Confidential AI API: Secure LLM Inference at Scale

Encrypted Chat Completions (RVENC)

curl --request POST \
  --url https://gateway.prem.io/rvenc/chat/completions \
  --header 'Authorization: <api-key>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "encryptedInference": "<string>",
  "cipherText": "<string>",
  "nonce": "<string>"
}
'

import requests

url = "https://gateway.prem.io/rvenc/chat/completions"

payload = {
    "encryptedInference": "<string>",
    "cipherText": "<string>",
    "nonce": "<string>"
}
headers = {
    "Authorization": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({encryptedInference: '<string>', cipherText: '<string>', nonce: '<string>'})
};

fetch('https://gateway.prem.io/rvenc/chat/completions', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://gateway.prem.io/rvenc/chat/completions",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'encryptedInference' => '<string>',
    'cipherText' => '<string>',
    'nonce' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: <api-key>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://gateway.prem.io/rvenc/chat/completions"

	payload := strings.NewReader("{\n  \"encryptedInference\": \"<string>\",\n  \"cipherText\": \"<string>\",\n  \"nonce\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://gateway.prem.io/rvenc/chat/completions")
  .header("Authorization", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"encryptedInference\": \"<string>\",\n  \"cipherText\": \"<string>\",\n  \"nonce\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://gateway.prem.io/rvenc/chat/completions")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"encryptedInference\": \"<string>\",\n  \"cipherText\": \"<string>\",\n  \"nonce\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "stream": "<string>",
  "_decryptedChunk": {
    "id": "<string>",
    "object": "chat.completion.chunk",
    "created": 123,
    "model": "<string>",
    "choices": [
      {
        "index": 123,
        "delta": {
          "content": "<string>",
          "reasoning_content": "<string>",
          "tool_calls": [
            {}
          ]
        },
        "logprobs": null,
        "matched_stop": null
      }
    ],
    "system_fingerprint": "<string>",
    "usage": null,
    "error": {
      "message": "<string>",
      "type": "<string>"
    }
  }
}

{
  "error": "<string>",
  "message": null,
  "log": "<string>",
  "support_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "data": {},
  "validator": {}
}

{
  "status": 401,
  "error": "<string>",
  "message": null,
  "log": "<string>",
  "support_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "data": {},
  "validator": {}
}

{
  "status": 403,
  "error": "<string>",
  "message": null,
  "log": "<string>",
  "support_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "data": {},
  "validator": {}
}

{
  "status": 123,
  "error": "<string>"
}

POST

rvenc

chat

completions

Encrypted Chat Completions (RVENC)

curl --request POST \
  --url https://gateway.prem.io/rvenc/chat/completions \
  --header 'Authorization: <api-key>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "encryptedInference": "<string>",
  "cipherText": "<string>",
  "nonce": "<string>"
}
'

import requests

url = "https://gateway.prem.io/rvenc/chat/completions"

payload = {
    "encryptedInference": "<string>",
    "cipherText": "<string>",
    "nonce": "<string>"
}
headers = {
    "Authorization": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({encryptedInference: '<string>', cipherText: '<string>', nonce: '<string>'})
};

fetch('https://gateway.prem.io/rvenc/chat/completions', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://gateway.prem.io/rvenc/chat/completions",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'encryptedInference' => '<string>',
    'cipherText' => '<string>',
    'nonce' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: <api-key>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://gateway.prem.io/rvenc/chat/completions"

	payload := strings.NewReader("{\n  \"encryptedInference\": \"<string>\",\n  \"cipherText\": \"<string>\",\n  \"nonce\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://gateway.prem.io/rvenc/chat/completions")
  .header("Authorization", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"encryptedInference\": \"<string>\",\n  \"cipherText\": \"<string>\",\n  \"nonce\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://gateway.prem.io/rvenc/chat/completions")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"encryptedInference\": \"<string>\",\n  \"cipherText\": \"<string>\",\n  \"nonce\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "stream": "<string>",
  "_decryptedChunk": {
    "id": "<string>",
    "object": "chat.completion.chunk",
    "created": 123,
    "model": "<string>",
    "choices": [
      {
        "index": 123,
        "delta": {
          "content": "<string>",
          "reasoning_content": "<string>",
          "tool_calls": [
            {}
          ]
        },
        "logprobs": null,
        "matched_stop": null
      }
    ],
    "system_fingerprint": "<string>",
    "usage": null,
    "error": {
      "message": "<string>",
      "type": "<string>"
    }
  }
}

{
  "error": "<string>",
  "message": null,
  "log": "<string>",
  "support_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "data": {},
  "validator": {}
}

{
  "status": 401,
  "error": "<string>",
  "message": null,
  "log": "<string>",
  "support_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "data": {},
  "validator": {}
}

{
  "status": 403,
  "error": "<string>",
  "message": null,
  "log": "<string>",
  "support_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "data": {},
  "validator": {}
}

{
  "status": 123,
  "error": "<string>"
}

TypeScript SDK

The SDK is available on GitHub: premAI-io/api-sdk-ts

Basic Setup

Create a client with auto-generated encryption keys:

import createRvencClient from "@premai/api-sdk";

const client = await createRvencClient({
  apiKey: process.env.PREM_API_KEY,
  clientKEK: process.env.CLIENT_KEK
});

Pre-generate Keys

You can pre-generate encryption keys and reuse them:

import createRvencClient, { generateEncryptionKeys } from "@premai/api-sdk";

const encryptionKeys = await generateEncryptionKeys();

const client = await createRvencClient({
  apiKey: process.env.PREM_API_KEY,
  encryptionKeys,
  requestTimeoutMs: 60000,  // optional
  maxBufferSize: 20 * 1024 * 1024, // optional
});

Non-streaming Requests

const response = await client.chat.completions.create({
  model: "deepseek-v4-pro",
  messages: [{ role: "user", content: "Hello!" }],
});

Streaming Requests

const stream = await client.chat.completions.create({
  model: "deepseek-v4-pro",
  messages: [{ role: "user", content: "Hello!" }],
  stream: true,
});

for await (const chunk of stream) {
  process.stdout.write(chunk.choices[0]?.delta?.content || "");
}

Configuration

Option	Default	Description
`apiKey`	required	Authorization token
`encryptionKeys`	auto-generated	Pre-generated `{ sharedSecret, cipherText }`
`requestTimeoutMs`	30000	Request timeout in ms
`maxBufferSize`	10MB	Max SSE buffer size

OpenAI-Compatible API Server

Run the SDK as a standalone server. The server automatically manages one DEK store for each API key:

bunx -p @premai/api-sdk confidential-proxy
# Server runs on http://127.0.0.1:8000

Use the server with any OpenAI-compatible client:

curl http://127.0.0.1:8000/v1/chat/completions \
  -H "Authorization: Bearer your-api-key" \
  -H "Content-Type: application/json" \
  -d '{"model": "deepseek-v4-pro", "messages": [{"role": "user", "content": "Hello!"}], "stream": false}'

You can also use the SDK directly in Node.js:

import OpenAI from "openai";

const client = new OpenAI({
  apiKey: process.env.PREM_API_KEY,
  baseURL: "http://127.0.0.1:8000/v1",
});

const stream = await client.chat.completions.create({
  model: "deepseek-v4-pro",
  messages: [{ role: "user", content: "Count to 10" }],
  stream: true,
});

for await (const chunk of stream) {
  process.stdout.write(chunk.choices[0]?.delta?.content || "");
}

The server caches clients in memory for each API key. This increases performance.

API Reference

Authorizations

Authorization

string

header

required

Send your access token as header Authorization: Bearer {accessToken}

Authorization

string

header

required

Your API key that starts with sk_live or sk_test. You can create yours at go.prem.io/api-keys.

Body

application/json

Request body for rvenc (raw volatile encrypted) chat completion. Contains an encrypted payload with cryptographic materials needed for decryption.

encryptedInference

string

required

Encrypted JSON string containing all chat completion parameters. When decrypted, this string must match the structure shown in the expandable _decryptedInference property below (reference only - do not send this property).

cipherText

string

required

Cipher text for shared secret generation (ECDH key exchange)

nonce

string

required

Nonce used for encrypting the inference payload

Response

Server-sent events stream with encrypted OpenAI-compatible chat completion chunks. Each chunk in the stream is encrypted and must be decrypted using the same shared secret and nonce from the request.

Server-sent events (SSE) stream response structure. The actual response is a text stream, but this schema documents the structure for reference.

stream

string

required

Server-sent events (SSE) stream with encrypted chat completion chunks. The stream contains three types of events:

event: data followed by data: <encrypted_hex_string> - Encrypted chunk that must be decrypted using the same shared secret and nonce from the request. When decrypted, each chunk matches the structure shown in the _decryptedChunk property below (reference only).
event: error followed by data: <error_data> - Error event (can be encrypted or plain JSON)
event: done followed by data: [DONE] - Stream completion marker

Each encrypted data: line contains a hex-encoded string. Decrypt each chunk using XChaCha20-Poly1305 with the shared secret and nonce from your request.

_decryptedChunk

object

read-only

Reference only - This shows the structure that each encrypted chunk should contain when decrypted. Decrypt each chunk in the stream using the same shared secret and nonce from your request to get this structure.

Show child attributes

Examples:

{
  "id": "cd9d05b657a041a6a14ab2fc890a7d7e",
  "object": "chat.completion.chunk",
  "created": 1764004858,
  "model": "openai/gpt-oss-120b",
  "choices": [
    {
      "index": 0,
      "delta": {
        "role": null,
        "content": null,
        "reasoning_content": "This ",
        "tool_calls": null
      },
      "logprobs": null,
      "finish_reason": null,
      "matched_stop": null
    }
  ],
  "usage": null
}

{
  "id": "cd9d05b657a041a6a14ab2fc890a7d7e",
  "object": "chat.completion.chunk",
  "created": 1764004858,
  "model": "openai/gpt-oss-120b",
  "choices": [
    {
      "index": 0,
      "delta": {
        "role": "assistant",
        "content": "Hello",
        "reasoning_content": null,
        "tool_calls": null
      },
      "logprobs": null,
      "finish_reason": null,
      "matched_stop": null
    }
  ],
  "usage": null
}

{
  "id": "cd9d05b657a041a6a14ab2fc890a7d7e",
  "object": "chat.completion.chunk",
  "created": 1764004858,
  "model": "openai/gpt-oss-120b",
  "choices": [
    {
      "index": 0,
      "delta": [],
      "logprobs": null,
      "finish_reason": "stop",
      "matched_stop": null
    }
  ],
  "usage": null
}

Use LLMs Encrypted Audio Transcriptions (RVENC)

Get Started

Core Concepts

Handling Errors

Guides

API Reference

Billing

Support

Encrypted Chat Completions (RVENC)

TypeScript SDK

Basic Setup

Pre-generate Keys

Non-streaming Requests

Streaming Requests

Configuration

OpenAI-Compatible API Server

API Reference

Authorizations

Body

Response

​TypeScript SDK

​Basic Setup

​Pre-generate Keys

​Non-streaming Requests

​Streaming Requests

​Configuration

​OpenAI-Compatible API Server

​API Reference

Authorizations

Body

Response

TypeScript SDK

Basic Setup

Pre-generate Keys

Non-streaming Requests

Streaming Requests

Configuration

OpenAI-Compatible API Server

API Reference