Lit Protocol

Lit Protocol is a key management and confidential compute network. Developers use it to sign transactions, encrypt data and run code on Solana, EVM chains and other networks. The private key never sits on their own servers. Since April 2026 it has run as Lit V3, codenamed Chipotle. In V3, small JavaScript programs called Lit Actions run inside secure, attested hardware (a Trusted Execution Environment, or TEE). The rules for which code may use which key live in smart contracts on Base. Developers call it through a plain REST API and pay $0.01 per second of compute. The pitch is simple: a server, bot or AI agent gets a key that can only ask for signatures, under rules written as code. It never holds a key that can sign anything.

How does Lit Protocol work? Chipotle, Lit Actions and the REST API

Lit V3 is built from three layers, according to its docs:

• A chain-secured TEE. Requests run inside an enclave hosted on Phala's dstack infrastructure. Lit's verification tooling checks that the API server is running unmodified code inside a genuine Intel TDX enclave. The enclave holds the root key and does all the sensitive work: deriving keys, checking authorisation and running Lit Actions in a sandbox. TLS terminates inside the enclave, so request contents are encrypted all the way in.
• On-chain permissions on Base. An Account contract registers each owner. An API Key Registry maps keys to scopes, a PKP Registry tracks wallet derivation paths, and Groups bind wallets to the Lit Action code (by IPFS content ID) they are allowed to run. In the docs' words, "your keys' authority lives on-chain; an attested TEE enforces it by reading the chain."
• Lit Actions. These are JavaScript (or WebAssembly) programs pinned to IPFS by content ID. An action can call APIs, read any chain and check conditions before it signs or decrypts. Because it is content-addressed, a deployed action can't be quietly swapped for different code.

V3 is a different design from earlier Lit networks. The V3 announcement describes a move "from threshold cryptography to TEE-based execution". Earlier networks split key shares across many nodes that had to agree before signing. Each Chipotle request runs on a single enclave. That makes V3 simpler and cheaper, and it shifts where the trust sits (see the risk section below).

V3 also dropped the client SDK that earlier Lit networks used. Everything goes through HTTP calls to the REST API. Lit's wallet API guide (5 October 2026) adds a wallet to an app in six calls: create a wallet, create a group, write a signing rule, connect them, issue a key for your server, and sign.

There are two account modes. API Mode is managed through the dashboard and paid by card. ChainSecured ("sovereign") mode makes admin writes as on-chain transactions, so you pay Base gas instead of Stripe fees.

Lit Protocol pricing and credits

The pricing page charges $0.01 per second for Lit Action execution and $0.01 per management call (creating, updating or deleting resources). A typical ECDSA signature takes under a second, so it costs about one cent. Read-only calls are free. Credits come in packages of $5, $10, $25 and $50 (500 to 5,000 credits), and they don't expire. When the balance runs out, the API returns a 402 Payment Required error. You can pay by card, in ETH, USDC, SOL and other tokens through Stripe, or in LITKEY on Base, which buys credits at a 25% discount. Enterprise pricing is available for higher volumes.

Each Lit Action execution is capped at 15 minutes, 64 MB of memory, a 1 MB response, 50 outbound HTTP requests and 10 key or signature requests. Heavier workloads can ask the team for custom limits.

Lit Protocol on Solana: keyless wallets and Ed25519 signing

Lit can sign Solana transactions from inside the enclave. The docs include two worked Solana examples (Lit Action examples):

• Keyless Ed25519 wallet. Each action has an identity key that is a 32-byte secret, and 32 bytes is exactly an Ed25519 seed. The action uses that key as a Solana wallet. It parses each SystemProgram transfer and checks it before signing, so the wallet can only sign what the code allows.
• Threshold FROST co-signer. A 2-of-3 FROST setup where the group key is itself a Solana address. No on-chain program is needed. It has been verified end to end on Solana devnet, and the same pattern covers other Ed25519 chains, Bitcoin Taproot (Schnorr), Zcash and Polkadot.

The same action key works on Ethereum too. A 19 October 2026 guide shows that the key is a standard secp256k1 key, which Ethereum uses as it is, while the same 32 bytes seed a Solana keypair. One action therefore controls an Ethereum address and a Solana address. There is a catch: both addresses belong to that exact version of the code. Change the code and you get two new addresses, so each version needs a built-in way to move funds out.

In practice, an AI agent, a trading bot or a cross-chain solver can read state on one chain and settle on Solana without anyone storing a raw Solana private key. Lit V3 has no Solana program of its own. Its permission contracts live on Base, so Solana only ever sees ordinary transactions signed by Lit-derived keys.

Lit Protocol encryption: encrypting and decrypting secrets

Encryption is still part of V3, though it works differently from the access control conditions earlier Lit versions were known for. The examples use Lit.Actions.Encrypt and Lit.Actions.Decrypt with a PKP wallet's key. Only an action that is permitted on-chain to use that PKP can decrypt the data. Who can decrypt is decided by the code, not by a separate rules list.

The docs build on this with a confidential dark pool. Orders sit as ciphertext in an ordinary Postgres database, and at the end of each epoch a Lit Action decrypts the batch inside the TEE and clears it in a single-price sealed-bid auction.

Lit signing policies, backend signing and Lit Triggers

Lit's own guides focus on a few uses. With signing policies as code, a JavaScript policy runs in the enclave next to the key and can check a price, a deposit or a ledger before it signs. With backend signing, your server holds an API key that can request signatures but can never extract the wallet key.

Lit Triggers start actions on a schedule, on chain events or from webhooks, so automations can run without a server you keep online. A 14 October 2026 guide builds a trading bot this way: a Lit Action that Triggers runs every hour, checks the price, follows limits written into its code, and signs with a key only that code can use.

Lit Agent Keychain for Claude Code and MCP servers

Agent Keychain is an open-source app that keeps API credentials away from AI agents. It has two modes:

• Stored secrets. These are encrypted in the browser and released to the agent's child processes.
• Connected services. The agent calls an action such as stripe_balance or github_read_file, Lit runs it in the enclave with the credential, and the agent only gets the result back.

Keychain runs as an MCP server for Claude Code, Cursor or any other MCP client. It is free for five secrets and costs $10 a month for up to a thousand.

Lit confidential AI deployments

On 16 September 2026, Lit extended the Chipotle runtime to AI training, fine-tuning and inference. Workloads run in sealed virtual machines. The host, the cloud provider and Lit can't read their memory. Changing the approved software is an on-chain transaction on Base, so customers can audit every upgrade.

In October Lit explained how it limits where an agent's data can go (22 October 2026). The agent runs in a Google Cloud confidential VM (Intel TDX). A proxy inside the VM only lets it reach the hostnames the deployment lists. Only port 443 is allowed, and wildcards are not. The list is part of what the hardware attests to. Adding a destination needs a new release, and that release doesn't run until the customer approves it on-chain.

No public price has been published: AI deployments start with a workload assessment with Lit's team, and self-hosting is offered.

Who is Lit Protocol for?

Lit suits developers and teams automating on-chain actions who don't want a hot key on a server: agent wallets, bots, cross-chain solvers, vaults and escrow logic. It is also for teams building AI agents that need to use credentials without seeing them. The REST API and per-second billing keep the cost of trying it low.

Lit's website names Relay Protocol, Tria, Emblem Vault, Beacon Protocol, Genius and Treasure DAO among the teams building with it. One community builder built a Chipotle escrow prototype on Base Sepolia where the payout key exists only inside a Lit Action.

It is not a consumer wallet. There's nothing for an end user to download. You need to be comfortable writing JavaScript policies and trusting a TEE-based service. Teams that want a fully decentralised, threshold-signed network with no single point of hardware trust should note that this is what V3 gave up.

Is Lit Protocol safe? Risks, audits and upgrade control

• Single-enclave trust in V3. Earlier Lit networks needed two-thirds of nodes to agree before signing. Chipotle runs each request in one TEE, so safety rests on the hardware and attestation (Intel TDX, Phala's dstack) and on Lit's code. A hardware-level enclave flaw would be a single point of failure. Lit's bug bounty explicitly excludes platform vulnerabilities in Intel TDX, the dstack OS and Phala Cloud.
• Who can upgrade it. Production code upgrades are approved by a 2-of-4 multisig Safe controlled by Lit on Base, with no timelock: approved changes take effect immediately (upgrade governance). An upgrade needs both a whitelist approval and a separate deployment, and both are public. Phala's own KMS whitelist sits behind a separate 2-of-3 Phala Safe. No single Lit employee can push code alone, but the Lit-controlled Safe can change the code that guards your keys without any delay. Self-hosters can deploy their own governance contract with timelocks or pinned versions.
• Audits. Lit's V3 docs list a bug bounty (reports to [email protected], working proof of concept required) but no published audit of the Chipotle code. Its website doesn't cite one either. We found no V3 audit report.
• Verifiability. The Chipotle repository is open source: the API server, actions runtime, dashboard and contracts. Builds are signed with Sigstore. Lit's verification guide sets out four checks anyone can run: verify the attestation, match it to a public build, confirm TLS ends in the enclave, and look up who approved the code on Base.
• Code-bound addresses. A Lit Action's wallet addresses change whenever its code changes. A bug fix means new addresses, so funds held by an old version need a planned exit path written into that version.
• Platform churn. Naga mainnet launched in January 2026 and sunset on 1 April 2026 when V3 arrived, so projects built on Naga had to migrate within about three months. Vincent, the agent-wallet framework built on the earlier network, isn't mentioned in the V3 docs. Check its status before relying on it.

Lit Protocol alternatives: Turnkey, Privy and MPC custody

• Turnkey signs Ed25519 (Solana) and secp256k1 inside AWS Nitro enclaves and enforces wallet rules through a policy engine (Turnkey). It is closest to Lit V3's model. The difference is that Lit's policies are arbitrary JavaScript that can fetch outside data, and its permissions and upgrade history are recorded on-chain.
• Privy focuses on embedded wallets for consumer apps: user login and onboarding rather than programmable, condition-checked signing.
• MPC custody platforms such as Fireblocks split keys across parties and target institutional custody and treasury operations, not developer-written signing logic.

Choose Lit when the signing decision itself has to be code that reads chains or APIs. Choose a wallet-as-a-service provider when you mostly need user wallets and a fixed policy set.

Lit Protocol history: Naga, Vincent and the V3 launch

• January 2026: Naga (V1) mainnet launched after a distributed key generation ceremony in December 2025. Naga nodes ran in sealed AMD SEV-SNP VMs and used threshold signing.
• February 2026: Lit announced V3, Chipotle, as a ground-up rebuild with a REST API in place of the SDK.
• 1 April 2026: Naga fully sunset. Delegated stakers and node operators were told to withdraw before the cutoff, and V3 launched.
• September 2026: Lit launched confidential AI deployments and Agent Keychain. On 2 September it said usage was up 5x over the previous two months. Its website now claims more than $50 billion secured.
• October 2026: Lit published the network allowlist for confidential AI agents and a run of developer guides covering the wallet API, signer verification and dual Ethereum and Solana wallets.

LITKEY token: staking, airdrop and price

LITKEY launched on 30 October 2025 on Aerodrome (Base), with a supply of one billion. Don't confuse it with LIT, the token of the Lighter perpetuals exchange, which has no connection to Lit Protocol.

At launch LITKEY was positioned as a staking token for node operators, a payment token and a governance token (locked as veLITKEY). The allocation was 28% core contributors, 28% veLITKEY emissions, 19% investors, 11% Lit Foundation, 10% community airdrops and 4% Aerodrome incentives. Team and investor tokens were locked for a year, then vest over 24 months.

V3 has no staked node set; Naga staking closed at the sunset. The current docs describe LITKEY only as a payment option with a 25% credit discount. They say nothing about staking or governance. Treat LITKEY as a payment token for the V3 network unless Lit announces otherwise.

Lit Protocol founders and funding

Lit Protocol was co-founded by David Sneider (CEO) and Chris Cassano. It has raised $17.7 million in total:

• a $2.2 million seed round from Sfermion and Collab+Currency;
• a $13 million Series A led by 1k(x) and 6MV, with Kleiner Perkins, Slow Ventures, CMT Digital, Gumi Cryptos, Lattice Capital, Longhash Ventures and Shima Capital among the participants;
• a 2025 pre-TGE round that added RRE Ventures, with follow-on from Collab+Currency, Protocol Labs and Village Global.