Automation

Lit Protocol vs Chainlink CRE

Automate with an address your contracts already accept.

Compare where an automated job’s code runs, how its transactions reach your contracts, and who can change or pause it.

By Lit Protocol · Reviewed November 2, 2026

Scope: Lit Triggers running Lit Actions in ChainSecured mode, and the Chainlink Runtime Environment (CRE), which Chainlink recommends in place of the deprecated Chainlink Automation.

Operator authority

Three questions about operator authority.

Operator authority: Lit Triggers and Actions compared with Chainlink CRE
Control	Lit · Triggers + Actions	Chainlink CRE
Who can change the permissions?	Your account wallet approves on Base which Actions can use each PKP wallet. Lit’s 2-of-4 Safe can upgrade the account contracts without a timelock. Trigger settings, such as the schedule and whether a trigger is enabled, are changed through your Lit Triggers login.[2][3][8][7]	Workflows in the public on-chain registry are managed by transactions from the owner, which can be a multisig. Workflows in Chainlink’s private registry are managed through a CRE login, which Chainlink describes as centralized and off-chain.[6]
Who can approve replacement code?	Each Action version is fixed by its code hash. A new version cannot use a PKP wallet until your account authorizes it. Separately, Lit’s 2-of-4 Safe approves runtime releases, with no timelock.[1][2][8]	The workflow owner deploys new code, and each deployment replaces the previous one. A receiver that pins the expected workflow ID rejects the replacement until the receiver is updated. An organization needs deploy access from Chainlink before its first deployment.[4][9]
Who can stop access?	Lit runs the Triggers service that decides when each job fires, and the operator can pause signing. The service stores your usage key, so it can also run the Actions that key permits. Your permissions stay on-chain, but execution needs the runtime and key-management system. Recovery requires a separate plan.[10][3][11]	The workflow owner can pause a workflow, as can team members with a CRE Developer or Admin role for private-registry workflows. Execution depends on the nodes of the workflow network, and reports reach your contract through Chainlink’s forwarder contract.[12][13]

Who can change the permissions?

Lit · Triggers + Actions: Your account wallet approves on Base which Actions can use each PKP wallet. Lit’s 2-of-4 Safe can upgrade the account contracts without a timelock. Trigger settings, such as the schedule and whether a trigger is enabled, are changed through your Lit Triggers login.[2][3][8][7]
Chainlink CRE: Workflows in the public on-chain registry are managed by transactions from the owner, which can be a multisig. Workflows in Chainlink’s private registry are managed through a CRE login, which Chainlink describes as centralized and off-chain.[6]

Who can approve replacement code?

Lit · Triggers + Actions: Each Action version is fixed by its code hash. A new version cannot use a PKP wallet until your account authorizes it. Separately, Lit’s 2-of-4 Safe approves runtime releases, with no timelock.[1][2][8]
Chainlink CRE: The workflow owner deploys new code, and each deployment replaces the previous one. A receiver that pins the expected workflow ID rejects the replacement until the receiver is updated. An organization needs deploy access from Chainlink before its first deployment.[4][9]

Who can stop access?

Lit · Triggers + Actions: Lit runs the Triggers service that decides when each job fires, and the operator can pause signing. The service stores your usage key, so it can also run the Actions that key permits. Your permissions stay on-chain, but execution needs the runtime and key-management system. Recovery requires a separate plan.[10][3][11]
Chainlink CRE: The workflow owner can pause a workflow, as can team members with a CRE Developer or Admin role for private-registry workflows. Execution depends on the nodes of the workflow network, and reports reach your contract through Chainlink’s forwarder contract.[12][13]

The Lit advantage

Your on-chain rules govern what jobs can sign

A Lit Action signs with a PKP wallet whose key stays in the enclave, so your contracts grant that wallet’s address a role and need no receiver interface. The code that checks each transaction runs next to the key, and your account approves on-chain which code can use that wallet.[1][2][3]

How Lit Triggers works

What control means in practice

In CRE, network nodes sign a report and a Chainlink forwarder delivers it, so your contract trusts the forwarder and checks the workflow’s identity. In Lit, a PKP wallet’s key inside the enclave sends the transaction, and your account controls which code can use that wallet. CRE spreads execution across independent nodes. Lit’s runtime has an operator that can pause signing.[13][6][3]

Shared protections

Both can pin automation code by hash. A CRE workflow ID is derived from its binary and configuration, and a receiver contract can require a specific ID. Both offer cron schedules with a 30-second minimum, HTTP or webhook triggers, and EVM log triggers. CRE also offers optional confidential execution.[4][5][6][7]

Moving from Chainlink Automation

Chainlink deprecated Automation v1.x on June 30, 2026, and v2.1 on July 31, 2026. Chainlink’s migration path is CRE, which delivers results to a receiver contract you deploy, either your own or a bridge that forwards calls to your existing contracts. Contracts that only accept calls from an upkeep forwarder need their allowed caller updated for either destination.[14][15]

Sources and review scope

These comparisons use published documentation and the source code linked below. We have not audited or tested the providers’ live systems. Configurations vary, and source code alone does not establish who currently owns a deployed contract or how it is configured.

Get started with crypto

Explore Lit’s security