Lit Protocol

Lit Protocol is a key management and confidential compute network. Developers use it to sign transactions, encrypt data and run code across Solana, EVM chains and other networks without a private key ever sitting on their own servers. Since April 2026 it has run as Lit V3, codenamed Chipotle. In V3, JavaScript programs called Lit Actions run inside attested Trusted Execution Environment (TEE) hardware, and the rules for which code may use which key live in smart contracts on Base. Developers reach it through a plain REST API and pay $0.01 per second of compute. The pitch is that a backend, a bot or an AI agent can hold a key that can only ask for signatures under rules written as code, rather than a key that can sign anything.

How does Lit Protocol work?

Lit V3 is built from three layers, according to its docs:

• A chain-secured TEE. Requests run inside an enclave hosted on Phala's dstack infrastructure. Lit's verification tooling checks that the API server is running unmodified code inside a genuine Intel TDX enclave. The enclave holds the root key and does all the sensitive work: deriving keys, checking authorisation and running Lit Actions in a sandbox. TLS terminates inside the enclave, so request contents are encrypted all the way in.
• On-chain permissions on Base. An Account contract registers each owner. An API Key Registry maps keys to scopes, a PKP Registry tracks wallet derivation paths, and Groups bind wallets to the Lit Action code (by IPFS content ID) they are allowed to run. In the docs' words, "your keys' authority lives on-chain; an attested TEE enforces it by reading the chain."
• Lit Actions. These are JavaScript (or WebAssembly) programs pinned to IPFS by content ID. An action can call APIs, read any chain and check conditions before it signs or decrypts. Because it is content-addressed, a deployed action can't be quietly swapped for different code.

V3 is a different design from earlier Lit networks. The V3 announcement describes a move "from threshold cryptography to TEE-based execution". Earlier networks split key shares across many nodes that had to agree before signing. Each Chipotle request runs on a single enclave. That makes V3 simpler and cheaper, and it shifts where the trust sits (see the risk section below).

There are two account modes. API Mode is managed through the dashboard and paid by card. ChainSecured ("sovereign") mode makes admin writes as on-chain transactions, so you pay Base gas instead of Stripe fees.

Lit Protocol pricing

The pricing page charges management calls and Lit Action execution at $0.01 per second. A typical ECDSA signature takes under a second, so it costs about one cent. Read-only dashboard and API calls are free. Credits come in one-time packages from $5 (500 credits) to $50 (5,000 credits), and they don't expire. You can pay by card, in ETH, USDC or SOL through Stripe, or in LITKEY on Base, which buys credits at a 25% discount.

Each Lit Action execution is capped at 15 minutes, 64 MB of memory, a 1 MB response, 50 outbound HTTP requests and 10 key or signature requests. Heavier workloads can ask the team for custom limits.

Lit Protocol on Solana: keyless wallets and Ed25519 signing

Lit can sign Solana transactions from inside the enclave. The docs include two worked Solana examples (Lit Action examples):

• Keyless Ed25519 wallet. Each action has an identity key that is a 32-byte secret, and 32 bytes is exactly an Ed25519 seed. The action uses that key as a Solana wallet. It parses each SystemProgram transfer and checks it before signing, so the wallet can only sign what the code allows.
• Threshold FROST co-signer. A 2-of-3 FROST setup where the group key is itself a Solana address. No on-chain program is needed. It has been verified end to end on Solana devnet, and the same pattern covers other Ed25519 chains, Bitcoin Taproot (Schnorr), Zcash and Polkadot.

In practice, an AI agent, a trading bot or a cross-chain solver can read state on one chain and settle on Solana without anyone storing a raw Solana private key. Lit V3 has no Solana program of its own. Its permission contracts live on Base, so Solana only ever sees ordinary transactions signed by Lit-derived keys.

Lit signing policies and backend signing without exposing keys

Lit's own recent guides focus on two uses. With signing policies as code, a JavaScript policy runs in the enclave next to the key and can check a price, a deposit or a ledger before it signs. With backend signing, your server holds an API key that can request signatures but can never extract the wallet key. Lit Triggers start actions on a schedule, on chain events or from webhooks, so automations can run without a server you keep online.

Lit Agent Keychain for Claude Code and MCP servers

Agent Keychain is an open-source app that keeps API credentials away from AI agents. It has two modes:

• Stored secrets. These are encrypted in the browser and released to the agent's child processes.
• Connected services. The agent calls an action such as stripe_balance or github_read_file, Lit runs it in the enclave with the credential, and the agent only gets the result back.

Keychain runs as an MCP server for Claude Code, Cursor or any other MCP client. It is free for five secrets and costs $10 a month for up to a thousand.

Lit confidential AI deployments

On 16 September 2026, Lit extended the Chipotle runtime to AI training, fine-tuning and inference. Workloads run in hardware-isolated confidential VMs whose memory the host, the cloud provider and Lit can't read. Changing the approved software hash is an on-chain transaction on Base, so customers can audit the upgrade history. No public price has been published: AI deployments start with a workload assessment with Lit's team, and self-hosting is offered.

Who is Lit Protocol for?

Lit suits developers and teams automating on-chain actions who don't want a hot key on a server: agent wallets, bots, cross-chain solvers, vaults and escrow logic. It is also for teams building AI agents that need to use credentials without seeing them. The REST API and per-second billing keep the cost of trying it low. One community builder built a Chipotle escrow prototype on Base Sepolia where the payout key exists only inside a Lit Action.

It is not a consumer wallet. There's nothing for an end user to download. You need to be comfortable writing JavaScript policies and trusting a TEE-based service. Teams that want a fully decentralised, threshold-signed network with no single point of hardware trust should note that this is what V3 gave up.

Is Lit Protocol safe? Risks and audits

• Single-enclave trust in V3. Earlier Lit networks needed two-thirds of nodes to agree before signing. Chipotle runs each request in one TEE, so safety rests on the hardware and attestation (Intel TDX, Phala's dstack) and on Lit's code. A hardware-level enclave flaw would be a single point of failure. Lit's bug bounty explicitly excludes platform vulnerabilities in Intel TDX, the dstack OS and Phala Cloud.
• Who can upgrade it. Production code upgrades are approved by a 2-of-4 multisig Safe controlled by Lit on Base, with no timelock: approved changes take effect immediately (upgrade governance). An upgrade needs both a whitelist approval and a separate deployment, and both are public. Phala's own KMS whitelist sits behind a separate 2-of-3 Phala Safe. No single Lit employee can push code alone, but the Lit-controlled Safe can change the code that guards your keys without any delay. Self-hosters can deploy their own governance contract with timelocks or pinned versions.
• Audits. Lit's V3 docs list a bug bounty (reports to [email protected], working proof of concept required) but no published audit of the Chipotle code. We found no V3 audit report.
• Verifiability. The Chipotle repository is open source: the API server, actions runtime, dashboard and contracts. Builds are signed with Sigstore, and anyone can check the enclave's attestation.
• Platform churn. Naga mainnet launched in January 2026 and sunset on 1 April 2026 when V3 arrived, so projects built on Naga had to migrate within about three months. Vincent, the agent-wallet framework built on the earlier network, isn't mentioned in the V3 docs. Check its status before relying on it.

Lit Protocol alternatives and comparison

• Turnkey signs Ed25519 (Solana) and secp256k1 inside AWS Nitro enclaves and enforces wallet rules through a policy engine (Turnkey). It is closest to Lit V3's model. The difference is that Lit's policies are arbitrary JavaScript that can fetch outside data, and its permissions and upgrade history are recorded on-chain.
• Privy focuses on embedded wallets for consumer apps: user login and onboarding rather than programmable, condition-checked signing.
• MPC custody platforms such as Fireblocks split keys across parties and target institutional custody and treasury operations, not developer-written signing logic.

Choose Lit when the signing decision itself has to be code that reads chains or APIs. Choose a wallet-as-a-service provider when you mostly need user wallets and a fixed policy set.

Lit Protocol history and V3 launch

• January 2026: Naga (V1) mainnet launched after a distributed key generation ceremony in December 2025. Naga nodes ran in sealed AMD SEV-SNP VMs and used threshold signing.
• February 2026: Lit announced V3, Chipotle, as a ground-up rebuild with a REST API in place of the SDK.
• 1 April 2026: Naga fully sunset. Delegated stakers and node operators were told to withdraw before the cutoff, and V3 launched.
• September 2026: Lit launched confidential AI deployments and Agent Keychain. On 2 September it said usage was up 5x over the previous two months. Its website now claims more than $50 billion secured.

LITKEY token

LITKEY launched on 30 October 2025 on Aerodrome (Base), with a supply of one billion. At launch it was positioned as a staking token for node operators, a payment token and a governance token (locked as veLITKEY). The allocation was 28% core contributors, 28% veLITKEY emissions, 19% investors, 11% Lit Foundation, 10% community airdrops and 4% Aerodrome incentives. Team and investor tokens were locked for a year, then vest over 24 months.

V3 has no staked node set; Naga staking closed at the sunset. The current docs describe LITKEY only as a payment option with a 25% credit discount. They say nothing about staking or governance. Treat LITKEY as a payment token for the V3 network unless Lit announces otherwise.

Lit Protocol team and funding

Lit Protocol was co-founded by David Sneider (CEO) and Chris Cassano. It has raised $17.7 million in total:

• a $2.2 million seed round from Sfermion and Collab+Currency;
• a $13 million Series A led by 1k(x) and 6MV, with Kleiner Perkins, Slow Ventures, CMT Digital, Gumi Cryptos, Lattice Capital, Longhash Ventures and Shima Capital among the participants;
• a 2025 pre-TGE round that added RRE Ventures, with follow-on from Collab+Currency, Protocol Labs and Village Global.