VoltageGPU is a Confidential AI Infrastructure platform. We provide hardware-sealed GPU pods (Intel TDX, H100 / H200 / B200) and an OpenAI-compatible inference API for confidential TEE LLMs such as DeepSeek-V3.2-TEE, Qwen3-32B-TEE and Qwen3.5-397B-TEE.

Is the VoltageGPU Inference API OpenAI compatible?

Yes. The Inference API is fully OpenAI-compatible. Point any existing OpenAI SDK at https://api.voltagegpu.com/v1 to run prompts against confidential TEE LLMs.

Which models does the Inference API expose?

The Inference API exposes confidential TEE LLMs only: DeepSeek-V3.2-TEE (Enterprise), Qwen3.5-397B-TEE (Plus / Team Starter / Pro) and Qwen3-32B-TEE (Free). All inference runs inside Intel TDX enclaves with hardware attestation.

Docs / AI coding agents

VoltageGPU for AI coding agents

If you code with an assistant such as Claude Code, Cursor, GitHub Copilot or Codex, it can manage VoltageGPU for you: deploy a Confidential VM, a standard GPU pod, a bare metal machine or a sandbox, wait until it answers over SSH, check the attestation, release it, and call the inference API. Everything it needs is in one Markdown file, written as instructions to the agent: https://voltagegpu.com/coding-agents.md.

Set it up in three steps

Create two keys at voltagegpu.com/api-keys: a GPU Pods key (volt_...) and, for inference, an AI Inference key (vgpu_...). Keys are shown once. Your agent cannot create them: that route needs your dashboard session.
Put them in environment variables, never in the repository: VOLT_API_KEY and VOLTAGEGPU_API_KEY.
Paste the block below into the AGENTS.md or CLAUDE.md of your project.

## VoltageGPU
- Before any VoltageGPU call, read https://voltagegpu.com/coding-agents.md and follow it.
- Keys come from environment variables only: VOLT_API_KEY (volt_..., GPU pods, header X-API-Key)
  and VOLTAGEGPU_API_KEY (vgpu_..., inference, header Authorization: Bearer). Never print,
  log, commit or paste a key. Never create or revoke keys: the user does it at
  https://voltagegpu.com/api-keys.
- Ask me before anything that spends money: say the machine, the hourly price, that one hour
  is charged at deploy, and the automatic stop you will set. Wait for a yes.
- Keep a list of every pod, VM, bare metal machine and sandbox you create, and release each one
  when the task ends or fails. Powering a machine off from inside does not stop billing.
- Only Confidential VMs are confidential. Standard pods, bare metal and sandboxes have no enclave.

What the agent can do

Machine	Create	Ready when	Release	Enclave
Confidential VM (Intel TDX)	`POST /api/volt/pods, provider "confidential", resource_name from GET /api/volt/machines`	GET /api/volt/pods until ssh_ready is true (about two minutes)	`DELETE /api/volt/pods/{workloadUid}`	Yes
Standard GPU pod	`POST /api/volt/pods, provider "standard", machine_id from GET /api/volt/machines?provider=standard`	GET /api/volt/pods/{id} until ssh_command is set	`DELETE /api/volt/pods/{id}`	No
Dedicated bare metal	`POST /api/volt/pods, provider "dedicated", machine_id from GET /api/volt/machines?provider=dedicated`	GET /api/volt/pods, entry with tier "dedicated" (15 to 25 minutes)	`DELETE /api/volt/pods/{id}`	No
Sandbox (CPU only)	`POST /api/volt/sandboxes`	In seconds; sshCommand in the answer or in GET /api/volt/sandboxes	`DELETE /api/volt/sandboxes/{id}`	No

All of these take the X-API-Key header on https://api.voltagegpu.com. Inference is at https://api.voltagegpu.com/v1 with Authorization: Bearer and the vgpu_ key (OpenAI-compatible, models listed by GET /v1/models). Bare metal needs a verified account with at least $100 of card top-ups (the first one more than 14 days old, none disputed) and runs one machine at a time; sandboxes need a verified email and one card payment. Either offer can be closed, in which case the API answers 403 FEATURE_DISABLED.

What the file makes the agent do

Never print, log or commit a key; read it from the environment.
Ask you before any spending: machine, hourly price, the hour charged at deploy, the automatic stop it will set.
Set an automatic stop on everything it creates (hardstop_hours, auto_terminate_hours, deleteTimeoutSec) and release everything at the end, or after an error.
Never deploy again after an uncertain answer ("charged": true or a timeout) without listing your pods first.
Never call a standard pod, a bare metal machine or a sandbox confidential.

Billing, in short

Prepaid balance. One hour is charged when a deploy succeeds, then billing is per second.
Released within that hour, the unused seconds go back to the balance. Bare metal always bills 15 minutes.
Halting a machine from inside does not stop billing; a release or the automatic stop does.
When the balance can no longer pay, running machines are stopped and their data is lost.

Verified, and not verified

NVIDIA GPU attestation from inside a Confidential VM is verified on four SKUs only: single-GPU H200, the 8x H100 node (NVSwitch not verified), single-GPU H100 and single-GPU RTX PRO 6000 Blackwell. The deploy answer says it in attestation.verified. See the Confidential VM guide.
Standard pods, dedicated bare metal and sandboxes have no enclave and no attestation.
Confidential CPU servers (AMD EPYC) are not verified by us and not deployable at the moment.
Inference attestation (GET /v1/attestation) proves confidential hardware answering your nonce, not which instance served a given response.

Files for agents

Instructions for the agent: https://voltagegpu.com/coding-agents.md (Markdown, served as is).
OpenAPI description of the endpoints: https://voltagegpu.com/openapi-voltagegpu.yaml.
Site summary for AI assistants: https://voltagegpu.com/llms.txt.
Human reference with every field: Volt API reference.
MCP server for the Confidential VM flow: voltagegpu.com/mcp-server-confidential.

Volt API reference

Every endpoint, field and error code.

Confidential VM

Intel TDX, attestation you verify yourself.