Confidential AI API: Secure LLM Inference at Scale

OpenCode is a coding assistant that runs in your terminal. This guide connects it to Prem API. Prem runs the model inside a secure enclave. Your prompts stay private on the way there.

OpenCode does not use the TypeScript SDK directly. It uses the OpenAI-compatible routes from the Confidential Proxy. The proxy is part of @premai/api-sdk.

Confidential API
Router (Beta)

Use the local Confidential Proxy for sensitive prompts and source code. Go to the confidential setup.

Confidential API

How the connection works

OpenCode and the Confidential Proxy stay on your machine. The Prem API Gateway sees only the sealed message. The Prem API Enclave opens it inside a Trusted Execution Environment (TEE).

Before you start

Get these four things ready:

OpenCode, installed. See the OpenCode install guide.
A Prem API key. This proves who you are. See API Keys.
A client Key Encryption Key (KEK). This is a master key that protects your other keys.
A model that your Prem account can use. See Models & Pricing.

The API key and the KEK are two different secrets. The API key handles sign-in, limits, and billing. The KEK protects your encryption keys. Keep both safe.

1. Set your secrets

Open a terminal. Set these values in the terminal that runs the proxy:

export PREM_API_KEY="your-prem-api-key"
export CLIENT_KEK="your-64-character-hex-kek"
export PROXY_URL="https://gateway.prem.io"
export ENCLAVE_URL="https://conf-engine.prem.io"

Do you not have a KEK yet? Make one, one time only:

openssl rand -hex 32

Store the KEK in a secret manager. Keep a backup. Use the same KEK every time. Do not make a new one each time you start the proxy.

PROXY_URL and ENCLAVE_URL show the current default endpoints. Check the Prem dashboard if the endpoints change.

2. Start the Confidential Proxy

Start the proxy in OpenAI mode. Keep this terminal open while you work:

npx -p @premai/api-sdk@1.0.59 confidential-proxy \
  --host 127.0.0.1 \
  --port 8787 \
  --compat openai \
  --kek "$CLIENT_KEK"

The proxy now listens at http://127.0.0.1:8787/v1. OpenCode sends its requests there.

3. Do a proxy test

Send one request before you start OpenCode:

curl http://127.0.0.1:8787/v1/chat/completions \
  -H "Authorization: Bearer $PREM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "glm-5.2",
    "messages": [{"role": "user", "content": "Reply with OK."}],
    "reasoning_effort": "none",
    "max_completion_tokens": 128,
    "stream": false
  }'

Use a different model ID if your account does not have glm-5.2. Inspect the response model field. The requested alias glm-5.2 currently resolves to zai-org/GLM-5.2. The response does not include an assurance-profile field. See Platform Status. Do not continue if this request does not complete. See Errors and Rate limits.

4. Configure OpenCode

Create opencode.json in the project root:

{
  "$schema": "https://opencode.ai/config.json",
  "model": "prem-confidential/glm-5.2",
  "small_model": "prem-confidential/glm-5.2",
  "enabled_providers": ["prem-confidential"],
  "share": "disabled",
  "provider": {
    "prem-confidential": {
      "npm": "@ai-sdk/openai-compatible",
      "name": "Prem API through the Confidential Proxy",
      "options": {
        "baseURL": "http://127.0.0.1:8787/v1",
        "apiKey": "{env:PREM_API_KEY}",
        "timeout": 600000,
        "chunkTimeout": 60000
      },
      "models": {
        "glm-5.2": {
          "name": "GLM 5.2"
        }
      }
    }
  },
  "permission": {
    "edit": "ask",
    "bash": "ask"
  }
}

Here is what each part does:

Setting	What it does
`baseURL`	Sends OpenCode’s requests to your local proxy.
`apiKey`	Reads the Prem API key from your terminal.
`model` and `small_model`	Uses Prem for big and small tasks.
`enabled_providers`	Uses Prem only. No other provider.
`share: disabled`	Does not create public chat links.
`permission`	Asks you before it edits files or runs shell commands.

This follows the OpenCode custom provider docs. Change glm-5.2 to the model your account uses. Change it in both model and models.

5. Start OpenCode

Start OpenCode from the folder that has opencode.json:

opencode

Send a short prompt, such as “Say hello.” Watch the proxy terminal. You see the request arrive. That is it. OpenCode now talks to Prem through the sealed path.

Type /models in OpenCode to check the model. The provider shows as Prem API through the Confidential Proxy.

What this setup protects

Component	Reads your text	Notes
OpenCode	Yes	It reads your prompt, your code, and the tool results on your machine.
Confidential Proxy	Yes, on your machine	It seals requests and opens replies.
Prem API Gateway	No	It handles the sealed message and metadata only.
Prem API Enclave	Yes, inside the TEE	It opens the request, runs the model, and seals the reply.
External tool or MCP server	Depends on the tool	A tool reads the data that OpenCode sends to it.

This setup protects the model path only. It does not put OpenCode, your code, shell commands, plugins, MCP servers, or local files inside the enclave.

Good to know

Tool calls run on your machine. The model can ask OpenCode to run a tool. The model traffic uses the sealed path. But OpenCode runs the tool on your machine, outside the enclave. So keep the edit and bash permissions set to ask. Do not treat a private model as a private tool. One stream at a time. The encrypted endpoint allows one active stream for each API key. A second stream on the same key can return 429. Start with one OpenCode session and no parallel subagents. Need parallel workers? Run them one after another, or give each worker its own API key. See Agents & Automation.

Troubleshooting

OpenCode cannot connect

Check that the proxy runs at 127.0.0.1:8787. Check that baseURL ends with /v1.

The proxy returns 401

Check that PREM_API_KEY is correct. Check that the API key is active.

The API says model not found

Change glm-5.2 to a model your account can use. Change it in model and in models.

The API returns 429

Wait for the active stream to finish. Reduce parallel work. Follow the Retry-After header if the response has one.

OpenCode shows a different provider

Check that enabled_providers lists only prem-confidential. Restart OpenCode after you change opencode.json.

Frequently asked questions

Does OpenCode use the Prem TypeScript SDK?

No. The local proxy gives OpenCode an OpenAI-compatible interface. OpenCode does not import the SDK.

Is the API key the same as the KEK?

No. The API key handles access, limits, and billing. The KEK protects your encryption keys.

Does this protect my whole OpenCode session?

No. It protects the model path. OpenCode and its local tools stay on your machine.

Can OpenCode use tool calls?

Yes, when the selected model supports tool calls. The model traffic uses the encrypted path. OpenCode runs each tool outside the enclave.

Router

Beta

Router is not confidential. Do not send secrets, private source code, personal data, or regulated data through this path.

Router uses a separate OpenCode provider. It does not use the Confidential Proxy, client KEK, or attestation path.

export PREM_ROUTER_API_KEY="your-router-api-key"

Confirm that kimi-k3 appears in GET /v1/models for this key. Otherwise, use an exact returned model ID. See Router models. Add the prem provider from the Router OpenCode configuration. Use https://router.prem.io/v1 as the base URL and start with prem/kimi-k3 as the model selector. Keep the provider names separate when both paths are configured:

Path	Provider	Key	Data boundary
Confidential API	`prem-confidential`	`PREM_API_KEY`	Encrypted through the local proxy
Router	`prem`	`PREM_ROUTER_API_KEY`	Not confidential

Confidential Proxy

Learn the proxy modes, routes, keys, and daemon controls.

Agents & Automation

Review concurrency, retries, reasoning, and error controls.

OpenAI-compatible clients

Understand the compatibility layer that OpenCode uses.

Security Model

Learn what the enclave protects and what stays outside the TEE.

Production Checklist

Complete the key, reliability, capacity, and attestation checks.

Platform Status

Review current behavior, assurance gaps, and roadmap items.

Get Started

Router

Core Concepts

Handling Errors

Guides

API Reference

Billing

Support

OpenCode

Confidential API

How the connection works

Before you start

1. Set your secrets

2. Start the Confidential Proxy

3. Do a proxy test

4. Configure OpenCode

5. Start OpenCode

What this setup protects

Good to know

Troubleshooting

Frequently asked questions

Does OpenCode use the Prem TypeScript SDK?

Is the API key the same as the KEK?

Does this protect my whole OpenCode session?

Can OpenCode use tool calls?

Router

Confidential Proxy

Agents & Automation

OpenAI-compatible clients

Security Model

Production Checklist

Platform Status

​Confidential API

​How the connection works

​Before you start

​1. Set your secrets

​2. Start the Confidential Proxy

​3. Do a proxy test

​4. Configure OpenCode

​5. Start OpenCode

​What this setup protects

​Good to know

​Troubleshooting

​Frequently asked questions

​Does OpenCode use the Prem TypeScript SDK?

​Is the API key the same as the KEK?

​Does this protect my whole OpenCode session?

​Can OpenCode use tool calls?

​Router

​Related

Confidential Proxy

Agents & Automation

OpenAI-compatible clients

Security Model

Production Checklist

Platform Status

Confidential API

How the connection works

Before you start

1. Set your secrets

2. Start the Confidential Proxy

3. Do a proxy test

4. Configure OpenCode

5. Start OpenCode

What this setup protects

Good to know

Troubleshooting

Frequently asked questions

Does OpenCode use the Prem TypeScript SDK?

Is the API key the same as the KEK?

Does this protect my whole OpenCode session?

Can OpenCode use tool calls?

Router

Related