Skip to main content
Encrypted is end-to-end encrypted inference: encryption on your device on top of everything Confidential gives. The concepts are in Encrypted Inference and the wire protocol a client implements is on Protocol. Your client encrypts each message with the model’s public key from a fresh attestation, the gateway relays the ciphertext without decrypting it, and your client decrypts the reply. Supported on POST /v1/chat/completions.

​
The Model

Choose an :encrypted ID from GET /v1/models?privacy_tier=encrypted. The Model List also marks available variants. Fetch current evidence and the model public key from the attestation endpoint before sending a request.

​
The Flow

1

Fetch and verify the attestation

Call GET /api/v1/attestation with the :encrypted model and trust_tier=encrypted. The response carries the model_public_key, signing_algo, and proof_format. Nito checks the key is present and the right shape for the algorithm and hands it to you with the evidence. Confirming the key belongs to the attested workload is part of verifying the evidence, so verify before encrypting with the key. See Verify It Yourself.
2

Encrypt the messages

Generate a key pair for the conversation and encrypt every messages[].content string locally with a fresh ephemeral key, following the protocol variant the attestation’s proof_format identifies (see Protocol). Content must be a nonblank ciphertext string. Content arrays are rejected.
3

Send the request with the Encrypted headers

Send the chat request with the headers below. The gateway checks the ciphertext shape, route eligibility, and request bounds, forwards the request, and returns the encrypted reply.

​
Headers

Sending :encrypted without the headers, or the headers with a model that is not :encrypted, returns 400 invalid_request.

​
What Works

  • Streaming. stream: true returns the provider’s encrypted deltas as a passthrough for your client to reassemble and decrypt.
  • Reasoning. Accepted when the route advertises visible reasoning support. Encrypted responses can carry visible thinking when a model emits it, even if that model does not advertise a reasoning request control. The model list separates output support from API-reported controls; only send reasoning controls when the route advertises them.
  • Function tools, with nito-encrypted-encrypt-all-fields: 1. Function names, descriptions, JSON-schema parameters, tool_choice names, assistant tool-call names and arguments, and tool-result content are all sent as ciphertext hex. Your client decrypts the returned tool call, runs the tool, encrypts the result, and sends the follow-up request.

​
Response Verification

For nonstreaming calls, request Response Evidence to receive the original upstream body bytes and signature proof. Nito returns verified: false; your client checks the signed exchange against independently verified attestation.

​
Rejected

  • Hosted web_search and web_fetch on the Encrypted request, because plaintext evidence cannot be added to an encrypted envelope.
  • Response evidence with stream: true.
  • Content arrays and raw image, file, or document attachment parts.
  • /v1/responses, /v1/messages, /v1/messages/count_tokens, and MCP: Encrypted runs on Chat Completions only.
  • uncensored=true with an :encrypted model.

​
Retention and Billing

The gateway never decrypts, logs, or persists the ciphertext. Usage is estimated from the envelope shape before the call and settled from the provider’s reported usage after it.