, and escrow releases per proven minute.
No proof, no pay. Validators run attested code themselves and probe the live route; their signed quorum is what opens the gate. Operators and validators are paid in USDC — a stablecoin, dollars in and dollars out — for each minute that was proven.
06 — Deploy
Install the PROOF CLI, scaffold a project, check the quote, and ship. DNS, certificates, and routing are handled for you.
hello.ingress.works
The full walkthrough, CLI reference, and concepts live in the docs.
Read the docs →