Verify a relay returned the official response
Paste an API response that carries a proof into the verifier below. It checks the signature in your browser and tells you which official upstream host the response came from and whether the relay changed it. Your data never leaves your computer.
- Stays in your browser
- Open-source verifier
- Free, no sign-up
Verify a response in three steps
- 1
Turn on verification for your key
On the API page, turn on "Official verification" for the key. Only raw passthrough Claude Messages and GPT Responses responses carry a proof.
- 2
Save the whole response
Send a streaming request and save the response bytes as-is; it should end with event: tee.proof. For non-streaming requests, add the header x-wokey-tee-proof-mode: multipart and save the whole multipart response.
- 3
Paste it into the verifier
Paste or drop the full response into the verifier below and start the check. It runs in your browser on this page and makes no network requests.
curl -sN https://api.wokey.ai/v1/messages \
-H "x-api-key: YOUR_API_KEY" \
-H "anthropic-version: 2023-06-01" \
-H "Content-Type: application/json" \
-d '{"model":"claude-sonnet-5","max_tokens":256,"stream":true,"messages":[{"role":"user","content":"Hello"}]}' \
-o captured-responseThe verifier above is published straight from the open-source repo on GitHub Pages and never passes through Wokey servers, so Wokey cannot swap in one that always says "pass". You can also save the page and open it offline.
The verifier asks you to check PCR0, the measurement of the enclave image. Use the value published in the open-source repo, which anyone can reproduce from source, not a value that arrives with the response.
Reading the result
- All checks pass
- The attestation chains to the AWS Nitro root, PCR0 matches the published value, the signature is valid, and the response bytes match the signed hash. The upstream host shown (for example api.anthropic.com) is where the response came from, and the relay did not change it.
- Proof valid, response body missing
- You pasted only the tee.proof event. The proof was signed by a real enclave, but without the body the hash cannot be recomputed, so this does not show the content you saw is unchanged. Paste the whole response.
- PCR0 mismatch
- The attestation is genuine, but the enclave is not running the audited image. Treat the response as unproven.
- Signature or hash check fails
- The proof or the response was altered, or bytes were lost when copying. Save the raw response again; if it still fails, do not trust it.
- No tee.proof
- The response is unproven: the key may not have verification on, the request went through a format conversion, or the enclave was unavailable. Treat it as unproven.
Checking other relays: what each method catches and misses
Without an upstream signature, only indirect checks are possible. They surface obvious problems, but the best result is "nothing suspicious found", never "confirmed official". Here are the common methods and their limits.
| Method | How | Catches | Misses |
|---|---|---|---|
| Token counts | How: Send the same fixed prompt to the same model on the official API and on the relay, and compare input_tokens in usage. | Catches: A model from another vendor: tokenizers differ across vendors, so the counts will clearly disagree. | Misses: Models from one vendor often share a tokenizer, so a cheaper model from the same family goes unnoticed. You also need an official reference count. |
| Prompt caching | How: Send the same prefix, longer than the model's minimum cacheable length, twice. Check that the second response reports cache_read_input_tokens and is billed at the cache-read rate. | Catches: A backend that is not the official upstream, or a relay that breaks caching but still bills full price. | Misses: A cache hit only shows the backend supports caching, not which model it is. |
| Long context | How: Send text close to the advertised context limit with one key fact hidden in the middle, then ask about it. | Catches: A smaller-context model posing as the real one, or a relay that silently truncates history. | Misses: A correct answer does not prove the model version, and this check costs the most tokens. |
| Protocol details | How: Compare the streaming event order (message_start to message_stop), message id format, headers and error shapes with the official docs. | Catches: Crude wrappers that force another model's output into the Claude format. | Misses: Every one of these fields is easy to fake; a careful wrapper matches them exactly. |
Methods not to rely on
- Asking the model "who are you" or "what is your knowledge cutoff": official models often get this wrong themselves, and a relay can make any model claim to be Claude with a system prompt.
- Judging answer quality or speed by feel: prompts, load and randomness swing both too much; treat it as a hint only.
Why there is no one-click scanner for any relay
- A scan has to send requests with your API key for that relay. Routing them through our servers would mean handing us another service's key, which we do not want to hold.
- Calling the relay straight from the browser fails because most relays do not allow cross-origin requests.
- The checks above can only say "suspicious" or "nothing found". Packaging them as a score would look authoritative and mislead.
Relay self-check checklist
Before picking a relay, or when you suspect the one you use, check in this order:
- Does the response carry an upstream proof you can verify offline? If so, is the signed upstream host official, for example api.anthropic.com for Claude?
- Do input_tokens for a fixed prompt match the official API?
- After repeating a long prefix, does the response report cache reads, and is it billed at the cache rate?
- Is context close to the advertised limit handled without truncation?
- Does the relay say publicly where its upstream comes from and whether it logs or stores request content?
- If a relay cannot be verified, do not send it secrets, customer data or other sensitive content.
What a proof shows and what it does not
Shows
- Which official upstream host the response came from.
- The response bytes are exactly what the upstream returned, including the model field; the relay changed nothing.
- The enclave runs an image built from public source (PCR0 is reproducible).
Does not show
- Confidentiality: the relay still handles plaintext while forwarding.
- Responses without a proof, such as format-converted requests and image generation.
- Replay of an old response between byte-identical requests.
FAQ
Is the response I paste uploaded anywhere?
No. The verifier is a front-end-only page that checks signatures with the browser's built-in WebCrypto and makes no network requests. You can confirm this in the network tab of your browser's developer tools, or save the verifier and use it offline.
Are AI API relays legal?
It depends on the laws where you and the relay operate and on the upstream provider's terms of use, which differ by region and by provider; this page is not legal advice. Read the upstream terms and your local rules before using one, especially for sensitive or regulated data. This tool answers one question that can be checked technically: whether the response you received is the official upstream's original.
How can I tell if a relay serves a "dumbed-down" model?
A model that feels worse through a relay is usually down to one of: a silent swap to a cheaper model, truncated conversation history, a lower output limit, or thinking turned off. A proven response rules out the first: the signature covers the upstream's original bytes, so the model field comes from the official API. Truncation and parameter changes happen on the request side, which the response proof does not cover; the long-context and token-count checks above help there.
What is the difference between a Claude mirror site and the official site?
The official products are claude.ai and the Anthropic API. A mirror site is a third-party chat page that may use the official API, shared accounts or another vendor's model, with its own features and privacy policy, and users usually cannot tell which. If you use the API from tools like Claude Code or Cursor, the question is about API relays, and the test is the same: can it give you an upstream proof you can verify yourself?
What if the response has no tee.proof?
Check that "Official verification" is on for the key and that you are calling a raw passthrough route, Claude Messages or GPT Responses. Format-converted requests, such as Claude over Chat Completions, never carry a proof. If the enclave is temporarily unavailable the request falls back and that response has no proof either. Treat any response without a proof as unproven.
Can I use this tool to verify other relays?
The verifier only checks responses that carry a Proof-of-Observation proof. The protocol is open source and any relay can implement it; for relays that have not, only the indirect checks above apply, and the best result is "nothing suspicious found".