Confidential Proxy

# Run without installing (bun or npm)
bunx -p @premai/api-sdk@1.0.59 confidential-proxy --kek "$CLIENT_KEK"
npx -p @premai/api-sdk@1.0.59 confidential-proxy --kek "$CLIENT_KEK"

# Or install globally, then run (confirm your global bin dir is on your PATH)
npm i -g @premai/api-sdk   # or: bun i -g @premai/api-sdk
confidential-proxy --kek "$CLIENT_KEK"

docker pull ghcr.io/premai-io/confidential-proxy:latest

# OpenAI-compatible server on port 8787
docker run -p 8787:8787 \
  -e PROXY_URL=... -e ENCLAVE_URL=... \
  ghcr.io/premai-io/confidential-proxy:latest \
  --kek "$CLIENT_KEK"

# Extra arguments go to the CLI
docker run -p 8787:8787 \
  -e PROXY_URL=... -e ENCLAVE_URL=... \
  ghcr.io/premai-io/confidential-proxy:latest \
  --kek "$CLIENT_KEK" --log-level debug

# Bind host / port
confidential-proxy --host 127.0.0.1 --port 8787 --kek "$CLIENT_KEK"

# Override backend endpoints
confidential-proxy --proxy-url https://gateway.prem.io --enclave-url https://conf-engine.prem.io --kek "$CLIENT_KEK"

# Pass the client KEK from the environment
# The value must be 32 bytes encoded as 64 hexadecimal characters.
confidential-proxy --kek "$CLIENT_KEK"

# Raise the JSON body size limit
confidential-proxy --json-body-limit 64mb --kek "$CLIENT_KEK"

# OpenAI only (default surface)
confidential-proxy --compat openai --kek "$CLIENT_KEK"

# Anthropic only
confidential-proxy --compat anthropic --kek "$CLIENT_KEK"

# Both, with custom prefixes
confidential-proxy --compat both --openai-prefix /openai --anthropic-prefix /anthropic --kek "$CLIENT_KEK"

curl http://127.0.0.1:8787/v1/chat/completions \
  -H "Authorization: Bearer your-api-key" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "glm-5.2",
    "messages": [{"role": "user", "content": "Hello!"}],
    "stream": false
  }'

import OpenAI from "openai";

const client = new OpenAI({
  apiKey: process.env.PREM_API_KEY!,
  baseURL: "http://127.0.0.1:8787/v1",
});

const stream = await client.chat.completions.create({
  model: "glm-5.2",
  messages: [{ role: "user", content: "Count to 10" }],
  stream: true,
});

for await (const chunk of stream) {
  process.stdout.write(chunk.choices[0]?.delta?.content || "");
}

from openai import OpenAI

client = OpenAI(
    api_key="your-api-key",
    base_url="http://127.0.0.1:8787/v1",
)

response = client.chat.completions.create(
    model="glm-5.2",
    messages=[{"role": "user", "content": "Hello, privately."}],
)

print(response.choices[0].message.content)

curl http://127.0.0.1:8787/v1/messages \
  -H "x-api-key: your-api-key" \
  -H "anthropic-version: 2023-06-01" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "glm-5.2",
    "max_tokens": 1024,
    "messages": [{"role": "user", "content": "Hello!"}]
  }'

curl -N http://127.0.0.1:8787/v1/messages \
  -H "x-api-key: your-api-key" \
  -H "anthropic-version: 2023-06-01" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "glm-5.2",
    "max_tokens": 1024,
    "messages": [{"role": "user", "content": "Count to 10"}],
    "stream": true
  }'

confidential-proxy \
  --host 0.0.0.0 --port 8787 \
  --compat anthropic \
  --kek "$CLIENT_KEK" \
  --default-model glm-5.2 \
  --cors-origin https://pivot.claude.ai \
  --tls --tls-cert ./cert.pem --tls-key ./key.pem

# Start in the background, then confirm it's up
confidential-proxy start --compat openai --kek "$CLIENT_KEK"
confidential-proxy status

# Stop it when you're done
confidential-proxy stop