Confidential AI API: Secure LLM Inference at Scale

Goose has a built-in OpenAI provider that accepts a custom host and Chat Completions path. Point it at Prem’s local Confidential Proxy and select a Prem model ID.

Goose and its extensions run on your machine. Prem protects supported model traffic after the local proxy encrypts it. File, shell, browser, MCP, and extension execution remain outside the Prem confidential runtime.

Confidential API
Router (Beta)

Use the local Confidential Proxy for sensitive model traffic. Go to the confidential setup.

Confidential API

How the connection works

Before you start

You need:

Goose installed. See the official installation guide.
A Prem API key. See API Keys.
A 32-byte client KEK encoded as 64 hexadecimal characters.
The current Prem gateway and enclave endpoints.
A chat model returned by your Prem model-list request.

Check the installed version:

goose --version

The commands below have been exercised with Goose 1.45.0 using a normal response and a local shell-tool call.

1. Set your secrets

export PREM_API_KEY="your-prem-api-key"
export CLIENT_KEK="your-64-character-hex-kek"
export PROXY_URL="https://gateway.prem.io"
export ENCLAVE_URL="https://conf-engine.prem.io"

Generate the KEK once if you do not have one:

openssl rand -hex 32

Store both secrets outside the repository. Do not place the API key in Goose’s config.yaml.

2. Start the Confidential Proxy

npx -p @premai/api-sdk@1.0.59 confidential-proxy \
  --host 127.0.0.1 \
  --port 8787 \
  --compat openai \
  --kek "$CLIENT_KEK"

Do not use --no-attest. Keep attestation enabled for confidential inference.

3. Select an enabled model

curl http://127.0.0.1:8787/v1/models \
  -H "Authorization: Bearer $PREM_API_KEY"

Use a returned id. This example uses qwen36-27b:

curl http://127.0.0.1:8787/v1/chat/completions \
  -H "Authorization: Bearer $PREM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "qwen36-27b",
    "messages": [{"role": "user", "content": "Reply with OK."}],
    "stream": false
  }'

4. Configure Goose

Set Goose’s OpenAI provider variables in the shell that starts it:

export GOOSE_PROVIDER="openai"
export GOOSE_MODEL="qwen36-27b"
export OPENAI_API_KEY="$PREM_API_KEY"
export OPENAI_HOST="http://127.0.0.1:8787"
export OPENAI_BASE_PATH="v1/chat/completions"

OPENAI_HOST contains the origin. OPENAI_BASE_PATH contains the Chat Completions path without a leading slash. A wrong path usually returns 404. Goose documents this pattern under custom OpenAI endpoints. The API key remains in the process environment instead of ~/.config/goose/config.yaml.

5. Run Goose

Run one chat-only request first:

GOOSE_MODE=chat goose run \
  --no-session \
  --text "Reply with exactly OK. Do not use tools."

Then test a tool-capable session in a controlled workspace:

GOOSE_MODE=approve goose run \
  --with-builtin developer \
  --text "Read README.md and summarize its first heading."

Use approve while evaluating commands. Goose can stream model output through the Chat Completions connection. A model-produced tool call returns through the encrypted model channel; Goose executes the tool locally.

Tool and extension boundary

Component	Plaintext access	Notes
Goose	Yes	Reads prompts, workspace files, instructions, and tool results
Confidential Proxy	Yes, locally	Encrypts model requests and decrypts responses
Prem API Gateway	No content access	Receives ciphertext and operational metadata
Prem confidential runtime	Yes, inside the protected runtime	Runs inference and encrypts the result
Built-in or MCP extension	Depends on the tool	Uses its own permissions, credentials, storage, and network path

Limit enabled extensions, review permission mode, and run Goose from the narrowest required workspace.

Agent limits

The encrypted chat endpoint permits one active stream for each API key. Concurrent Goose sessions, recipes, or subagents using the same key can receive 429 responses. Start with one session. Serialize model turns or use a separate Prem API key per concurrent worker. Do not switch to another provider if every model call must use Prem.

Troubleshooting

Goose returns 404 from the provider

Set OPENAI_HOST to http://127.0.0.1:8787 and OPENAI_BASE_PATH to v1/chat/completions. Do not put /v1 in both values.

Goose reports that no API key was passed

Export OPENAI_API_KEY="$PREM_API_KEY" in the same process that starts Goose. Goose does not read provider API keys from config.yaml.

The API returns model not found

Call /v1/models, then set GOOSE_MODEL to a returned ID.

The tool prompt is skipped or denied

Check GOOSE_MODE, the enabled extension, and its permissions. Use approve during setup instead of bypassing tool confirmation.

The API returns 429

Wait for the active stream to finish. Reduce concurrent sessions, recipes, and subagents or use separate API keys.

Frequently asked questions

Does Goose need a custom provider plugin?

No. Its built-in OpenAI provider supports a custom host and Chat Completions path.

Is Goose itself inside the Prem enclave?

No. Goose runs locally. Only supported model traffic uses the encrypted Prem path.

Are extension calls confidential?

Not automatically. The model call is protected through Prem, but each local or remote extension has its own trust boundary.

Can I persist these settings?

You can persist non-secret provider values in your shell or Goose configuration. Keep OPENAI_API_KEY in a secret manager or injected environment variable.

Router

Beta

Router is not confidential. Use this path only for non-sensitive prompts, workspace context, and extension results.

Goose uses Router through its built-in OpenAI provider and a separate API key. Confirm that kimi-k3 appears in GET /v1/models for this key. Otherwise, use an exact returned model ID. See Router models.

export PREM_ROUTER_API_KEY="your-router-api-key"
export GOOSE_PROVIDER="openai"
export GOOSE_MODEL="kimi-k3"
export OPENAI_API_KEY="$PREM_ROUTER_API_KEY"
export OPENAI_HOST="https://router.prem.io"
export OPENAI_BASE_PATH="v1/chat/completions"

Run a bounded request before enabling tools:

GOOSE_MODE=chat goose run \
  --no-session \
  --text "Reply with exactly: router ok"

This provider does not use the local proxy or KEK. See the Router Goose configuration and Router models.

Confidential Proxy

Review proxy modes, routes, keys, and daemon controls.

OpenAI-compatible clients

Understand the protocol used by Goose.

Agents & Automation

Review concurrency, retries, and unattended operation.

Security Model

Review the protected and unprotected parts of the flow.

Get Started

Router

Core Concepts

Handling Errors

Guides

API Reference

Billing

Support

Goose

Confidential API

How the connection works

Before you start

1. Set your secrets

2. Start the Confidential Proxy

3. Select an enabled model

4. Configure Goose

5. Run Goose

Tool and extension boundary

Agent limits

Troubleshooting

Frequently asked questions

Does Goose need a custom provider plugin?

Is Goose itself inside the Prem enclave?

Are extension calls confidential?

Can I persist these settings?

Router

Confidential Proxy

OpenAI-compatible clients

Agents & Automation

Security Model

​Confidential API

​How the connection works

​Before you start

​1. Set your secrets

​2. Start the Confidential Proxy

​3. Select an enabled model

​4. Configure Goose

​5. Run Goose

​Tool and extension boundary

​Agent limits

​Troubleshooting

​Frequently asked questions

​Does Goose need a custom provider plugin?

​Is Goose itself inside the Prem enclave?

​Are extension calls confidential?

​Can I persist these settings?

​Router

​Related

Confidential Proxy

OpenAI-compatible clients

Agents & Automation

Security Model

Confidential API

How the connection works

Before you start

1. Set your secrets

2. Start the Confidential Proxy

3. Select an enabled model

4. Configure Goose

5. Run Goose

Tool and extension boundary

Agent limits

Troubleshooting

Frequently asked questions

Does Goose need a custom provider plugin?

Is Goose itself inside the Prem enclave?

Are extension calls confidential?

Can I persist these settings?

Router

Related