Making requests

Tinfoil’s SecureClient verifies the enclave before sending any data, using the same attestation flow as Tinfoil’s inference API. Every request is authenticated against the container’s attestation report and TLS certificate.

Beta: V3 verification in the Go and Swift SDKs and the CLI is still being deployed. The CLI’s verified HTTP, proxy, TCP tunnel, and SSH flows use V3. See Feature status.

You need two values to connect:

<CONTAINER_URL>: your container’s hostname (e.g. myapp.myorg.containers.tinfoil.dev)
<CONFIG_REPO>: the GitHub repo linked to your container, in org/repo format

The Rust SecureClient constructor retains an API-key argument for inference API compatibility, but raw requests through http_client() do not use it. Pass an empty string for custom containers, then add application authentication to individual requests if your service requires it.

GET requests

from tinfoil import SecureClient

client = SecureClient(
    enclave="<CONTAINER_URL>",
    repo="<CONFIG_REPO>",
)

# Attestation is verified automatically
response = client.get("https://<CONTAINER_URL>/<YOUR_ENDPOINT>")
print(response.status_code)

import tinfoil "github.com/tinfoilsh/tinfoil-go"

client, err := tinfoil.NewSecureClient(
    "<CONTAINER_URL>",
    "<CONFIG_REPO>",
)
if err != nil {
    panic(err)
}

// Attestation is verified automatically
resp, err := client.Get("https://<CONTAINER_URL>/<YOUR_ENDPOINT>")

import { SecureClient } from "tinfoil";

const client = new SecureClient({
    enclaveURL: "https://<CONTAINER_URL>",
    configRepo: "<CONFIG_REPO>",
});

await client.ready();

// Attestation is verified automatically
const response = await client.fetch(
    "https://<CONTAINER_URL>/<YOUR_ENDPOINT>"
);

use tinfoil::SecureClient;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let mut client = SecureClient::new(
        "<CONTAINER_URL>",
        "<CONFIG_REPO>",
        "",
    );
    client.verify().await?;

    // http_client() returns a verified, attestation-pinned reqwest::Client
    let response = client.http_client()?
        .get(format!("https://{}/<YOUR_ENDPOINT>", "<CONTAINER_URL>"))
        .send()
        .await?;
    println!("{}", response.status());
    Ok(())
}

POST requests

import json
from tinfoil import SecureClient

client = SecureClient(
    enclave="<CONTAINER_URL>",
    repo="<CONFIG_REPO>",
)

response = client.post(
    "https://<CONTAINER_URL>/<YOUR_ENDPOINT>",
    headers={"Content-Type": "application/json"},
    body=json.dumps({"key": "value"}).encode(),
)
print(response.status_code)
print(response.body.decode())

import (
    "strings"

    tinfoil "github.com/tinfoilsh/tinfoil-go"
)

client, err := tinfoil.NewSecureClient(
    "<CONTAINER_URL>",
    "<CONFIG_REPO>",
)
if err != nil {
    panic(err)
}

resp, err := client.Post(
    "https://<CONTAINER_URL>/<YOUR_ENDPOINT>",
    "application/json",
    strings.NewReader(`{"key": "value"}`),
)

import { SecureClient } from "tinfoil";

const client = new SecureClient({
    enclaveURL: "https://<CONTAINER_URL>",
    configRepo: "<CONFIG_REPO>",
});

await client.ready();

const response = await client.fetch(
    "https://<CONTAINER_URL>/<YOUR_ENDPOINT>",
    {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({ key: "value" }),
    }
);
const data = await response.json();

use serde_json::json;
use tinfoil::SecureClient;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let mut client = SecureClient::new(
        "<CONTAINER_URL>",
        "<CONFIG_REPO>",
        "",
    );
    client.verify().await?;

    let response = client.http_client()?
        .post(format!("https://{}/<YOUR_ENDPOINT>", "<CONTAINER_URL>"))
        .json(&json!({ "key": "value" }))
        .send()
        .await?
        .error_for_status()?
        .json::<serde_json::Value>()
        .await?;
    println!("{}", response);
    Ok(())
}

The client verifies the enclave is running the expected code from the pinned repo, then pins the TLS certificate for all subsequent requests. If anything doesn’t match, the connection fails.

Using the local proxy

You can also connect to your container with the standalone Tinfoil Proxy CLI (tinfoil-proxy), which runs a local reverse proxy that verifies attestation and forwards requests:

tinfoil-proxy \
  -e <CONTAINER_URL> \
  -r <CONFIG_REPO> \
  -p 3301

Then send requests to http://localhost:3301 as if it were your container:

curl http://localhost:3301/<YOUR_ENDPOINT> \
  -H "Content-Type: application/json" \
  -d '{"key": "value"}'

Using the CLI

For one-off verified requests without running a proxy, use tinfoil http:

tinfoil http post https://<CONTAINER_URL>/<YOUR_ENDPOINT> \
  -e <CONTAINER_URL> \
  -r <CONFIG_REPO> \
  -H "Content-Type: application/json" \
  -b '{"key": "value"}'

Add any other request headers with repeatable -H, --header flags, such as -H "Authorization: Bearer <TOKEN>". If you’ve logged in with tinfoil login, use tinfoil container connect <name> to skip looking up the container URL and config reference by hand. The CLI resolves both from the container name, checks the resolved config against your local connection policy — by default the first connect asks you to confirm (or is pre-seeded by container create); allowed configs pass silently — and starts the same verified proxy:

tinfoil container connect my-api -p 3301

The proxy binds to 127.0.0.1 by default. Use --bind <ADDRESS> to choose another interface, for example when connecting from another container:

tinfoil container connect my-api --port 3301 --bind 0.0.0.0

Only bind beyond localhost on a trusted network because other hosts may then send requests through the proxy.

Native SSH

For a workload serving an attested SSH host key on a direct SSH endpoint, install a verified profile and use your native client:

tinfoil attest-ssh my-container --install
ssh my-container

See Attested SSH for server prerequisites, login identities, printing a profile, and refreshing it after an enclave reboot.

TCP tunnels and SSH

container connect proxies HTTP. For raw TCP, such as a database port or SSH, use tinfoil forward and tinfoil ssh. Both open a tunnel over the enclave’s attested TLS connection, so the peer is pinned to the verified enclave rather than trusted on first use. The enclave only accepts a tunnel to a port that one of its containers publishes in tinfoil-config.yml. The enclave authenticates the tunnel with an inference API key (tk_...), not the admin key you used for tinfoil login. Set the tunnel key with TINFOIL_TUNNEL_API_KEY or --api-key. To look up the container by name, TINFOIL_ADMIN_KEY takes precedence; TINFOIL_API_KEY overrides the saved admin login only when its value starts with admin_. An inference key in TINFOIL_API_KEY does not replace the saved admin credential. See credential precedence.

export TINFOIL_TUNNEL_API_KEY=tk_...

# Forward local port 5432 to the container's port 5432
tinfoil forward my-api -L 5432:5432

# Multiple ports, and a custom bind address
tinfoil forward my-api -L 5432:5432 -L 0.0.0.0:8080:8080

-L takes [bind:]<local-port>:<enclave-port> and may be repeated. The target is a container name or ID, which the CLI looks up with your admin login and checks against your connection policy — the same check as container connect, also applied by ssh and scp — or a bare enclave hostname (anything containing a dot). A hostname target requires --repo owner/repo to select the expected workload; both target forms require workload attestation verification. A live session stays pinned to the config it was verified against at the start. When the container is updated, the session fails closed with a certificate-mismatch error rather than migrating to the new config — reconnect, and the connection policy applies to the new config there. tinfoil ssh wraps your local ssh with a ProxyCommand that runs tinfoil forward --stdio:

tinfoil ssh my-api
tinfoil ssh my-api -l app -- systemctl status my-service

Arguments after -- are passed to ssh. -l sets the remote user (default root) and -p the enclave-side port; the port defaults to the container’s published SSH port, or 22 if none is known. Because the attested tunnel pins the peer, the CLI disables SSH host key checking for the session. Both commands refuse to tunnel into a container running in debug mode, because the debug toolbox puts an interactive shell inside the enclave. Pass --allow-debug to override. See Managing containers from the CLI for the rest of the management surface.

Debug mode containers do not pass attestation. This is by design: debug enclaves trade confidentiality for inspectability.

Getting Started

Model catalog

Tinfoil SDKs

Tinfoil Chat

Local Proxy

Tinfoil Containers

Guides

Verification & Attestation

Tutorials

Admin API

Resources

GET requests

POST requests

Using the local proxy

Using the CLI

Native SSH

TCP tunnels and SSH

​GET requests

​POST requests

​Using the local proxy

​Using the CLI

​Native SSH

​TCP tunnels and SSH

GET requests

POST requests

Using the local proxy

Using the CLI

Native SSH

TCP tunnels and SSH