Skip to main content
Model Runners are reachable on the public network. The Secure Model Protocol ensures that:
  • Communication between the Coordinator and the Model Runner is encrypted
  • Requests genuinely come from the expected Coordinator
  • The Model Runner is controlled by the on-chain identity (wallet) it claims
It achieves this by combining mTLS, wallet-signed messages, and a rotatable hotkey that binds each TLS certificate to an on-chain identity.

​
How it works

1

Certificate issuance

The Crunch Protocol issues TLS certificates through a private certificate service, signed by the protocol’s Certificate Authority (CA).
2

Mutual TLS (mTLS)

Both the Coordinator and the Model Runner present valid certificates when connecting. The connection is encrypted end-to-end, and both endpoints are authenticated.
3

Wallet binding

A wallet signature binds the TLS public key to an on-chain identity. A rotatable hotkey allows the owner to invalidate old bindings if a key is compromised.
4

Per-request verification

Every gRPC request carries authentication metadata so the receiver can verify the caller’s identity on each call.

​
Authentication message

Each side generates a tls_auth_message containing:
  • The TLS public key (cert_pub)
  • A hotkey value
  • A wallet signature over the message
Every gRPC request then includes:
HeaderDescription
x-auth-messageThe signed authentication message
x-auth-signatureWallet signature over the message
x-auth-wallet-pubkeyWallet public key (debug only — chain is the source of truth)

​
Verification checks

When a request arrives, the receiver validates three things before accepting it:
  1. Wallet signature — verify that x-auth-signature correctly signs x-auth-message, using the wallet public key fetched from the blockchain
  2. TLS certificate binding — confirm that the TLS public key in x-auth-message matches the certificate used in the active mTLS connection
  3. Hotkey validity — confirm that the hotkey in x-auth-message matches the hotkey currently registered on-chain
If any check fails, the request is rejected.

Next: Crunch lifecycle

Understand the full lifecycle of a Crunch — from creation through payout to closure.