Making requests

Tinfoil’s SecureClient verifies the enclave before sending any data — same attestation flow as Tinfoil’s inference API. Every request is authenticated against the container’s attestation report and TLS certificate. You need two values to connect:

<CONTAINER_URL> — your container’s hostname (e.g. myapp.myorg.containers.tinfoil.dev)
<CONFIG_REPO> — the GitHub repo linked to your container, in org/repo format

The Rust SecureClient constructor retains an API-key argument for inference API compatibility, but raw requests through http_client() do not use it. Pass an empty string for custom containers, then add application authentication to individual requests if your service requires it.

GET requests

from tinfoil import SecureClient

client = SecureClient(
    enclave="<CONTAINER_URL>",
    repo="<CONFIG_REPO>",
)

# Attestation is verified automatically
response = client.get("https://<CONTAINER_URL>/<YOUR_ENDPOINT>")
print(response.status_code)

import tinfoil "github.com/tinfoilsh/tinfoil-go"

client, err := tinfoil.NewSecureClient(
    "<CONTAINER_URL>",
    "<CONFIG_REPO>",
)
if err != nil {
    panic(err)
}

// Attestation is verified automatically
resp, err := client.Get("https://<CONTAINER_URL>/<YOUR_ENDPOINT>")

import { SecureClient } from "tinfoil";

const client = new SecureClient({
    enclaveURL: "https://<CONTAINER_URL>",
    configRepo: "<CONFIG_REPO>",
});

await client.ready();

// Attestation is verified automatically
const response = await client.fetch(
    "https://<CONTAINER_URL>/<YOUR_ENDPOINT>"
);

use tinfoil::SecureClient;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let mut client = SecureClient::new(
        "<CONTAINER_URL>",
        "<CONFIG_REPO>",
        "",
    );
    client.verify().await?;

    // http_client() returns a verified, attestation-pinned reqwest::Client
    let response = client.http_client()?
        .get(format!("https://{}/<YOUR_ENDPOINT>", "<CONTAINER_URL>"))
        .send()
        .await?;
    println!("{}", response.status());
    Ok(())
}

POST requests

import json
from tinfoil import SecureClient

client = SecureClient(
    enclave="<CONTAINER_URL>",
    repo="<CONFIG_REPO>",
)

response = client.post(
    "https://<CONTAINER_URL>/<YOUR_ENDPOINT>",
    headers={"Content-Type": "application/json"},
    body=json.dumps({"key": "value"}).encode(),
)
print(response.status_code)
print(response.body.decode())

import (
    "strings"

    tinfoil "github.com/tinfoilsh/tinfoil-go"
)

client, err := tinfoil.NewSecureClient(
    "<CONTAINER_URL>",
    "<CONFIG_REPO>",
)
if err != nil {
    panic(err)
}

resp, err := client.Post(
    "https://<CONTAINER_URL>/<YOUR_ENDPOINT>",
    "application/json",
    strings.NewReader(`{"key": "value"}`),
)

import { SecureClient } from "tinfoil";

const client = new SecureClient({
    enclaveURL: "https://<CONTAINER_URL>",
    configRepo: "<CONFIG_REPO>",
});

await client.ready();

const response = await client.fetch(
    "https://<CONTAINER_URL>/<YOUR_ENDPOINT>",
    {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({ key: "value" }),
    }
);
const data = await response.json();

use serde_json::json;
use tinfoil::SecureClient;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let mut client = SecureClient::new(
        "<CONTAINER_URL>",
        "<CONFIG_REPO>",
        "",
    );
    client.verify().await?;

    let response = client.http_client()?
        .post(format!("https://{}/<YOUR_ENDPOINT>", "<CONTAINER_URL>"))
        .json(&json!({ "key": "value" }))
        .send()
        .await?
        .error_for_status()?
        .json::<serde_json::Value>()
        .await?;
    println!("{}", response);
    Ok(())
}

The client verifies the enclave is running the expected code from the pinned repo, then pins the TLS certificate for all subsequent requests. If anything doesn’t match, the connection fails.

Using the local proxy

You can also connect to your container with the standalone Tinfoil Proxy CLI (tinfoil-proxy), which runs a local reverse proxy that verifies attestation and forwards requests:

tinfoil-proxy \
  -e <CONTAINER_URL> \
  -r <CONFIG_REPO> \
  -p 3301

Then send requests to http://localhost:3301 as if it were your container:

curl http://localhost:3301/<YOUR_ENDPOINT> \
  -H "Content-Type: application/json" \
  -d '{"key": "value"}'

Using the CLI

For one-off verified requests without running a proxy, use tinfoil http:

tinfoil http post https://<CONTAINER_URL>/<YOUR_ENDPOINT> \
  -e <CONTAINER_URL> \
  -r <CONFIG_REPO> \
  -H "Content-Type: application/json" \
  -b '{"key": "value"}'

Add any other request headers with repeatable -H, --header flags, such as -H "Authorization: Bearer <TOKEN>". If you’ve logged in with tinfoil login, use tinfoil container connect <name> to skip looking up the container URL and config repo by hand — the CLI resolves both from the container name and starts the same verified proxy:

tinfoil container connect my-api -p 3301

The proxy binds to 127.0.0.1 by default. Use --bind <ADDRESS> to choose another interface, for example when connecting from another container:

tinfoil container connect my-api --port 3301 --bind 0.0.0.0

Only bind beyond localhost on a trusted network because other hosts may then send requests through the proxy. See Managing containers from the CLI for the rest of the management surface.

Debug mode containers do not pass attestation. This is by design — debug enclaves trade confidentiality for inspectability.

Getting Started

Model catalog

Tinfoil SDKs

Local Proxy

Tinfoil Containers

Guides

Verification & Attestation

Tutorials

Admin API

Resources

GET requests

POST requests

Using the local proxy

Using the CLI

​GET requests

​POST requests

​Using the local proxy

​Using the CLI

GET requests

POST requests

Using the local proxy

Using the CLI